Data Processing Agreement (DPA)

Version 1.0 – effective 27 Oct 2026

between the Organizer (Controller) and DYNAMIC BTL EVENTS SRL, operating Eventyora (Processor)

1. Parties and definitions

• Controller: the organizer, venue or agency that accepted the Eventyora Terms of Service ("Organizer").
• Processor: DYNAMIC BTL EVENTS SRL, Strada Tudor Arghezi nr. 38, Sector 2, București, România, Trade Register J2015009514405, CUI 34846781 ("Eventyora").

Terms such as "personal data", "processing", "data subject" and "personal data breach" have the meaning in Regulation (EU) 2016/679 (GDPR).
This DPA is part of the Terms of Service. If they conflict on personal data, this DPA prevails.

2. Subject matter, duration and nature

Eventyora processes personal data for the Organizer to provide the Eventyora services (CRM, Experience, Production and the mobile apps) for as long as the contract lasts, plus the period needed to return or delete the data (clause 11).
Nature and purpose: hosting, storing, organising, displaying, transmitting by email and notification, and deleting data so that the Organizer can sell tickets, send invitations, check guests in, communicate with guests, handle offers, contracts, invoices and payments, and show live screens.

3. Types of data and data subjects

• Data subjects: the Organizer's clients and leads, guests and ticket buyers, invitees, staff, speakers, suppliers.
• Data: name, email, phone, company, ticket and order data, payment status, check-in data, messages, photos, answers to the Organizer's questions (these may include special-category data such as dietary or health needs), signature records, device tokens, technical logs.
• The Organizer decides what data to collect and must not load data it has no basis for.

4. Processor obligations (art. 28(3))

Eventyora will:
a) process personal data only on documented instructions from the Organizer (this DPA, the Terms and the Organizer's use of the features), unless EU or Romanian law requires otherwise (in which case it informs the Organizer first, if allowed);
b) make sure everyone who handles the data is bound by confidentiality;
c) apply the security measures in Annex 2;
d) respect the conditions for subprocessors in clause 6;
e) help the Organizer answer data subject requests, using the tools in the product and reasonable support;
f) help the Organizer with security, breach notification, impact assessments and prior consultation (art. 32-36);
g) delete or return the data at the end (clause 11);
h) give the Organizer the information needed to show compliance, and allow audits (clause 9);
i) tell the Organizer if, in its view, an instruction breaches the GDPR.

5. Organizer obligations

The Organizer: has a valid legal basis and gives the notices for the data it loads; asks sensitive questions (art. 9) only with a valid basis, usually explicit consent; manages its users' roles and access; and gives lawful instructions.

6. Subprocessors

The Organizer gives general authorisation for the subprocessors in Annex 1 (also on the public Subprocessors page). Eventyora will tell Organizers at least 30 days before adding or replacing one (by email and on the page). The Organizer may object on reasonable data protection grounds within that time (write to privacy@eventyora.com); if not solved, the Organizer may end the affected service. Eventyora signs with each subprocessor a contract with equivalent obligations and remains responsible for it.

7. International transfers

Data is hosted in the EU/EEA. Where a subprocessor transfers data outside the EEA, it does so under an adequacy decision (for example the EU-US Data Privacy Framework) or Standard Contractual Clauses (Annex 1 shows which).

8. Data subject requests

If Eventyora receives a request that concerns the Organizer's data, it forwards it to the Organizer without undue delay and does not answer it itself, unless instructed.

9. Audits

Eventyora provides, on request, its security documentation and answers to the Organizer's security questionnaire. Once a year, or after a breach, with 30 days' notice, during working hours and without harming other clients, the Organizer (or an independent auditor bound by confidentiality) may audit Eventyora's compliance with this DPA. Costs are the Organizer's, unless the audit finds serious non-compliance.

10. Personal data breach

Eventyora informs the Organizer without undue delay and in any case within 48 hours after becoming aware of a breach that affects the Organizer's data, with the information it has: what happened, the data and people affected, likely consequences, measures taken, and a contact (privacy@eventyora.com). Eventyora keeps updating the Organizer. The Organizer decides on notifying ANSPDCP (within 72 hours) and the data subjects. See the Breach Notification Procedure.

11. End of the contract

At the end, Eventyora lets the Organizer export its data for 30 days. After that Eventyora deletes or anonymises the data within 60 days and from backups on their normal cycle, unless the law requires keeping it. Eventyora confirms deletion in writing on request. The Data Retention Policy applies.

12. Liability, law and order of documents

Liability follows the Terms of Service. Romanian law applies; the courts of Bucharest Sector 2 decide. Order of priority: this DPA, then the Terms.

13. Signatures

Accepted electronically by the Customer on sign-up; for Eventyora: DYNAMIC BTL EVENTS SRL, Andrei Rădulescu, Administrator.

Annex 1: Subprocessors

See the Subprocessors page (/legal/subprocessors) – it is part of this annex.

Annex 2: Technical and organisational measures (TOM)

Status is as at 26 October 2026. "Yes" means implemented and tested locally; "Partial" and "No" are shown honestly.