Parties and scope

This Data Processing Agreement ("DPA") is concluded between:

1. Controller: the legal entity or natural person identified as the contracting Organizer in the relevant DanceMeetup organization profile and acceptance record ("Organizer"), represented by the person who accepts this DPA; and
2. Processor: XWare, s.r.o., Na suchých 320, 252 50 Jesenice u Prahy, Czechia, company ID (IČO) 27377539, VAT ID (DIČ) CZ27377539, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 109479, operator of the DanceMeetup platform ("DanceMeetup").

The person accepting this DPA confirms that they are authorised to bind the Organizer. The Organizer accepts this DPA through the designated acceptance action in the Platform. The acceptance record identifies the accepting account, the DPA version and the time of acceptance and is associated with the Organizer's organization profile.

The DPA supplements the Terms & Conditions for Organizers ("Terms") and any license or service order. It applies whenever DanceMeetup processes personal data on the Organizer's behalf in providing an agreed Platform service, whether paid or free. Annex A describes that processing; a separate paid service order is not required for this DPA to apply.

DanceMeetup also processes personal data as an independent controller for separately identified purposes, including Platform accounts, authentication, security, its own communications and the attendee archive described in its Privacy Policy. That processing is not covered by this DPA. A provider's role, including payment providers, depends on the specific service, contract, account holder and purpose.

1. Documented instructions

DanceMeetup processes the personal data only on the Organizer's documented instructions, including with regard to transfers outside the EEA, unless EU or Member State law requires otherwise. In that case DanceMeetup informs the Organizer before processing, unless that law prohibits it on important grounds of public interest.

The Terms, any applicable service order, this DPA and the settings the Organizer's authorised users make on the Platform are the Organizer's documented instructions. Other instructions must be sent to info@dancemeetup.com; instructions outside the agreed services may require a separate agreement. If DanceMeetup reasonably considers an instruction unlawful, it promptly informs the Organizer and seeks clarification. DanceMeetup may suspend the affected instruction while the issue is resolved and will not carry out processing it knows would breach applicable law. Any suspension is limited to what is reasonably necessary, and the parties will cooperate to identify a lawful alternative. This does not make assistance required by data protection law conditional on buying an additional service.

The Organizer determines the purposes of its processing, ensures a lawful basis, informs data subjects and is responsible for the lawfulness of its instructions and of the data it collects. The Organizer must not collect data it does not need, must not collect special-category data without an applicable condition under Article 9 GDPR, and must not collect copies of identity documents through the Platform.

2. Confidentiality and security

DanceMeetup ensures that persons authorised to process the personal data are bound by confidentiality and have access only to the extent their role requires. DanceMeetup implements the technical and organisational measures described in Annex B, taking into account the nature, scope, context, purposes and risks of the processing. Measures may change over time, provided the level of protection is not reduced.

3. Sub-processors

The Organizer gives DanceMeetup general written authorisation to engage the sub-processors listed in Annex C.

DanceMeetup gives the Organizer at least 30 calendar days' advance notice by email to the administrator contact address registered for the Organizer, and updates Annex C, before an intended addition or replacement starts processing the Organizer's personal data. The notice identifies the provider, the service and data involved, and any known processing location or transfer information. The Organizer may object on reasonable data protection grounds by writing to info@dancemeetup.com before the proposed start date. DanceMeetup will not start the new processing for that Organizer while a timely objection remains unresolved. The parties will seek a reasonable solution; if none is found, the Organizer may stop using the affected feature or terminate the affected services.

DanceMeetup imposes on each sub-processor data protection obligations equivalent in substance to those in this DPA and remains liable to the Organizer for the sub-processor's performance of those obligations.

4. Assistance and personal data breaches

Taking into account the nature of the processing, DanceMeetup assists the Organizer with appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects exercising their rights. DanceMeetup forwards to the Organizer without undue delay any such request it receives that concerns processing on the Organizer's behalf, unless prohibited by law.

DanceMeetup assists the Organizer, taking into account the information available to it, in meeting its obligations under Articles 32 to 36 GDPR, including security, breach notification, data protection impact assessments and prior consultation.

DanceMeetup notifies the Organizer of a personal data breach affecting the Organizer's data without undue delay after becoming aware of it. The initial notification describes, to the extent then available, the nature of the breach, affected data and data-subject categories, approximate numbers of affected individuals and records, likely consequences, measures taken or proposed, and a contact for follow-up. Incomplete information does not delay the initial notification; further information is provided without undue delay as it becomes available. DanceMeetup takes reasonable steps to contain and mitigate the breach and preserve relevant evidence.

5. International transfers

DanceMeetup transfers personal data outside the EEA only on the Organizer's documented instructions, including this DPA and Annex C, or where required by law, and only where Chapter V GDPR is complied with.

6. Information and audits

DanceMeetup makes available to the Organizer the information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Organizer or an auditor it mandates. The parties agree reasonable notice, scope, confidentiality and security arrangements in advance.

7. Retention, return and deletion

During the term of the Organizer's account, Organizer-controlled event data may remain stored after an event ends so that the Organizer can administer past events, its CRM records and related claims. The Organizer determines the purpose and appropriate retention period for its CRM data and must not retain data it no longer needs. Sensitive or optional fields are not retained merely because other event-history records remain available. The Organizer may delete data it no longer needs using the Platform or by request.

When the Organizer's account or the relevant services end, DanceMeetup, at the Organizer's choice, returns the Organizer-controlled personal data in a commonly used electronic format available on the Platform or agreed between the parties, or deletes it, and deletes existing copies without undue delay, unless EU or Member State law requires storage. Backups are handled as described in Annex D.

The attendee's separate DanceMeetup archive (including event history, old pass records and links to memories where available) is a distinct Platform purpose described in the Privacy Policy. It is not retained as Organizer CRM data under this DPA. An Organizer's deletion instructions do not delete data held by another Organizer or data DanceMeetup processes as an independent controller. An attendee may request erasure of their Platform archive; records retained under a separate legal obligation are handled separately.

8. Term and precedence

This DPA applies for as long as DanceMeetup processes personal data on the Organizer's behalf. For the processing it covers, the DPA prevails over the Terms and any license or order. Liability between the parties is governed by the Terms, subject to mandatory law. Nothing in this DPA limits data subjects' rights or the powers of supervisory authorities under applicable data protection law. DanceMeetup may update this DPA; material changes are notified in the same way as changes to the Terms.

Annex A — Description of processing

Annex B — Technical and organisational measures

• The Platform's primary servers and database backups are located in the Czech Republic. The servers are operated and administered by XWare, s.r.o.
• Access to servers and data is restricted to authorised personnel and protected by a firewall.
• Access to Organizer data on the Platform is limited to the Organizer's users with the relevant permissions.
• Backups are encrypted and retained for up to one year.
• Persons with access to personal data are bound by confidentiality.
• Personal data breaches are assessed and handled under section 4.

Annex C — Sub-processors

This Annex identifies the service providers used in delivering the Platform, the services they provide and the categories of personal data involved.

DanceMeetup shall ensure that providers acting as sub-processors are bound by the data protection obligations required under Article 28 GDPR. Any transfers of personal data outside the EEA shall comply with section 5 of this DPA.

Information necessary to demonstrate compliance, including applicable provider roles, contracting entities, processing locations, retention arrangements and transfer safeguards, shall be made available to the Organizer under section 6, subject to appropriate confidentiality safeguards.

Annex D — Backups, contacts and requests