Data Processing Addendum

1. Application and definitions

1.1 This Data Processing Addendum ("DPA") forms part of the Terms of Service between TixBloom ("the Company", the "Intermediary") and each organiser (the "Organiser") and applies whenever the Company processes Organiser Personal Data. "Organiser Personal Data" means personal data about the Organiser's attendees, exhibitors, sponsors, speakers, staff and other individuals that the Organiser collects or processes through the Platform. "Processing", "personal data", "data intermediary" and related terms have the meanings in the PDPA; where other data protection law applies, equivalent terms (controller, processor) apply.

1.2 The Organiser is the organisation responsible for Organiser Personal Data and the Company processes it on the Organiser's behalf and for the Organiser's purposes. For data about the Organiser's own account holders and billing, the Company is itself responsible, as described in the Privacy Policy.

2. Instructions

2.1 The Company will process Organiser Personal Data only on the Organiser's documented instructions, which consist of the Terms of Service, this DPA, the Organiser's configuration of the Platform (including features it enables, integrations it connects and exports it runs) and any further written instructions the parties agree. The Company will inform the Organiser if, in its opinion, an instruction breaches the PDPA, and may suspend processing of that instruction.

2.2 The subject matter is the operation of the Organiser's events on the Platform. The nature and purpose are hosting, storing, transmitting, displaying, analysing and deleting data to provide the features of the Platform. The duration is the term of the Terms of Service plus the retention periods in the Privacy Policy. Categories of data and individuals are as listed in the Privacy Policy, Part 2.

3. Security

3.1 The Company will implement and maintain reasonable security arrangements to protect Organiser Personal Data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, as required by section 24 of the PDPA, including the measures described in the Security and Data Residency statement, and will ensure that personnel with access are bound by confidentiality.

3.2 The Company will not retain Organiser Personal Data once it is no longer necessary for the purposes in Part 2, subject to the Organiser's export rights and the Company's own legal retention obligations.

4. Sub-processors

4.1 The Organiser authorises the Company to engage the sub-processors listed in the Security and Data Residency statement. The Company will impose data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance.

4.2 The Company will give at least 30 days' notice before adding a new sub-processor that will process Organiser Personal Data. The Organiser may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Organiser may terminate the affected service and receive a pro-rata refund of prepaid subscription fees for the unused period as its sole remedy.

5. Transfers

5.1 Organiser Personal Data is stored in Singapore. Where processing by a sub-processor involves a transfer outside Singapore, the Company will ensure the recipient is bound by legally enforceable obligations providing a standard of protection comparable to the PDPA, so that the Organiser's transfer limitation obligation is satisfied.

6. Assistance and individual requests

6.1 Taking into account the nature of the processing, the Company will assist the Organiser by appropriate technical and organisational measures, including the export, correction, deletion, consent-withdrawal and audit-log features of the Platform, in meeting access, correction, withdrawal and portability requests. The Company will forward to the Organiser any such request it receives from an individual about Organiser Personal Data within 5 business days and will not respond substantively itself unless the Organiser asks it to or the law requires.

6.2 The Company will provide reasonable assistance with data protection impact assessments and consultations with the Personal Data Protection Commission relating to the Platform, at the Organiser's cost where the effort is more than minimal.

7. Breach notification

7.1 The Company will notify the Organiser without undue delay, and in any event within 48 hours, after confirming a data breach affecting Organiser Personal Data, and will provide the information reasonably available about the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences and the measures taken or proposed, supplementing it as more becomes available. The Organiser is responsible for assessing whether the breach is notifiable to the Commission and to individuals and for making those notifications, unless the parties agree otherwise in writing.

8. Audit

8.1 On written request not more than once in any 12-month period, the Company will provide the Organiser with information reasonably necessary to demonstrate compliance with this DPA, including summaries of its security measures, sub-processor list and any third-party assessments it holds. Where that information is insufficient to meet a legal obligation of the Organiser, the parties will agree the scope, timing, duration and confidentiality of a further audit conducted at the Organiser's cost, during business hours, by an independent auditor bound by confidentiality, without access to other customers' data.

9. Return and deletion

9.1 The Organiser may export Organiser Personal Data at any time during the term and for 30 days after termination. After that period the Company will delete or anonymise Organiser Personal Data within 90 days, except for copies it must retain under law or for invoicing, dispute or security purposes, which remain protected by this DPA until deleted.

10. Liability and order of precedence

10.1 Each party's liability under this DPA is subject to the exclusions and limitations in the Terms of Service. The Organiser indemnifies the Company against claims, fines and losses arising from the Organiser's instructions, its own breach of data protection law, or its failure to obtain consents or give notices required for the processing. In case of conflict between this DPA and the Terms of Service on the subject of personal data, this DPA prevails.

11. Contact

11.1 Data Protection Officer, TixBloom, Singapore. Email: billing@tixbloom.com.