Data Processing Addendum for Organizers

This Data Processing Addendum ("DPA") sets forth the terms and conditions related to the privacy, confidentiality and security of Personal Data associated with Services provided by Tixify to Organizer pursuant to the Agreement. In this DPA references to "you" means the Organizer and references to "we,'' "us," "our" and "Tixify" means Tixify Limited and our affiliates.

The terms of this DPA are hereby incorporated into the Tixify Terms of Service or any other applicable services agreement between you and Tixify (the "Agreement").

With respect to provisions regarding Processing of Personal Data, in the event of a conflict between the Agreement and this DPA,the provisions of this DPA shall control. In the event of a conflict between this DPA and any other provision of the Agreement between you and us, this DPA will control; except where Organizer and Tixify have individually negotiated data processing terms that are different from this DPA and which meet the requirements of applicable Data Protection Laws in full, in which case those negotiated terms will control.

“Controller-to-Processor Standard Contractual Clauses” means the Controller-to-Processor Standard Contractual Clauses in the Annex to the European Commission Decision of February 5, 2010, as may be amended or replaced from time to time by the European Commission.

"Data Protection Laws” means all laws or regulations related to the privacy, confidentiality and security of Personal Data.“

"Business,” "Data Controller," "Data Processor," "Data Subject," "Processing," "Personal Data," and “Service Provider” shall have the meanings ascribed to them in applicable Data Protection Laws."

"Data Security Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Personal Data Processed by Tixify on Organizer’s behalf as part of Organizer’s use of the Services.

“Sell” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Personal Data to a third party, other than to a sub-processor pursuant to Section 2, for monetary or other valuable consideration.

"Services” means any services provided by Tixify to Organizer, as defined in the Tixify Terms of Service of any other applicable services agreement between Organizer and Tixify. "Technical and Organizational Security Measures" means reasonable security measures implemented by Tixify appropriate to the type of Personal Data being Processed on Organizer’s behalf and the Services being provided by Tixify designed to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, alteration or disclosure.

1.1 In using Tixify's Services, Organizer acts as a Business and is a Data Controller of the Personal Data associated with an individual using Tixify Services, or on whose behalf an individual is using Tixify Services, to register for or purchase a ticket to attend such Organizer's event ("Consumer"). Organizer represents and warrants that it has provided any necessary notices and if required, obtained any necessary consents related to the collection of such Personal Data from the Consumer and Organizer has the right to share such Personal Data with Tixify.

1.2 Where Tixify Processes the Personal Data of Consumers on behalf of Organizer as part of the Services, Tixify is a Data Processor or Service Provider in performing such Processing and Organizer is the Data Controller or Business. This includes circumstances where Tixify obtains Personal Data as a result of the provision of its core services (for example, where Tixify facilitates the transmission of emails to Consumers at the request of Organizers, Processes payments, or provides event reports and tools to enable Organizers to gain insights into the effectiveness of various sales channels).

In respect of some Processing of Consumers' Personal Data, Tixify may act as a Data Controller or Business, for example, where Consumers have engaged with aspects of Tixify's Applications beyond those relating to Organizer's event or where Consumers' Personal Data is Processed by Tixify to conduct research and analysis to enable Tixify to improve its products and features and provide targeted recommendations. With regard to such Processing, Tixify is an independent Data Controller and not a joint Data Controller with Organizer.

To the extent that Tixify Processes Personal Data as a Data Processor or Service Provider on behalf of Organizer, Section 2 of this DPA shall apply, however, when Tixify is acting as a Business or Data Controller of Consumers' Personal Data, Tixify's Processing shall not be subject to this DPA.

1.3 Details about the Personal Data to be Processed by Tixify and the Processing activities to be performed under the Agreement are as follows: (i) duration - as set out in the Agreement; (ii) nature, purpose and subject matter - to enable Organizer to manage an event, process cashless payments, and access control using Tixify Services; (iii) data categories - name, email address, billing and payment information, bank account information, information related to events booked and attended, relationship to Organizer and any other Personal Data that Organizer requests of its Consumers; (iv) data subjects - Consumers.

2.1.Whenever Tixify Processes Personal Data on behalf of Organizer, Tixify shall:

2.2. Organizer hereby consents and authorizes Tixify to disclose or transfer Personal Data to, or allow access to Personal Data by, Tixify's current sub-processors (i.e. those listed on Tixify's website on the Effective Date of this DPA or the Agreement, whichever is later) ("Current Sub-Processors") to Process Personal Data on Organizer’s behalf.

2.3. Organizer hereby consents to Tixify appointing additional and replacement sub-processors ("Replacement Sub-Processors") to Process Personal Data on Organizer’s behalf. Tixify shall: (i) give notice to Organizer of the identity of Replacement Sub-Processors via Tixify's website (Organizer is responsible for regularly checking and reviewing Tixify's website for any such changes and Tixify's website shall be the sole means of Tixify communicating any such changes); and (ii) give Organizer the opportunity to object to such changes that take place after the Effective Date of the Agreement, in accordance with the terms that follow in Section 2.4 of this DPA.

