EventCatalog Ltd

Processing of Support Data

Summary​

• Annex 1: Details of processing
• Annex 2: Technical and organisational measures
• Annex 3: Sub-processors for Support Data

1. Parties​

1.1 EventCatalog Ltd, a private limited company registered in England and Wales (company number 15764703), whose registered office is at 55 Broadgate Lane, Deeping St James, Peterborough, PE6 8NN, United Kingdom ("EventCatalog"). EventCatalog is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC269123.

1.2 The customer that has entered into the Main Agreement ("Customer").

1.3 This Data Processing Agreement ("DPA") forms part of the Main Agreement and applies automatically from the start of the Main Agreement. EventCatalog will countersign a copy on request.

2. Definitions​

"Data Protection Laws" means the UK GDPR and the Data Protection Act 2018 and, where they apply to the processing, Regulation (EU) 2016/679 (the "EU GDPR") and laws implementing or supplementing it.

"EU SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

"Main Agreement" means the contract under which EventCatalog licenses its software and provides support to the Customer: the EventCatalog Standard Terms together with the Customer's Order (such as a signed EventCatalog Business Order Form or an online purchase), or an EventCatalog Enterprise Agreement together with the Standard Terms it incorporates. "Order", "Standard Terms", "Enterprise Agreement" and "Subscription Term" have the meanings given in the Standard Terms.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Support Data.

"Privacy Policy" means EventCatalog's privacy policy at https://www.eventcatalog.dev/privacy.

"Sub-processor" means a third party engaged by EventCatalog to process Support Data.

"Subprocessors Section" means the Subprocessors section of the Privacy Policy, at https://www.eventcatalog.dev/privacy#subprocessors.

"Support Data" means personal data that the Customer chooses to give EventCatalog, or lets EventCatalog see, for a support request, including during access to the Customer's self-hosted environment that the Customer has expressly agreed to.

"UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

"controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the Data Protection Laws.

3. Order of precedence​

3.1 If this DPA and the Main Agreement conflict on a data protection matter relating to Support Data, this DPA prevails over every part of the Main Agreement, including the Customer's Order (for an Enterprise Agreement, the order details in Parts A to E), consistent with clause 1.8 of the Standard Terms. For all other matters, the Main Agreement applies.

3.2 If the EU SCCs or the UK Addendum apply under clause 10, they prevail over this DPA to the extent of any conflict.

4. Scope and roles​

4.1 Support Data​

For Support Data, the Customer is the controller and EventCatalog is its processor. If the Customer is itself a processor for another controller, EventCatalog is the Customer's sub-processor, and the Customer confirms that its controller has authorised this.

4.2 Outside this DPA​

EventCatalog is an independent controller, under its Privacy Policy, for all other personal data it holds about the Customer and its personnel, including EventCatalog Cloud account data (including invited team members), license data, billing data, correspondence, product usage telemetry and website analytics. Data held in the Customer's self-hosted catalog is not processed by EventCatalog and is outside this DPA.

4.3 Customer obligations​

The Customer is responsible for having a lawful basis for sharing Support Data, will share only the Support Data needed to resolve a support request, and will not share special category data or criminal offence data.

5. EventCatalog's obligations​

EventCatalog will:

1. Instructions. Process Support Data only to resolve the Customer's support request and otherwise on the Customer's documented instructions (including for transfers outside the UK or EEA), unless the law requires otherwise, in which case EventCatalog will tell the Customer first unless the law prohibits it. EventCatalog will tell the Customer if it believes an instruction infringes Data Protection Laws.
2. Confidentiality. Ensure that everyone it authorises to process Support Data is bound by a duty of confidentiality and has access only as needed for the support request.
3. Security. Implement and maintain the technical and organisational measures in Annex 2, as required by Article 32 of the UK GDPR and EU GDPR. EventCatalog may update them, provided the overall level of protection is not materially reduced.
4. Sub-processors. Engage Sub-processors only in accordance with clause 6.
5. Data subject rights. Taking into account the nature of the processing, assist the Customer by appropriate measures, so far as possible, to respond to requests from data subjects. EventCatalog will pass any request it receives about Support Data to the Customer without undue delay.
6. Assistance. Taking into account the nature of the processing and the information available to it, give the Customer reasonable assistance with its obligations under Articles 32 to 36 of the UK GDPR and EU GDPR (security, breach notification, data protection impact assessments and prior consultation), normally by providing EventCatalog's security documentation and answering reasonable written questions.
7. Deletion or return. Delete or return Support Data as set out in clause 8.
8. Information and audits. Make available the information needed to demonstrate compliance with this clause 5 and Article 28 of the UK GDPR and EU GDPR, and allow for and contribute to audits as set out in clause 9.

EventCatalog's data protection contact is support@eventcatalog.dev. EventCatalog has not appointed a Data Protection Officer because one is not required for its processing.

6. Sub-processors​

6.1 The Customer gives EventCatalog general written authorisation to engage Sub-processors. The Sub-processors used for Support Data on the date of this DPA are listed in Annex 3, and all of EventCatalog's subprocessors are listed in the Subprocessors Section.

