Data Processing Addendum (DPA)

Last updated: 2026-10-31

This DPA forms part of the agreement between you (the “Controller” / “Organiser”) and Party Platform (the “Processor”) for use of Party Platform.

1. Definitions

• Controller: the organiser determining purposes and means of processing attendee data.
• Processor: Party Platform processing personal data on Controller instructions.
• Personal Data, Processing: as defined in UK GDPR.

2. Subject matter, duration, nature & purpose

• Subject matter: attendee management, invitations, RSVP collection, event communications.
• Duration: for the term of the Service and as retained per system configuration.
• Nature: collection, storage, transmission, and logging of delivery status.
• Purpose: provide event planning functionality and reliability/security controls.

3. Categories of data and data subjects

• Data subjects: attendees, invitees, organisers.
• Data types: names, emails, phone numbers (optional), RSVP responses, delivery logs, IP/security logs.

4. Controller obligations

• Ensure a lawful basis to contact attendees and process their data.
• Provide appropriate privacy information to attendees.
• Ensure instructions to Processor are lawful.
• Respond to data subject requests (we assist where applicable).

5. Processor obligations

• Process personal data only on documented instructions from the Controller.
• Ensure persons authorised to process data are bound by confidentiality.
• Implement appropriate technical and organisational measures.
• Assist the Controller with security, breach notifications, and DPIAs where relevant.

6. Security measures

• Encrypted connections (HTTPS)
• Access controls and authentication protections
• Audit logging for critical actions
• Availability and reliability monitoring

7. Sub-processors

We may use sub-processors (email/SMS delivery, hosting). We require appropriate contractual safeguards. A list may be provided upon reasonable request.

8. Data retention

• Security/audit logs retained up to 365 days
• Message delivery logs retained up to 365 days

9. Data subject requests

Where we receive a request directly, we will direct it to the relevant Controller where appropriate and assist as required.

10. Personal data breaches

We will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data, and provide information reasonably required to support compliance.

11. Deletion/return of data

Upon termination or deletion requests from the Controller, we will delete or return Controller personal data within a reasonable timeframe, subject to legal retention obligations.

12. Contact

DPA and data protection queries: general@mypartyplatform.com