For the avoidance of doubt, any termination rights available herein shall only apply in the instance of objections to Replacement Sub-Processors appointed after the Effective Date of this DPA that are not remedied in accordance with the terms herein, and shall not apply in relation to Current Sub-Processors.

2.4. Organizer shall raise any objection to the appointment of Replacement Sub-Processors within ten (10) days of Tixify posting the changes on its website. Organizer shall send its objection to [email protected] with the subject line 'Objection to Replacement Sub-Processor'. Provided that Organizer's objection: (i) concerns the Replacement Sub-Processor's ability to allow Tixify to materially comply with its data protection obligations under this DPA; and (ii) includes sufficient detail to support its objection and provides specific examples, Tixify will then use commercially reasonable efforts to review and respond to Organizer's objection within thirty (30) days of receipt of Organizer's objection with Tixify's determined method of accommodation. If Tixify determines in its sole discretion that it cannot reasonably accommodate Organizer's objection, upon notice from Tixify, Organizer may choose to terminate the Agreement by providing written notice to Tixify, and complying with the terms herein, which shall be Organizer's sole and exclusive remedy. Without limiting the generality of the foregoing, Organizer's termination right under this Section 2.4 will be deemed an additional termination right of Organizer under the "Term and Termination" Section of the Agreement (if any) and if exercised will be deemed a termination pursuant to such Section. Such written notice must be sent to [email protected] and must specifically reference this Section 2.4 of the DPA. The day Tixify receives an Organizer's written termination notice under this Section 2.4 will be referred to as the "Objection Date" in this DPA. Should Organizer choose to terminate the Agreement as a result of a Replacement Sub-Processor, then nothing in this Section 2 shall relieve Organizer from any of its payment and/or repayment obligations to Tixify under the Agreement.

Without limiting Tixify's other rights and remedies, if Organizer terminates the Agreement pursuant to this Section 2.4, then Organizer will immediately pay to Tixify (1) all amounts accruing and owed to Tixify, including, without limitation, obligations to pay and/or repay Tixify for Fees, Sponsorship Payments, Advances, and/or Advance payments of Activation Fees, as such terms are defined in the Agreement and only to the extent applicable to Organizer, (2) if the Agreement includes a minimum number of activations, a minimum amount of Event Registration Fees or Tixify Services Fees that must be processed (each such sales or processing threshold, a "Minimum Threshold"), and/or a requirement to pay Tixify the portion of Service Fees Tixify would have received had a Minimum Threshold been met, then Organizer agrees to pay Tixify an amount equal to (x) the amount that Tixify would have received in Service Fees had the Minimum Threshold been met in each year of the term up to the date of such termination (with such Minimum Threshold prorated as to any partial year of the Term), less (y) the amount that Tixify actually received in Service Fees attributable to Organizer's sales during the Term up to the date of such termination; and (3) 80% of the anticipated Fees Tixify would have earned during the remainder of the Term had the Agreement not been terminated with respect to (x) events on sale on the Site as of the Objection Date, and (y) any future events contemplated under the Agreement intended to go live in the ninety (90) days following the Objection Date.

3.1. Organizer agrees that Tixify may transfer Personal Data of Consumers to various locations in connection with providing the Services. Transfers will be made in accordance with legally enforceable transfer mechanisms where required by applicable Data Protection Laws. Tixify’s exclusive transfer mechanism for data exported from the European Economic Area, United Kingdom and Switzerland is the use of Standard Contractual Clauses, which Organizer can request from Tixify for Organizer compliance records.

3.2. With respect to Tixify Personal Data transferred from the United Kingdom for which United Kingdom law (and not the law in any European Economic Area jurisdiction) governs the international nature of the transfer, and such law permits use of the Old EU SCCs but not use of the New EU SCCs, the Old EU SCCs form part of this DPA and take precedence over the rest of this DPA as set forth in the Old EU SCCs, until such time that the United Kingdom adopts new Standard Contractual Clauses, in which case new, Standard Contractual Clauses will control.  For purposes of the Old EU SCCs, they shall be deemed completed as follows:

i) The “exporters” and “importers” are the Parties and their Affiliates to the extent any of them is involved in such transfer, including those set forth in Annex I.A of the New EU SCCs.  

ii) Clause 9 of the Old EU SCCs specifies that United Kingdom law will govern the Old EU SCCs.

iii) The content of Appendix 1 of the Old EU SCCs is set forth in Annex I.B of the New EU SCCs herein.

iv) The content of Appendix 2 of the Old EU SCCs is set forth in Annex II of the New EU SCCs herein.

3.3  With respect to Personal Data transferred from Switzerland for which Swiss law (and not the law in any European Economic Area jurisdiction) governs the international nature of the transfer, references to the GDPR in Clause 4 of the New EU SCCs are, to the extent legally required, amended to refer to the Swiss Federal Data Protection Act or its successor instead, and the concept of supervisory authority shall include the Swiss Federal Data Protection and Information Commissioner. 

3.4. With respect to Personal Data transferred from the European Economic Area, the New EU SCCs incorporated herein shall apply and form part of this DPA. In the event of a conflict between any provision of the New EU SCCs and any provision of this DPA, the New EU SCCs will control to the extent of conflicts.