1. Subject and duration
The processor processes personal data of event participants on behalf of the controller for the purpose of providing real-time audience interaction. The agreement lasts as long as the controller uses the service.
2. Categories of data and data subjects
- Data subjects: participants of events created by the controller, members of the controller's team.
- Data: optional display names, questions, votes, poll and quiz answers, technical identifiers (random participant token, rotating salted hashes for rate limiting).
3. Obligations of the processor
- Processes data only on documented instructions of the controller.
- Ensures confidentiality of persons authorized to process the data.
- Implements appropriate technical and organizational measures: encryption in transit, tenant isolation on every database query, access control by roles, audit log of moderation actions and exports, daily backups.
- Assists the controller with requests of data subjects and with data protection impact assessments.
- Notifies the controller of a personal data breach without undue delay.
- Deletes or returns all personal data at the end of the service, unless the law requires storage.
4. Sub-processors
The controller gives general authorization to the sub-processors listed in the privacy policy. The processor informs the controller about intended changes in advance and the controller may object.
5. Transfers outside the EU
Data is stored in the EU. Texts of participants are transferred to the AI provider only when the controller enables AI features; such transfers rely on the safeguards of Chapter V GDPR.
6. Audits
The processor makes available all information necessary to demonstrate compliance and allows audits by the controller or an auditor mandated by the controller, after reasonable notice.
Controller: ______________________ Processor: ______________________
Contact
[Operator company name, registered office and company ID - to be completed]
E-mail: support@voxpla.eu