Effective Date: April 16, 2025 Data Processing Agreement (GDPR)

This Data Processing Addendum ("DPA") applies to Organizers that are subject to the EU General Data Protection Regulation (2016/EC/679) or "GDPR"), or equivalent legislation, including any amending or replacement legislation from time to time ("Applicable Data Protection Laws"), which require Effective Registration to process Personal Data on their behalf as part of the Organizer's use of the Services.

In this DPA references to "you" means the Organizer and references to "we", "us", "our" and "Effective Registration" means Effective Registration, Inc.

Overview

The terms of this DPA are hereby incorporated in to the Effective Registration Terms of Use or any other applicable services agreement between you and Effective Registration (the "Agreement").

With respect to provisions regarding Processing of Personal Data, in the event of a conflict between the Agreement and this DPA, the provisions of this DPA shall control. In the event of a conflict between this DPA and any other provision of the Agreement between you and us, this DPA will control; except where the Organizer and Effective Registration have individually negotiated data processing terms that are different from this DPA and which meet the requirements of Applicable Data Protection Law in full, in which case those negotiated terms will control.

"Data Controller", "Data Processor", "Data Subject", "Processing" and "Personal Data" shall have the meanings ascribed to them in Applicable Data Protection Laws;

"Data Security Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Personal Data transmitted, stored or otherwise Processed; and

"Technical and Organizational Security Measures" means security measures implemented by Effective Registration appropriate to the type of Personal Data being Processed and the Services being provided by Effective Registration to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, alteration or disclosure.

1. Applicability of DPA and Scope of Data Processing Activities.
   1. In using Effective Registration's Services, for the purposes of Applicable Data Protection Laws, the Organizer is a Data Controller of the Personal Data associated with an individual using Effective Registration Services to register for or purchase a ticket to attend such the Organizer's event ("Registrant"). the Organizer agrees to Process such Personal Data in accordance with the Organizer's obligations under Applicable Data Protection Laws.
   2. Where Effective Registration Processes the Personal Data of Registrants on behalf of the Organizer as part of the Services, Effective Registration is a Data Processor in performing such Processing and the Organizer is the Data Controller. This includes circumstances where Effective Registration obtains Personal Data as a result of the provision of its core services (for example, where Effective Registration facilitates the transmission of transactional emails to the Registrant at the request of Organizers, processes payments, processes hotel reservations or provides event reports and tools to enable Organizers to gain insights into the effectiveness of various sales channels.
   3. In respect of some Processing of Registrants' Personal Data, Effective Registration may act as a Data Controller, for example, where Registrants have engaged with aspects of Effective Registration's Applications beyond those relating to the Organizer's event or where Registrants' Personal Data is Processed by Effective Registration to conduct research and analysis to enable Effective Registration to improve its products and features and provide targeted recommendations.
   4. To the extent that Effective Registration Processes Personal Data as a Data Processor on behalf of the Organizer, Section 2 of this DPA shall apply, however, when Effective Registration is acting as a Data Controller of the Organizer's Personal Data, Effective Registration's Processing shall not be subject to this DPA.
   5. Details about the Personal Data to be Processed by Effective Registration and the Processing activities to be performed under the Agreement are as follows:
      1. Duration - as set out in the Agreement;
      2. Nature, purpose and subject matter - to enable the Organizer to organize and promote events and manage registration using the Services;
      3. Data categories - name, email address, billing and payment information, information related to events booked and attended, relationship to the Organizer and any other Personal Data that the Organizer requests of its Registrants;
      4. Data subjects - Registrants.
2. Data Processing Clauses.
   1. Whenever Effective Registration Processes Personal Data on behalf of the Organizer, Effective Registration shall:
   1. Process Personal Data only on the documented instructions of the Organizer, unless required to do otherwise by applicable law. Effective Registration shall inform the Organizer of the legal requirement before Processing Personal Data other than in accordance with the Organizer's instructions, unless that same law prohibits Effective Registration from doing so on important grounds of public interest. Effective Registration will notify the Organizer if in its opinion an instruction is in breach of Applicable Data Protection Laws. the Organizer hereby instructs Effective Registration, and Effective Registration hereby agrees, to Process Personal Data as necessary to perform Effective Registration's obligations under the Agreement and for no other purpose;
   2. Have in place Technical and Organizational Security Measures to protect Personal Data;
   3. Notify the Organizer in the event of a Data Security Breach without undue delay and provide co-operation and assistance to the Organizer to enable the Organizer to comply with its obligations as a Data Controller in relation to data breach notification requirements;
   4. Ensure that its personnel are subject to binding obligations of confidentiality with respect to Personal Data;
   5. Impose obligations on its sub-processors that have access to Personal Data that are the same as or equivalent to those set out in this Section 2 by way of written contract, and remain fully liable to the Organizer for any failure by a sub-processor to fulfill its obligations in relation to the Personal Data;
   6. Provide reasonable assistance to the Organizer in responding to rights requests under Applicable Data Protection Laws, complaints, or other communications received from any data protection authority or individual who is the subject of any Personal Data Processed by Effective Registration. In the event that a Registrant submits a Personal Data deletion request to Effective Registration, the Organizer hereby instructs and authorizes Effective Registration to delete or anonymize the Registrant's Personal Data on the Organizer's behalf;
   7. Upon the Organizer's written request, make available to the Organizer all information reasonably necessary to demonstrate its compliance with the obligations set out in this Section 2, and allow for and co-operate with any audits. Any on-site audits shall be: (i) permitted only on reasonable advance notice to Effective Registration; (ii) subject to appropriate confidentiality undertakings; and (iii) limited to once every three (3) years and only in order to evaluate a specific suspected deficiency after exhausting all other reasonable means as determined by Effective Registration. Any costs related to such audits shall be borne entirely by the Organizer; and
   8. Except for that Personal Data with respect to which Effective Registration acts as a Data Controller, return, delete, or destroy (at the Organizer's election), the Personal Data and copies thereof, at the Organizer's request (unless applicable law requires the storage of such Personal Data).
   2. the Organizer hereby consents to Effective Registration's current sub-processors (i.e. those listed on Effective Registration's website on the Effective Date of this DPA, as well as those listed on Effective Registration's website as of the Effective Date of the Agreement) ("Current Sub-Processors") to Process Personal Data on its behalf.
   3. the Organizer hereby consents to Effective Registration appointing additional and replacement sub-processors ("Replacement Sub-Processors") to Process Personal Data on its behalf. Effective Registration shall: (i) give notice to the Organizer of the identity of Replacement Sub-Processors via Effective Registration's website (the Organizer is responsible for regularly checking and reviewing Effective Registration's website for any such changes and Effective Registration's website shall be the sole means of Effective Registration communicating any such changes); and (ii) give the Organizer the opportunity to object to such changes that take place after the Effective Date of the Agreement, in accordance with the terms that follow in Section 2(d) of this DPA.

