Attend Data Processing Addendum

Introduction

This Data Processing Addendum ("DPA") is between Kardoe Incorporated ("Kardoe," "Attend," "we," "us," or "our") and the organization that uses the Attend Services ("Customer," "you," or "your"). It is incorporated into our Terms of Service. If your organization has a signed order form or master agreement with us, this DPA applies to it if that agreement refers to this DPA or to our online terms, or if you and we sign this DPA. Whichever of these applies is the "Agreement." For a countersigned copy, contact legal@attend.vip.

If this DPA conflicts with the Agreement, this DPA controls with respect to the processing of Customer Personal Data. If this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses control.

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement.

Data Protection Laws: All laws that apply to the processing of Customer Personal Data under the Agreement, including, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as incorporated into UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA"), and other U.S. state privacy laws.
Attend Account Data: The email address, name, sign-in credentials, sessions, and passkeys of an Attend account. A person can use one Attend account to take part in events run by more than one organization.
Customer Personal Data: Personal data that we process on your behalf in providing the Services, as described in Section 2.
Usage Data: Information about how people use the Services: screens viewed, features used, actions taken (for example, that a message was sent, but not what it said), device and app details, performance and error measurements, approximate location derived from IP address, and the account identifier, name, email address, and event identifier that link this information to a person and event. Usage Data does not include the content of Customer Personal Data, such as messages, form responses, guest lists, travel details, files, or Secure Vault Data.
Data Subject: The identified or identifiable person to whom Customer Personal Data relates.
Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data while it is processed by us or our Subprocessors.
Secure Vault Data: Customer Personal Data stored in the Secure Vault, such as passport, national ID, visa, and driver's license numbers, which is end-to-end encrypted as described in Section 8.
Standard Contractual Clauses: The standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, as described in Section 16.
Subprocessor: A third party we engage to process Customer Personal Data on your behalf.
"Controller," "processor," "process," "personal data," "business," "service provider," "consumer," and "sell" and "share" have the meanings given in the applicable Data Protection Laws.

2. Roles and Scope

2.1 You are the controller. For Customer Personal Data, you are the controller (or, under the CCPA, the business) and we are your processor (or service provider). If you act as a processor on behalf of another controller, such as an event agency running an event for a client, we act as your subprocessor, and you are responsible for passing on any instructions or notices from that controller.

2.2 What is Customer Personal Data. Customer Personal Data is all personal data we process in providing the Services for you, other than the data listed in Section 2.3. It includes everything you, your staff, and your attendees submit to or do within your organization and events, such as guest lists, registrations, form responses, travel details, messages, and files.

2.3 Data we control ourselves. We act as an independent controller, under our Privacy Policy, only for:

Attend Account Data, which we need to authenticate people and keep the Services secure, and which is not tied to any single organization;
billing, contract, and contact information about your organization and its administrators, which we need to manage our relationship with you;
communications between us and you or your users about the Services;
information about visitors to our website; and
Usage Data, as described in Section 7.

2.4 Description of processing. The subject matter, nature, purpose, and duration of the processing, and the types of personal data and categories of Data Subjects, are described in Annex 1.

3. Processing on Your Instructions

We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you before processing unless the law prohibits us from doing so. Your instructions are the Agreement, this DPA, and how you and your authorized users configure and use the Services, for example by inviting guests, sending messages, building forms, or connecting integrations. Any additional instructions must be consistent with the Agreement and agreed in writing. We will tell you if we believe an instruction infringes Data Protection Laws, and we may suspend that processing until you confirm or change the instruction.

4. Your Responsibilities

You are responsible for:

Having a lawful basis for the Customer Personal Data you collect and ask us to process, and giving Data Subjects any required notices and obtaining any required consents. This includes consents for SMS messages and push notifications you send through the Services.
Collecting only what you need. This applies especially to sensitive information such as dietary, allergy, medical, and accessibility needs, which may reveal health or religious information, and to identity documents.
Deciding which of your staff may access Customer Personal Data and the Secure Vault, and keeping their access up to date.
Choosing where Customer Personal Data goes outside the Services. When you export data, share a link, or connect a service such as Slack, Cvent, or your own Stripe account, we process and transmit the data on your instructions and under this DPA. Once the recipient has received it, the recipient's own processing is governed by your agreement with that recipient, not by this DPA, and the recipient is not our Subprocessor.

