Data Processing Addendum
This DPA applies when CrowdSafe processes personal data for a customer through CrowdSafeData.
Effective August 16, 2026 · Version 1.11. Incorporation and roles
This DPA supplements the Terms of Service or applicable order. The customer is the controller or business and CrowdSafe Group, LLC is the processor or service provider for customer personal data. Each party will comply with data-protection law applicable to its role.
2. Processing details
The subject matter is the provision of event-data ingestion, analytics, reporting, support, security and recovery services. Processing lasts for the subscription and applicable retention period. Operations may include collection, hosting, structuring, analysis, retrieval, transmission, deletion and restoration. Data subjects may include attendees, workers, customers, account users and other persons represented in customer data. Customers should avoid special-category, biometric, payment-card, health, precise-location or direct-identifier data unless expressly agreed and lawfully provided.
3. Documented instructions
CrowdSafe will process customer personal data only on documented instructions in the agreement, product configuration and authorized support requests, unless law requires otherwise. CrowdSafe will notify the customer if an instruction appears unlawful, unless prohibited.
4. Confidentiality and security
Personnel and contractors with access are subject to confidentiality obligations. CrowdSafe maintains measures appropriate to the service, including access control, organization isolation, role authorization, protected transport and storage, source integrity hashes, audit records, secure development checks, bounded ingestion, incident procedures and recovery snapshots.
5. Subprocessors
The customer authorizes subprocessors needed for hosting, authentication, storage, security, support and billing. Current core providers are OpenAI Sites for site delivery and authentication, Cloudflare services for hosted runtime and protected storage, and PayPal or Stripe only when the applicable billing method is activated. CrowdSafe remains responsible for their processing obligations to the extent required by law and will disclose material changes through updated service documentation or notice.
6. Assistance
Taking account of the processing and information available, CrowdSafe will reasonably assist with data-subject requests, security obligations, impact assessments and regulator consultations. Customers remain responsible for responding as controller and should provide request details through the Support console.
7. Security incidents
CrowdSafe will notify the customer without undue delay after confirming a personal-data breach affecting customer data, provide available information about nature and impact, take reasonable containment and remediation steps, and provide updates as the investigation develops. Notification is not an admission of fault.
8. Return and deletion
At termination or on lawful written instruction, CrowdSafe will return or delete customer personal data unless retention is required by law. Operational copies and backups expire under the Retention Policy. Deletion does not require alteration of immutable audit evidence where continued retention is lawful and access remains restricted.
9. Transfers
Where a restricted transfer requires safeguards, the applicable controller-to-processor or processor-to-processor modules of the European Commission Standard Contractual Clauses are incorporated on request, with the customer as exporter and CrowdSafe as importer. The parties will complete required annexes and supplementary assessments for the relevant deployment. Customers can initiate a DPA or SCC request through Account and Support.
10. Audit information
CrowdSafe will make available information reasonably necessary to demonstrate compliance and will support proportionate audits subject to confidentiality, security, scope and frequency controls. The parties will first use security documentation, test summaries and written responses before requesting intrusive inspection.