Creator Data Processing Addendum

Scope and roles

This addendum is part of the Terms and covers personal information in guest RSVP replies. The host decides what to collect and why and is responsible for it (the controller). Eventloom processes it on the host's behalf (the processor or service provider).

What Eventloom will do

• Process guest replies only to provide the host's event page, RSVP collection, dashboard, export and deletion, or as the law requires.
• Limit access to people who need it to run or support the service, and keep the information confidential.
• Protect it with the safeguards in our Privacy Policy and Security page.
• Use only the providers listed on our Subprocessors page, under contracts that protect the information, and list new ones there before we use them. If you object to a change you can stop using Eventloom and delete your data.
• Help hosts answer guests' requests to access, correct or delete their information.
• Tell affected hosts without undue delay after we confirm a breach involving their guests' information, with the details we have.
• Delete guest replies automatically 90 days after the event ends, or sooner when the host deletes them, the event or the account. Hosts can export replies as a CSV file before then.
• Give hosts reasonable information they need to show compliance, on request.

What the host will do

Give guests a clear privacy notice (the event privacy notice is required before publishing), collect only what the event needs, have a lawful basis for collecting it, and handle exported replies securely.

Liability

Each party's liability under this addendum is subject to the limits in the Terms, except where the law doesn't allow those limits.