5. Confidentiality of Personnel

We will ensure that our employees and contractors who are authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and access it only as needed to provide, support, and secure the Services.

6. Security

We will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks to Data Subjects. Our current measures are described in Annex 2 and on our Security page. We may update these measures over time, but we will not materially reduce the overall level of protection.

7. Usage Data

7.1 We control Usage Data. We collect Usage Data, through our analytics provider PostHog, to operate, maintain, secure, support, and improve the Services and to understand how they are used. We decide how Usage Data is used, so we are its controller, under our Privacy Policy, and not your processor. We do not provide identified Usage Data to you.

7.2 Limits. Usage Data never includes the content of Customer Personal Data. We will not use Usage Data for advertising or sell it, and we will not disclose it in a form that identifies you or your Data Subjects to anyone other than service providers acting on our behalf, such as PostHog, or as required by law. We keep Usage Data only for as long as we need it for the purposes in Section 7.1.

7.3 Our responsibilities. For Usage Data, we are responsible for our own compliance with Data Protection Laws, including telling people about it in our Privacy Policy and responding to their requests about it.

8. Secure Vault

Secure Vault Data is encrypted on the submitting device, and only people you have granted vault access can decrypt it, on their own devices. We do not hold, and cannot obtain, the keys or passphrases needed to decrypt it. As a result:

We, our personnel, and our Subprocessors cannot decrypt Secure Vault Data, and we will not attempt to.
We cannot provide Secure Vault Data in decrypted form to you, a Data Subject, or anyone else, including in response to legal process. We hold only the encrypted values and the unencrypted information described below. If we are legally required to disclose those, Section 13 applies.
Our assistance under Sections 10 and 11 is limited to the information we can access. We can delete Secure Vault Data on request.
We cannot recover Secure Vault Data if your organization loses every means of unlocking the vault that your administrators hold, including the recovery code.
Information about vault items that is not end-to-end encrypted, such as the document type, labels, the related event and attendee, timestamps, and access records, is protected under Section 6.

9. Subprocessors

9.1 Authorization. You give us general authorization to engage Subprocessors. Our current Subprocessors are listed in Annex 3.

9.2 Our obligations. Before a Subprocessor processes Customer Personal Data, we will enter into a written agreement with it that requires data protection obligations no less protective than those in this DPA, to the extent applicable to the services it provides. We remain responsible for each Subprocessor's performance of its obligations.

9.3 Changes. We will give you at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating Annex 3 and emailing the owners of your organization's account. In an emergency, for example to keep the Services secure or available, we may give shorter notice and will explain why.

9.4 Objections. You may object to a new Subprocessor on reasonable data protection grounds by emailing legal@attend.vip within the notice period. We will work with you in good faith to find a solution. If we cannot do so within 30 days, either of us may terminate the affected part of the Services, and we will refund any prepaid fees for the period after termination.

10. Data Subject Requests

The Services let you access, correct, export, and delete Customer Personal Data. Taking into account the nature of the processing, we will provide reasonable additional assistance so you can respond to Data Subjects exercising their rights under Data Protection Laws. If we receive a request directly from a Data Subject that relates to your Customer Personal Data, we will refer it to you within 5 business days and will not respond to it ourselves, except to confirm that we have referred it, unless the law requires us to.

11. Impact Assessments and Consultations

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities that you are required to carry out under Data Protection Laws. We may meet this obligation by providing our Security page, this DPA, and answers to reasonable security questionnaires.

12. Personal Data Breaches

We will notify you without undue delay, and in any event within 48 hours, after we become aware of a Personal Data Breach. We will send the notice to the owners of your organization's account and include, as it becomes available, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures we have taken or propose to take. We will take reasonable steps to contain, investigate, and remedy the breach, and will provide reasonable assistance with any notices you must give to authorities or Data Subjects. Our notice is not an admission of fault or liability.

