Skip to content
bagevent.io

Data Processing Agreement

A Data Processing Agreement (DPA) is available on request for business customers. Email milo@bagevent.io with your organization's name and we will send it to you for review.

This page summarises how the roles are split and what we already do. It is not the DPA itself.

Who is controller, who is processor

  • Attendee data collected through your events — registrations, orders, check-ins, and what attendees do in the app at your event — belongs to your event. You, the organizer, are the controller, and BagEvent processes it on your instructions to provide the service.
  • Your organizer account data — the people on your team and your billing details — is data BagEvent controls, as set out in our privacy policy.

What we already do as your processor

These are described in the privacy policy and on the security page:

  • Where the data is held. On Google Cloud Platform in Singapore (asia-southeast1). The privacy policy sets out the basis for transfers from the EEA and the UK.
  • Who else handles it. Every sub-processor is listed on the sub-processors page, with what it does and which data it handles.
  • Requests from attendees. Organizers can export an attendee's data and action an erasure request directly from the attendee record.
  • Security incidents. If one affects personal data we process for you, we notify you without undue delay after becoming aware of it.
  • When a subscription ends or an account closes. Ending a subscription deletes nothing: your events and attendee data are kept and stay exportable. Closing a person's account starts a 30-day grace period, after which that person's own personal data is anonymised; it does not delete your organization's events or attendee records. Attendee data is deleted when you ask — for one attendee from the attendee record, or for the whole organization by writing to us. Invoices and payment records are kept for the period tax law requires.

Certifications

BagEvent holds no security or data protection certification, such as SOC 2 or ISO 27001, and claims none. If you have a security questionnaire, send it to milo@bagevent.io and we will answer it.