Organizer Data Processing Agreement (DPA)

KonfHub provides technology that enables Organizers to create, manage, promote, and operate events. In doing so, KonfHub processes personal data relating to attendees, speakers, exhibitors, sponsors, volunteers, and other users on behalf of the Organizer or, where applicable, for its own independent purposes as described in the KonfHub Privacy Policy.

These Terms describe each party's responsibilities regarding the collection, use, disclosure, security, and retention of personal data.

Depending on the nature of the processing activity:

• The Organizer determines what attendee information is collected, the purposes for which it is collected, and the communications sent to attendees.
• KonfHub provides the technology platform used to process that information and acts on documented instructions from the Organizer where applicable.
• Certain processing activities performed by KonfHub for account management, fraud prevention, platform security, legal compliance, billing, customer support, and service improvement may be carried out by KonfHub as an independent data fiduciary/controller, as permitted by applicable law.

The Organizer is responsible for:

• collecting attendee information lawfully;
• providing all required privacy notices to attendees;
• obtaining any legally required consents before collecting or sharing personal data with KonfHub;
• ensuring that all attendee information uploaded to the platform is accurate and up to date;
• responding to attendee privacy requests relating to Organizer-controlled processing;
• ensuring that communications sent through the platform comply with applicable laws;
• obtaining appropriate permissions before enabling optional features such as AI Photo Gallery, attendee networking, SMS campaigns, or WhatsApp messaging where required by law;
• complying with the Digital Personal Data Protection Act, 2023, and any other applicable privacy or data protection laws.

The Organizer must not upload personal data that has been collected unlawfully or without appropriate authorization.

Depending on the Organizer's use of the platform, KonfHub may process:

• attendee names;
• email addresses;
• mobile numbers;
• organization and designation;
• ticket information;
• registration responses;
• event attendance records;
• QR codes;
• check-in records;
• payment transaction metadata;
• uploaded documents;
• photographs;
• networking profile information;
• AI Photo Gallery submissions;
• customer support communications;
• device identifiers;
• IP addresses;
• browser and usage logs.

The Organizer determines which categories of personal data are collected through event registration forms.

Where the Organizer enables AI-powered features such as AI Photo Gallery, AI Photo Booth or AI-assisted networking:

• the Organizer is responsible for determining whether applicable law requires attendee notice or consent before such features are used;
• KonfHub will process AI-related data solely for providing the requested AI functionality;
• KonfHub will not use attendee photographs or AI-generated facial representations for advertising or unrelated commercial purposes without an appropriate legal basis;
• additional information regarding AI processing is available in KonfHub's AI Privacy Notice.

Organizers may use the KonfHub platform to communicate with attendees.

The Organizer is solely responsible for ensuring that:

• recipients have been contacted lawfully;
• required permissions or consents have been obtained;
• communications comply with applicable anti-spam, telecommunications, and privacy laws;
• message content is lawful and accurate.

KonfHub is not responsible for the legality or content of communications initiated by the Organizer.

KonfHub maintains reasonable security measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction.

These measures include, where appropriate:

• encryption in transit;
• access controls;
• authentication mechanisms;
• audit logging;
• monitoring;
• vulnerability management;
• secure software development practices;
• regular backups;
• incident response procedures.

The Organizer is responsible for maintaining the confidentiality of its user accounts and ensuring that only authorized personnel have access to Organizer accounts.

KonfHub may engage trusted third-party service providers to support the delivery of the Services, including cloud hosting, payment processing, messaging, analytics, customer support, and security services.

KonfHub remains responsible for ensuring that such subprocessors are subject to appropriate contractual obligations relating to confidentiality, security, and data protection.

A current list of subprocessors is available in KonfHub's Subprocessor List.

Organizer-controlled personal data is retained for the period necessary to provide the Services, satisfy contractual obligations, comply with applicable law, resolve disputes, or enforce agreements.

Where supported by the platform, Organizers may request deletion of event data in accordance with KonfHub's Data Retention and Deletion Policy.

Certain information may be retained where required by law, for fraud prevention, security, accounting, taxation, or dispute resolution purposes.

Where an attendee exercises rights under applicable privacy laws, including requests to access, correct, delete, or otherwise manage their personal data:

• requests relating to event-specific processing should generally be directed to the relevant Organizer;
• KonfHub will provide reasonable assistance to the Organizer where necessary to fulfil such requests;
• KonfHub may respond directly where the request relates to data for which KonfHub acts as an independent data fiduciary/controller.

Depending on the Organizer's configuration and the services used, personal data may be processed by KonfHub or its authorized subprocessors in jurisdictions outside the country in which the data was originally collected.

Where applicable, KonfHub implements appropriate safeguards for cross-border processing in accordance with applicable data protection laws.

If KonfHub becomes aware of a confirmed personal data breach affecting Organizer-controlled personal data, KonfHub will notify the Organizer without undue delay where required by applicable law or contractual obligation.

The Organizer is responsible for determining any notification obligations owed to attendees or regulators unless applicable law places such obligations directly on KonfHub.

Upon reasonable request and subject to confidentiality obligations, KonfHub may provide information regarding its security and privacy controls sufficient to demonstrate compliance with these Terms.

Enterprise customers may request additional documentation, certifications, or security reports under separate contractual arrangements.

KonfHub may update these Terms from time to time to reflect changes in applicable law, technology, or the Services. Material updates will be communicated through the KonfHub website or customer account notifications.

Continued use of the Services after the effective date of an updated version constitutes acceptance of the revised Terms.

Questions regarding these Organizer Data Processing Terms may be directed to:

Privacy Officer
KonfHub

Email: privacy@konfhub.com

Website: https://konfhub.com