13. Government and Legal Requests

If a government authority or other third party asks us to disclose Customer Personal Data, we will try to redirect the request to you. If we are legally required to respond, we will:

Notify you promptly and before disclosing, unless the law prohibits it. If it does, we will use reasonable efforts to obtain a waiver of the prohibition.
Review the legality of the request and challenge it where we reasonably conclude there are grounds to do so.
Disclose only the minimum information required. For Secure Vault Data, this can only be encrypted values and unencrypted information, as described in Section 8.
Keep a record of the request and our response, and provide you with information about requests we have received when you ask, to the extent the law permits.

14. Return and Deletion

14.1 During the term. You can export and delete Customer Personal Data at any time using the Services.

14.2 When the Agreement ends. You may choose whether we return or delete Customer Personal Data. For 30 days after the Agreement ends, you can export it using the Services, or ask us to provide it in a commonly used, machine-readable format. After that period, or sooner if you ask us to delete it, we will delete Customer Personal Data within 30 days, unless the law requires us to keep it. If the law requires us to keep any of it, this DPA continues to apply to that data and we will process it only for the purpose the law requires.

14.3 Backups and logs. Copies in backups are not used or restored for any purpose other than disaster recovery, and they expire within 30 days of deletion. If we ever restore a backup, we will delete again any Customer Personal Data that was due to be deleted. Security audit records are kept for as long as reasonably needed to secure the Services and meet legal obligations, and remain protected under this DPA. Aggregated or de-identified information is not Customer Personal Data.

15. Audits

15.1 Information. We will make available the information reasonably necessary to demonstrate our compliance with this DPA and Article 28 of the GDPR, including responses to reasonable security questionnaires, at least once a year and at other reasonable times.

15.2 Audits and inspections. If that information is not enough to demonstrate compliance, you may audit our compliance, yourself or through an independent auditor bound by confidentiality. Routine audits are limited to once a year, on at least 30 days' written notice. Additional audits, on shorter notice that is reasonable in the circumstances, are allowed where reasonably needed to investigate a Personal Data Breach, to respond to a request from a supervisory authority, or because we have not provided information needed to demonstrate compliance.

15.3 Conduct. Audits must take place during normal business hours, avoid unreasonable disruption to our operations, and must not compromise the security or confidentiality of other customers' data. You bear the costs of your audits, unless an audit reveals a material breach of this DPA by us. Audits of our Subprocessors are carried out by reviewing the reports and certifications they make available, or as their agreements with us allow.

16. International Transfers

16.1 Where data is processed. We are based in the United States, and Customer Personal Data is processed in the United States and in the other locations where we and our Subprocessors operate, including on Cloudflare's global network.

16.2 Transfer mechanism. For Customer Personal Data subject to the GDPR, UK GDPR, or Swiss law that is transferred to us in the United States, we rely on the Standard Contractual Clauses, supplemented as described below. This applies unless the transfer is covered by an adequacy decision that applies to us. You will be notified if we come to rely on a different mechanism.

16.3 EU transfers. The Standard Contractual Clauses are incorporated into this DPA as follows. Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor. Clause 7 (docking clause) applies. Under Clause 9, option 2 (general written authorization) applies, with the notice period in Section 9.3. The optional language in Clause 11 does not apply. Under Clauses 17 and 18, the governing law and courts are those of Ireland. The competent supervisory authority is determined under Clause 13. Annex I of the Standard Contractual Clauses is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by Annex 3.

16.4 UK transfers. For Customer Personal Data subject to the UK GDPR, the UK International Data Transfer Addendum to the Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, applies. Its Tables 1 to 3 are completed with the information in this DPA and its Annexes, and for Table 4, either party may end the Addendum as set out in its Section 19.

16.5 Swiss transfers. For Customer Personal Data subject to Swiss law, the Standard Contractual Clauses apply as described in Section 16.3, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

16.6 Transfer assessment. We will provide the information reasonably needed for you to complete the assessment required by Clause 14 of the Standard Contractual Clauses, including a description of the laws and practices that may affect the transferred data and the measures in Section 13 and Annex 2. We will notify you if we have reason to believe that applicable laws prevent us from meeting our obligations under the Standard Contractual Clauses.

