Data processing agreement

Version 2026-10-31

This agreement is part of the Meetamorph terms of service and meets Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 33 of Spanish Organic Law 3/2018 (LOPDGDD).

1. Parties

• Controller: the organisation that accepts this agreement in the organiser dashboard, for the events it creates there.
• Processor: Juan José Montiel Pérez, who provides Meetamorph.

2. Subject matter

The processor processes, on behalf of the controller, the data of the people who take part in its events, solely to provide the features the controller turns on for each event: profiles and directory, badges with QR and NFC, help requests and volunteers, messaging between attendees, emails and notifications, and ticket imports.

This agreement does not cover each person's Meetamorph account or base profile, which the platform processes as controller under its privacy notice.

3. Duration

For as long as the organisation has events on the platform. Section 10 applies when it ends.

4. Data subjects and data

• Data subjects: attendees, speakers, volunteers and staff of the events, and the members of the organisation's team.
• Data: first and last name, email address, ticket data (order code and product), role at the event, whatever each person chooses to add to their profile (photo, bio, company, job title, social networks), help requests and the place in the venue they are made from, messages between attendees, devices for notifications and technical access logs.
• Special categories: the platform does not ask for them. A help request may reveal information about the health or disability of the person making it; the processor uses it only to deal with the request and deletes it with the event.

5. Processor obligations

1. Process the data only on the controller's documented instructions: this agreement and each event's settings in the organiser dashboard. If an instruction seems to breach data protection law, the processor will say so at once.
2. Not use the data for its own purposes or disclose it to third parties, except to the sub-processors in section 7 or where the law requires it.
3. Ensure that everyone with access to the data is bound by confidentiality.
4. Apply the security measures in section 6.
5. Help the controller respond to requests to exercise the rights of access, rectification, erasure, objection, restriction and portability. If a person contacts the processor, the request will be passed on within five working days.
6. Notify the controller without undue delay, and within 48 hours of becoming aware of it, of any personal data breach affecting its data, with the information available so that the controller can notify the supervisory authority within 72 hours.
7. Help the controller with data protection impact assessments and prior consultations where relevant.
8. Make available the information needed to demonstrate compliance and allow reasonable audits, announced in advance.
9. Keep a record of the processing activities it carries out as processor.

6. Security measures

• Encrypted connections (HTTPS) on every page.
• Password-free access, with single-use links that expire. Ticket source credentials are stored encrypted.
• Separation of each event's data in every query.
• Role-based access to the organiser dashboard (owner, admin and staff) within each organisation.
• Servers in the European Union, regular backups and security updates.
• Deletion of the event's data when its retention period is over.

7. Sub-processors

The controller authorises the processor to use these sub-processors:

• None at the moment.

The processor will announce any change at least 15 days in advance, by email to the organisation's contact address, so that the controller can object. Each sub-processor is bound by the same obligations as the processor. No data is transferred outside the European Economic Area except with the safeguards of Chapter V of the GDPR.

8. Controller obligations

• Having a legal basis for every piece of data it imports or asks for and, where relevant, for the special categories that may appear in help requests.
• Informing people through the event's privacy notice.
• Configuring each event (features, languages and retention period) to fit its needs.
• Overseeing the processing.

9. Retention

Each event's data is kept until the retention period the controller chooses in the organiser dashboard, counted from the end of the event, is over. It is then deleted beyond recovery. Backups that still contain it are overwritten within 30 days.

10. End of the processing

When the service ends, the processor will delete the data or return it to the controller, as the controller chooses. The organiser dashboard can export the participants at any time. Only data the law requires will be kept, blocked.

11. Liability

Each party is liable for its own breaches under Article 82 of the GDPR.