Horn Events

Data Processing Agreement (DPA) This DPA applies where Horn Events processes personal data on behalf of an organizer, agency or white-label operator (each a “Controller”) in connection with their use of the Platform. It forms part of the applicable agreement. 1. Roles and scope The Controller determines the purpose of processing attendee personal data it collects for its events; Horn Events processes that data as processor only on documented instructions, being the Controller’s use of the Platform. Horn Events is an independent controller for account, security, payment and platform operation data. 2. Subject-matter and data Subject-matter: provision of ticketing, messaging, payment-collection and event-operations services. Data subjects: ticket buyers and attendees. Data types: contact details, order and ticket data, attendee fields configured by the Controller, and gate-scan metadata. 3. Obligations ● Process only on instructions; maintain confidentiality; apply appropriate technical and organizational security (including row-level access control and audited mutations). ● Use sub-processors per the Sub-processor List; notify of changes; impose equivalent terms. ● Assist the Controller with data-subject requests, security, breach notification and, where applicable, impact assessments. ● On termination, delete or return personal data except records retained by law (e.g. financial/audit records).