   For the avoidance of doubt, any termination rights available herein shall only apply in the instance of objections to Replacement Sub-Processors appointed after the Effective Date of this DPA that are not remedied in accordance with the terms herein, and shall not apply in relation to Current Sub-Processors.

   4. the Organizer shall raise any objection to the appointment of Replacement Sub-Processors within ten (10) days of Effective Registration posting the changes on its website. the Organizer shall send its objection to privacy@effectiveregistration.com with the subject line 'Objection to Replacement Sub-Processor'.

      Provided that the Organizer's objection:

      1. concerns the Replacement Sub-Processor's ability to allow Effective Registration to materially comply with its data protection obligations under this DPA; and
      2. includes sufficient detail to support its objection and provide specific examples,

      Effective Registration will then use commercially reasonable efforts to review and respond to the Organizer's objection within thirty (30) days of receipt of the Organizer's objection with Effective Registration's determined method of accommodation. If Effective Registration does not view the objection as providing sufficient supporting detail, the objection shall be deemed invalid and Effective Registration has no further obligations.

   If Effective Registration determines in its sole discretion that it cannot reasonably accommodate the Organizer's objection, upon notice from Effective Registration, the Organizer may choose to terminate the Agreement by providing written notice to Effective Registration, and complying with the terms herein, which shall be the Organizer's sole and exclusive remedy. Without limiting the generality of the foregoing, the Organizer's termination right under this Section 2(d) will be deemed an additional termination right of the Organizer under the "Term and Termination" Section of the Agreement (if any) and if exercised will be deemed a termination pursuant to such Section. Such written notice must be sent to privacy@effectiveregistration.com and must specifically reference this Section 2(d) of the DPA. The day Effective Registration receives an the Organizer's written termination notice under this Section 2(d) will be referred to as the "Objection Date" in this DPA. Should the Organizer choose to terminate the Agreement as a result of a Replacement Sub-Processor, then nothing in this Section 2 shall relieve the Organizer from any of its payment and/or repayment obligations to Effective Registration under the Agreement. Without limiting Effective Registration's other rights and remedies, if the Organizer terminates the Agreement pursuant to this Section 2(d), then the Organizer will immediately pay to Effective Registration all amounts accruing and owed to Effective Registration, including, without limitation, obligations to pay and/or repay Effective Registration for Fees, Sponsorship Payments, Advances, and/or advance payments of Event Registration Fees, as such terms are defined in the Agreement and only to the extent applicable to the Organizer.

   5. Effective Registration confirms that it is a Canadian commercial organization and subject to Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), recognized by the European Commission (Decision of 20th December 2001 and reaffirmed most recently in July 2024) as providing adequate levels of protection for personal data transferred from the EU to Canada. Effective Registration is also subject to as well as the Digital Privacy Act of 2015. Effective Registration agrees to maintain its adherence to PIPEDA and DPA throughout the duration of the Agreement or implement another, alternative data transfer mechanism which lawfully permits the transfer of Personal Data outside of the European Economic Area / United Kingdom if required.