Version 1.0 · Effective date: 1 August 2025
This Data Processing Addendum ("DPA") forms part of the agreement between CrowdTagg Inc. ("Processor") and the event organizer ("Controller") who uses the CrowdTagg platform. It governs the processing of personal data on the Controller's behalf in accordance with GDPR Article 28, the UK GDPR, the CCPA, and applicable privacy law. Capitalized terms not defined here have the meanings given in the main Services Agreement.
Controller: The event organizer determines the purposes for which attendee contact data (email, phone, name) is collected and used — e.g. to send event photos and marketing communications to attendees of their event.
Processor: CrowdTagg processes attendee contact data on the Controller's behalf solely to: (a) deliver matched photos to attendees; (b) send event-related notifications as directed by the Controller; and (c) provide the platform features described in the Services Agreement.
Excluded data: Biometric faceprints are processed and immediately destroyed by CrowdTagg's own systems. They are never accessible to the Controller and fall outside this DPA's scope of shared data.
CrowdTagg shall process personal data only on documented instructions from the Controller (including those set out in the Services Agreement and this DPA) and shall not process data for its own purposes except as permitted by law. If CrowdTagg is required by law to process data for other purposes, it will inform the Controller unless prohibited by law.
CrowdTagg shall ensure that persons authorized to process personal data are under appropriate confidentiality obligations.
CrowdTagg implements and maintains appropriate technical and organizational security measures, including:
The Controller grants general authorization for CrowdTagg to engage the following sub-processors:
CrowdTagg will provide at least 30 days' written notice before adding or replacing sub-processors. The Controller may object to a new sub-processor within 14 days; if the parties cannot resolve the objection, the Controller may terminate the Services Agreement for that specific processing activity without penalty.
Personal data may be processed in the USA and other countries. For transfers from the EU/EEA or UK, CrowdTagg relies on Standard Contractual Clauses (2021/914/EU) as incorporated in this DPA. The SCCs can be provided on request at privacy@crowdtagg.com. For transfers subject to UK GDPR, the applicable International Data Transfer Addendum (IDTA) applies.
CrowdTagg will, to the extent technically possible, assist the Controller in responding to requests from attendees exercising their data subject rights (access, rectification, erasure, restriction, portability, objection). Requests received directly by CrowdTagg will be forwarded to the Controller within 5 business days. CrowdTagg will implement verified erasure of an attendee's contact data within 10 business days of a confirmed deletion request.
CrowdTagg will notify the Controller without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting the Controller's attendee data. Notification will include: nature of the breach, categories and approximate number of data subjects affected, categories and approximate number of records affected, likely consequences, and measures taken or proposed.
CrowdTagg will provide reasonable assistance to the Controller in conducting data protection impact assessments (DPIAs) and prior consultation with supervisory authorities, where required, in relation to processing under this DPA.
CrowdTagg will make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits (including inspections) conducted by the Controller or a mandated auditor, subject to reasonable notice (30 days) and confidentiality obligations. In lieu of an on-site audit, CrowdTagg may provide a current SOC 2 Type II report or equivalent third-party audit report to satisfy the Controller's audit rights.
Upon termination or expiration of the Services Agreement, CrowdTagg will, at the Controller's election, delete or return all personal data processed on the Controller's behalf within 30 days, and will delete existing copies (except to the extent retention is required by law). A written certificate of deletion is available on request.
This DPA is governed by the same governing law as the main Services Agreement. Where GDPR applies, disputes relating to this DPA shall be subject to the courts of the EU member state in which the Controller is established.
Data Protection inquiries: privacy@crowdtagg.com / dpo@crowdtagg.com · CrowdTagg Inc., USA