6.2 EventCatalog will put a written contract in place with each Sub-processor that gives at least the same level of protection as this DPA, and remains liable to the Customer for each Sub-processor's performance.

6.3 EventCatalog gives notice of any addition or replacement of a Sub-processor by updating the Subprocessors Section before the new Sub-processor starts processing Support Data. That update is the notice of the change, and EventCatalog does not send individual notices.

6.4 The Customer may object to a new Sub-processor on reasonable data protection grounds by emailing support@eventcatalog.dev within 30 days after the Subprocessors Section is updated. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may stop sharing Support Data with EventCatalog, and EventCatalog will delete the Customer's existing Support Data under clause 8.

7. Personal Data Breach​

7.1 EventCatalog will notify the Customer without undue delay, and in any case within 72 hours of becoming aware of a Personal Data Breach.

7.2 The notice will describe, as far as the information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at first will be provided in phases without further undue delay. EventCatalog will take reasonable steps to contain the breach and will cooperate with the Customer so that it can meet its own notification obligations.

8. Deletion or return​

8.1 EventCatalog deletes or returns Support Data within 30 days after the related support request is resolved.

8.2 The Customer may also ask, by emailing support@eventcatalog.dev, for Support Data to be deleted or returned at any time, and EventCatalog will do so within 30 days of the request and confirm when it is done.

8.3 EventCatalog may keep Support Data where the law requires it to, in which case clauses 5(b) and 5(c) continue to apply to it.

9. Audits​

9.1 The Customer's audit and information rights are satisfied by EventCatalog providing its security documentation (the Security Pack), answering a reasonable written security questionnaire (on the Business plan, EventCatalog's standard questionnaire; on the Enterprise plan, the Customer's own, as set out in clause 12.3 of the Standard Terms), and providing other relevant information reasonably requested, once in any 12-month period.

9.2 The Customer (or an independent auditor bound by confidentiality who is not a competitor of EventCatalog) may carry out a fuller audit only if a supervisory authority requires it, or after a Personal Data Breach or other security incident affecting the Customer. Any such audit will be remote unless a supervisory authority requires otherwise. The Customer must give at least 30 days' written notice (or shorter if a supervisory authority requires), limit the audit to the processing of Support Data, and carry it out during UK business hours without disrupting EventCatalog's business or compromising other customers' data. Each party bears its own costs of any audit, except that if the audit finds that EventCatalog has materially failed to comply with this DPA, EventCatalog will reimburse the Customer's reasonable costs of the audit.

10. International transfers​

10.1 EventCatalog is established in the United Kingdom. Support Data received by email is held in Google Workspace, which processes data globally under Google's data processing terms. If the Customer has a private Slack or Discord support channel on the Enterprise plan (clause 6.8(b) of the Standard Terms), that channel is hosted in the Customer's own workspace, and the provider processes messages in it under the Customer's own agreement with that provider.

10.2 Transfers of Support Data from the EEA to EventCatalog in the UK rely on the European Commission's adequacy decision for the United Kingdom. If that decision ceases to apply, the EU SCCs are incorporated into this DPA: Module 2 applies where the Customer is a controller and Module 3 where it is a processor; the Customer is the data exporter and EventCatalog the data importer; Clause 7 applies; Clause 9 option 2 applies, with notice given under clause 6.3; the optional wording in Clause 11 does not apply; the supervisory authority under Clause 13 is determined by reference to the data exporter; Clauses 17 and 18 are completed with Ireland; and Annexes I to III are completed with Annexes 1 to 3 of this DPA.

10.3 Where EventCatalog transfers Support Data to a Sub-processor outside the UK or EEA, it relies on the safeguards in that Sub-processor's data processing terms: the UK International Data Transfer Agreement, the EU SCCs with the UK Addendum, or the EU-US Data Privacy Framework and its UK Extension where the Sub-processor is certified.

11. Liability​

11.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Main Agreement and counts towards the aggregate cap in the Main Agreement.

11.2 Nothing in this DPA limits either party's liability to data subjects under Article 82 of the UK GDPR or EU GDPR, or any liability that cannot be limited or excluded by law.

12. Term and changes​

12.1 This DPA lasts for as long as EventCatalog processes Support Data for the Customer. Clauses 8, 9 and 11 survive until all Support Data has been deleted or returned.

12.2 EventCatalog may update this DPA where needed to reflect changes in Data Protection Laws, regulatory guidance or approved transfer mechanisms, provided the protection given to Support Data is not materially reduced. EventCatalog will give at least 90 days' written notice of any update, and an update applies to the Customer only from the start of its next Subscription Term after that notice, never part way through a Subscription Term, except that an update required by Data Protection Laws or a supervisory authority (for example, new standard contractual clauses) may apply from the date the law requires, with as much notice as is reasonably possible. Any other change needs both parties' written agreement.

13. Governing law​

13.1 This DPA and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, unless the Customer's Enterprise Agreement selects LCIA arbitration, in which case disputes under this DPA are resolved by arbitration in the same way as under clause 18.2 of the Standard Terms. This clause applies except where the EU SCCs or the UK Addendum require otherwise.