Data Processing Agreement (DPA)

1. Subject Matter

The Event Organizer acts as the Data Controller ("Controller") and Gagan Dabole trading as DanzOS (hereinafter "DanzOS") acts as the Data Processor ("Processor") pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR). This agreement governs the processing of attendee, artist, volunteer, and staff personal data in connection with the cloud services provided by DanzOS.

2. Obligations of the Processor

DanzOS shall process personal data solely on documented instructions from the Organizer and strictly for the performance of event operating system services. DanzOS implements state-of-the-art Technical and Organizational Measures (TOMs), including end-to-end TLS encryption, row-level access controls, role-based authorization, and automated audit trail timestamp recording.

3. Subprocessors

The Organizer authorizes DanzOS to engage vetted subprocessors essential for infrastructure operations. Current authorized subprocessors include:

• Vercel Inc. (Hosting & Application Infrastructure)
• Supabase Inc. (Database Storage & Authentication)
• Resend Inc. (Transactional & Broadcast Email Delivery)
• Upstash Inc. (Background Job Queuing & QStash Verification)
• Stripe Inc. (Merchant Payment Processing)

For any data transfers to subprocessors outside the European Economic Area (EEA), DanzOS guarantees that EU Standard Contractual Clauses (SCCs) or adequacy decisions are executed.

4. Breach Notification

DanzOS shall notify the Organizer without undue delay (and no later than 36 hours) upon becoming aware of any confirmed personal data breach affecting the Organizer's workspace data.

5. Deletion and Return of Data

Upon contract termination or workspace closing, DanzOS shall delete or anonymize all personal data in accordance with statutory retention schedules and provide confirmation to the Organizer.

Processor Address: Virtual Business Address, Berlin, Germany • Contact: support@danzos.app