Data Processing Addendum

This addendum (“DPA”) is part of the Terms of Service between the host (“you”, the controller) and Programmable, LLC (“we”, the processor). It applies to personal data we process for you in providing Programmable Talk (“Customer Personal Data”). If it conflicts with the Terms, this DPA wins for that data.

1. Details of the processing

• Subject matter and purpose: taking and managing registrations for your events, and the features you choose: invitations, email to registrants, reminders, a live room, company research, website reviews, introductions, exports, webhooks, and sending registrations to platforms you connect.
• Duration: while you use the Service, then until deletion under section 9.
• Data subjects: people who register for, are invited to, or attend your events; your contacts you import; your team.
• Categories of data: names, email addresses, company and company domain, how they arrived (way in, UTM tags), registration status and attendance, what they write to you (hopes, questions, replies), company research and website reviews, introduction preferences, and email delivery records. You agree not to collect special categories of data, government identifiers, payment card details or passwords through the Service.

2. Your instructions

We process Customer Personal Data only on your documented instructions: these Terms, this DPA, and what you set up and do in the Service. That includes transfers to the services you connect (Luma, Zoom, programmable.info, programmable.marketing, your AI provider, your webhook), which you instruct by connecting them. We will tell you if we think an instruction breaks data protection law, unless the law forbids us to. If the law requires us to process data otherwise, we will tell you first unless it forbids that.

3. Confidentiality

Everyone we allow to process Customer Personal Data is bound by confidentiality, and has access only as far as their work needs.

4. Security

We keep appropriate technical and organisational measures, including:

• encryption in transit (TLS) on every connection, and encryption at rest for keys to connected services and for link secrets; personal page and invitation links stored only as hashes;
• separation between hosts' accounts in every query, with access by role inside a team;
• production access limited to the people who run the Service;
• rate limits and abuse checks on public forms and links; signed webhooks;
• daily backups, the off-site copy encrypted, kept for 14 days;
• software kept up to date, and changes reviewed and tested before release.

We may improve these measures over time, but won't reduce the overall protection.

5. Subprocessors

You authorise us to use the subprocessors below. Each is bound by written terms that protect the data at least as well as this DPA, and we remain responsible for them. We will tell account owners by email, and in the dashboard, at least 14 days before adding or replacing one, and list the change below until it takes effect. You may object on reasonable data protection grounds within that time; if we can't resolve it, you may end the affected part of the Service.

programmable.info and programmable.marketing are operated by us. Stripe, which bills hosts for paid plans, is not a subprocessor either: it handles only hosts' own billing details, never registrants' data, and we use it as controller under our Privacy Policy. The services you connect yourself (Luma, Zoom, your AI provider, your webhook, video platforms) are not our subprocessors: you choose them, under your own agreements with them.

6. Helping you

• Requests from people: the Service lets you export and delete registrants, and lets registrants cancel, stop email and turn off research themselves. If a person writes to us directly about your event, we pass it to you without undue delay and don't answer it ourselves, unless you ask us to.
• Assessments and consultations: we give you the information you reasonably need for data protection impact assessments and consultations with authorities about the Service.

7. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer Personal Data, with what we know (what happened, the data and people likely affected, the likely consequences, and what we are doing), and keep you updated. We will help you meet your own duties to notify authorities and people.

8. Transfers

We and our subprocessors process data in the United States. Where the GDPR, the UK GDPR or Swiss law applies to a transfer, the Standard Contractual Clauses adopted by the European Commission (Module Two, controller to processor) are incorporated into this DPA, with the UK International Data Transfer Addendum for UK transfers, and adapted for Swiss transfers as the Swiss authority requires. For the Clauses: clause 7 (docking) applies; clause 9 option 2 (general authorisation, with the notice in section 5); clause 11's optional language does not apply; clauses 17 and 18 are governed by and brought before the courts of Ireland; Annex I is section 1 of this DPA with you as data exporter and us as data importer; Annex II is section 4; Annex III is section 5.

9. Deleting or returning data

You can export and delete Customer Personal Data at any time. When your account ends, we delete it 30 days later, and it leaves our backups within the following 15 days, unless the law requires us to keep it. Delivery records are deleted sooner, as the Privacy Policy describes (webhooks after 30 days, email records after 13 months).

10. Showing we comply

We give you the information reasonably needed to show we meet this DPA, and answer your reasonable written questions about it. If that isn't enough, or an authority requires it, you may have us audited, at most once a year (unless after a breach), with 30 days' notice, during working hours, by an auditor bound by confidentiality, at your cost.

11. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, we act as your service provider (or processor). We will not sell or share Customer Personal Data, nor retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service; nor combine it with personal data from elsewhere, except as those laws allow. We will tell you if we can no longer meet these obligations, and you may take reasonable steps to stop unauthorised use.

12. Liability and order

Each side's liability under this DPA is subject to the limits in the Terms, except where the Standard Contractual Clauses or the law don't allow it. If this DPA and the Clauses conflict, the Clauses win.