Data Processing Addendum

1Status of this addendum

This addendum attaches to the Terms of Service and applies whenever we process personal data on an organizer’s behalf. You do not need to sign it separately: it takes effect when you accept the Terms of Service.

Where this addendum and the Terms of Service conflict on the processing of personal data, this addendum prevails.

If your organization needs a wet-signed copy or uses its own template, contact us at info@yarnext.com with a subject prefixed [privasi].

2Definitions

3Subject matter of the processing

4Processing only on instructions

We process personal data only on the controller’s documented instructions. The Terms of Service, this addendum, and the controller’s use of the service features constitute those documented instructions.

Where the law requires us to process beyond those instructions, we tell the controller before doing so, unless that same law forbids the notice.

If we consider an instruction to breach data protection rules, we tell the controller and may suspend it until the matter is settled.

We do not use registrant data for our own ends: not to market anything, not to train models, not for cross-organizer analytics, and not to build profiles of people.

5Confidentiality

Everyone on our side who can access personal data is bound by a confidentiality obligation that survives the end of their engagement, and receives access only as far as their work genuinely requires.

6Technical and organizational measures

We apply measures appropriate to the risk, at minimum the following:

• isolation between organizers enforced by the database through row-level security, so that a mistake in the application layer still does not cross the boundary between organizations;
• TLS encryption of traffic end to end;
• short-lived secrets — sign-in codes, verification codes, access codes, invitation tokens — stored salted and hashed, never raw;
• IP addresses stored as salted hashes;
• registrant answer files retrievable only through a path that requires a session, with every retrieval written to the audit trail;
• file types sniffed from the bytes themselves, and image metadata stripped before storage;
• an audit trail recording who viewed or exported personal data in bulk;
• rate limiting on public paths and on code delivery;
• regular backups, with restoration tested;
• separation of development from production, with production data not used for development.

We may change this list so long as the level of protection is not reduced.

7Subprocessors

The controller gives general authorization for the use of subprocessors. Those currently in place:

We bind every subprocessor to data protection obligations no weaker than ours under this addendum, and we remain responsible to the controller for what our subprocessors do.

Adding or replacing a subprocessor is announced at least 30 days before it takes effect. The controller may object in writing on reasonable data protection grounds; if we cannot resolve the objection, the controller may terminate without penalty.

8Assistance to the controller

So far as the nature of the processing allows, we assist the controller in:

• responding to data subject requests — access, correction, deletion, restriction, portability — through the panel and export functions already provided, and through direct help where those are not enough;
• meeting obligations on security, breach notification, and data protection impact assessments;
• answering questions from competent authorities.

Data subject requests that reach us directly are passed to the controller rather than answered by us, unless the law orders otherwise.

9Breach notification

We notify the controller without undue delay, and where possible within 48 hours of becoming aware, of any personal data protection failure affecting the controller’s data.

That notice covers the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, the steps we have taken and will take, and a named contact for further information. Details not yet known follow in stages, without holding back the first notice.

10Audit and evidence

On written request, we provide reasonable information to demonstrate compliance with this addendum — including an explanation of the security architecture, the current subprocessor list, and third-party assessment results where they exist.

On-site audits may take place once in any twelve months, with at least 30 days’ notice, during business hours, by an auditor bound to confidentiality who is not a competitor of ours, and in a way that does not disrupt the service for other organizers. The controller bears the cost, unless the audit finds a material breach on our side.

11Cross-border processing

Where data is processed outside the controller’s own region, we ensure a valid transfer basis: an equivalent level of protection in the destination country, standard contractual clauses binding the recipient, or another basis recognized by applicable law. On request, we state which basis applies to a given transfer.

12Return and deletion of data

While the service is running, the controller can export their registrant data at any time in a machine-readable format.

After the service relationship ends, we keep the data for 30 days so that it can still be retrieved or the closure undone, then delete or anonymize it. Backup copies still holding it overwrite themselves in the backup rotation, at most 30 days after that.

The only exception is data we are legally required to keep — billing records and consent records as evidence, among others — which we retain strictly for that purpose and process for nothing else.

13Liability

The limitation of liability in the Terms of Service applies to this addendum too, so far as it does not conflict with data protection rules that cannot be set aside.

Each party is liable for breaching its own obligations. The controller is responsible for the validity of the lawful basis it sets, for the content of the form it builds, and for the appropriateness of the data it asks its registrants for.