16.7 Onward transfers. We will ensure that any transfer of Customer Personal Data to a Subprocessor outside the EEA, UK, or Switzerland is covered by an adequate transfer mechanism.

17. U.S. State Privacy Laws

Where the CCPA or a similar U.S. state privacy law applies, you disclose Customer Personal Data to us only for the limited and specified business purposes described under "Nature and purpose of processing" in Annex 1, and we will:

Process Customer Personal Data only for those business purposes.
Not sell or share Customer Personal Data, as those terms are defined in the CCPA.
Not retain, use, or disclose Customer Personal Data outside our direct business relationship with you, or for any purpose other than those business purposes, except as permitted by applicable law.
Not combine Customer Personal Data with personal data we receive from or on behalf of others, or collect from our own interactions with consumers, except as permitted by applicable law.
Provide the same level of privacy protection required of businesses by the applicable law, and notify you within 5 business days if we determine we can no longer meet our obligations.
Help you respond to consumer requests. You can forward a request to legal@attend.vip, and where the Services do not already let you act on it, we will carry it out, or give you the means to, within 10 business days. If a consumer sends a request to us directly, we will tell you as described in Section 10.

You may take reasonable and appropriate steps to ensure that we use Customer Personal Data in a manner consistent with your obligations, including through the information and audits in Section 15, and, on notice, to stop and remediate any unauthorized use. We certify that we understand and will comply with these restrictions.

18. Liability

Each party's liability arising out of or relating to this DPA, including the Standard Contractual Clauses to the extent permitted by law, is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits either party's liability to Data Subjects under the Standard Contractual Clauses where such a limitation is not permitted.

19. Term, Versions, and Changes

This DPA remains in effect for as long as we process Customer Personal Data on your behalf. This is version 1.0, effective October 16, 2026. We keep every previous version and will provide it on request. We may update this DPA to reflect changes in Data Protection Laws, the Services, or our Subprocessors. If a change materially reduces the protection of Customer Personal Data, we will notify the owners of your organization's account at least 30 days before it takes effect, unless the change is required by law. Changes do not apply to a DPA that you and we have signed unless you agree to them in writing.

Annex 1: Description of Processing

Parties

Data exporter: The Customer, as identified in the Agreement or in its Attend account, acting as controller (or as processor for its own client). Activities: using the Services to run its events. Contact: the owners of the Customer's Attend organization.
Data importer: Kardoe Incorporated, 55 Water Street, Floor 3, Brooklyn, NY 11201, United States, acting as processor. Activities: providing the Services. Contact: legal@attend.vip.

Categories of Data Subjects

Attendees, guests, and their plus-ones invited to or registered for the Customer's events.
The Customer's staff, contractors, crew, and vendors who use the Services or are recorded in them.
The Customer's contacts and clients, including people on lists the Customer imports.
Other people whose information appears in content submitted to the Services, such as messages and documents.

Categories of personal data

Contact details: name, email address, mobile number, organization, and job title.
Event participation: invitations, RSVPs, registrations, tickets, schedules, sessions, check-ins, badges, and form responses.
Travel and logistics: flights, accommodation, ground transport, rental vehicles, and related booking details.
Communications: chat messages, announcements, support conversations, email, SMS, and push notification content and delivery records.
Content: documents, images, and other files uploaded to the Services.
Technical and usage data: device and push notification tokens, IP addresses, and access records.
Payment records: ticket orders, payment status, and Stripe reference identifiers. Ticket payments are made to the Customer's own Stripe account, with the Customer as merchant of record. Card details are entered on Stripe's hosted checkout and are not processed by us.
Identity documents, as Secure Vault Data: passport, national ID, visa, and driver's license numbers and related details.

Special categories of data

Depending on how the Customer configures the Services, Customer Personal Data may include dietary requirements, allergies, medical information, and accessibility needs, which may reveal health information or religious beliefs. These are protected by the measures in Annex 2, including role-based access controls that limit which staff can see them. Identity documents are protected as Secure Vault Data under Section 8.

