Data processing agreement

Version 2026-10-01

Draft: awaiting legal review. Details in [brackets] will be completed before launch.

This agreement is between you, the organizer ("controller"), and [Company name] Ltd ("processor"), for guest personal data processed through Eventilize, under the Nigeria Data Protection Act 2023.

1. Instructions

We process guest data only to provide Eventilize as you use it (guest lists, passes, messages, seating, check-in, exports) and on your documented instructions, unless the law requires otherwise.

2. Confidentiality and access

Our staff with access are bound by confidentiality. Within your event, access follows the roles you assign; contact details are hidden from viewers unless you allow it.

3. Security

Encryption in transit, hashed passwords and access links, role-based access, rate limiting, audit logging, and passes that carry no personal data. Offline check-in devices hold only the minimum (names, tables, pass details).

4. Sub-processors

You authorise the sub-processors listed here. We give notice of changes on that page and bind each to equivalent data protection terms. Transfers outside Nigeria rely on those terms.

5. Data-subject requests

Guests can see their registration, stop messages and delete their details themselves; you can export, correct and delete guest data. We help with other requests sent to us.

6. Breaches

We notify you without undue delay, and within 24 hours of becoming aware of a breach affecting your guests' data, with what we know, so you can meet the 72-hour duty to notify the Commission.

7. Deletion

Guest data is never deleted automatically: after your event you are asked whether to keep or delete it. Deleting guests or the event removes them from our database; backups expire on their normal cycle.

8. Audits

On reasonable request we provide the information needed to show compliance with this agreement.

[Company name] Ltd, RC [number], [Registered address], Nigeria. Privacy questions and requests: privacy@[your-domain].