Frequency of transfer

Continuous, for as long as the Customer uses the Services.

Nature and purpose of processing

We process Customer Personal Data only to provide the Services to the Customer: hosting, storing, organizing, displaying, transmitting, and deleting it to deliver event invitations and registration, schedules, travel coordination, messaging and notifications, forms, reporting, and payments; to provide customer support; and to troubleshoot, maintain, and secure the Services.

Duration and retention

For the term of the Agreement and until return or deletion under Section 14. During the term, the Customer decides how long to retain Customer Personal Data and can delete it at any time.

Transfers to Subprocessors

As described in Annex 3, for the duration set out above.

Competent supervisory authority

As determined under Clause 13 of the Standard Contractual Clauses.

Annex 2: Technical and Organizational Measures

Encryption: All traffic uses HTTPS (TLS) with HTTP Strict Transport Security. Databases and file storage are encrypted at rest by our hosting provider. Secure Vault Data is end-to-end encrypted, and we hold no keys to decrypt it.
Separation of customers: Every request is limited to the caller's organization, and this check is enforced on the server for every record.
Separation of data stores: Sign-in and identity data, event data, webhook data, and security audit logs are kept in separate databases. Uploaded files are kept in private storage unless the Customer publishes them.
Access control: Role-based access with owner, admin, and member roles plus per-event roles. No user can grant a role above their own. Contact details and notes are hidden from roles that do not need them, and attendees see only their own information and what the organizer chooses to share.
Authentication: Passwordless sign-in with single-use, time-limited email codes, and passkeys for staff. Session cookies are Secure, HttpOnly, and SameSite, and requests from untrusted websites are rejected. Signing out or revoking a session invalidates its access tokens. Repeated failed codes trigger lockouts, and public entry points are rate limited.
Event passes: Passes that let attendees in without email are limited to a single event, stored only as a hash, exchanged for access tokens that expire within three minutes, and stop working when the attendee is removed.
Our personnel: Platform-level access is limited to a small number of Attend administrators, and their changes are written to a protected audit log.
Logging and monitoring: Security-sensitive actions, including administrator actions, permanent deletions, and Secure Vault reveals, are recorded in a separate audit database that the application's own interfaces cannot read or change. Each request carries an identifier so incidents can be traced end to end.
Secrets management: Signing keys and service credentials are stored as encrypted platform secrets, never in source code, and the Services refuse to start if a required secret is missing.
Secure development: Access rules are declared alongside each data model and checked automatically on every build. Changes are reviewed before release and tested in a separate development environment with its own databases. We regularly review our code and configuration for security issues and fix findings by severity.
Integrations: Webhooks we send are signed (HMAC-SHA256), and webhooks we receive are signature-checked and time-limited. Connected tools use OAuth or scoped, rate-limited API keys, and act with the permissions of the person who connected them.
Availability and resilience: The Services run on Cloudflare's distributed network, and our databases support point-in-time recovery.
Data minimization with providers: Each Subprocessor receives only the data it needs for its task. For ticket sales, card details are entered on Stripe's hosted checkout for the Customer's own Stripe account and never reach our servers.
Vulnerability reporting: Security issues can be reported to security@attend.vip.

Annex 3: Subprocessors

Cloudflare, Inc. (United States and global network): hosting, databases, file storage, real-time messaging, voice and video calls, and inbound email routing.
Amazon Web Services, Inc. (United States): email delivery (Amazon SES) and SMS delivery (AWS End User Messaging).
Apple Inc. (United States): push notifications to iOS and macOS devices (Apple Push Notification service).
Google LLC (United States): push notifications to Android devices and web browsers (Firebase Cloud Messaging).

PostHog, Inc. (United States) collects Usage Data on our behalf, as described in Section 7. Usage Data is not Customer Personal Data, so PostHog is not a Subprocessor under this DPA. It is listed in our Privacy Policy.

Services a Customer chooses to connect are not our Subprocessors, as described in Section 4. These include integrations such as Slack or Cvent, and the Customer's own Stripe account for ticket sales, where the Customer is the merchant of record.