1. Parties and roles
This Data Processing Agreement ("DPA") is concluded between the Organizer (controller) and Jetlio, s.r.o., IČO 09967231, Voroněžská 2547/1, 616 00 Brno, registered at the Regional Court in Brno, file C 121887 ("Bookitive", processor). It forms part of the Terms of Service and applies automatically upon their acceptance (Art. 28(9) GDPR permits electronic form). A countersignable PDF is available at [email protected].
Controller-capacity carve-out: for organizer account data, billing, and platform security and fraud prevention (risk scoring, cross-event abuse signals, protection lists), Bookitive acts as an independent controller as described in the Privacy Policy — that processing is outside the scope of this DPA.
2. Subject matter, duration, nature and purpose
Bookitive processes the personal data described in Annex 1 on the Organizer's behalf for the purpose of providing the ticketing platform (selling tickets, matching payments, delivering tickets, running check-in, sending event emails, and — where the Organizer uses them — sponsor campaigns), for the duration of the Terms of Service.
3. Bookitive's obligations (Art. 28(3) GDPR)
Bookitive shall:
- process personal data only on the Organizer's documented instructions, given through the use and configuration of the Platform, including with regard to transfers to third countries, unless required by EU or Czech law — in which case Bookitive informs the Organizer unless the law prohibits it. Activating a third-party integration in the Platform's settings (for example connecting the Organizer's own Mailchimp account) and enabling its data sync constitutes such a documented instruction (the Platform records the activation: timestamp, acting user and the selected sync scope); the connected service is engaged by the Organizer under the Organizer's own contract, its role with respect to the data (typically the Organizer's processor) is determined by that contract, and it is in no case a Bookitive sub-processor;
- ensure that persons authorized to process the data are bound by confidentiality, which survives the end of their engagement;
- implement the technical and organizational measures in Annex 2 (Art. 32 GDPR);
- respect the subprocessing conditions in section 4;
- assist the Organizer, taking into account the nature of processing, in responding to data subject requests — Bookitive forwards requests received directly and provides assistance within 14 days;
- assist the Organizer with Articles 32–36 GDPR, including breach notification: we notify the Organizer without undue delay, and in any case within 48 hours of confirming a breach affecting the Organizer's personal data, with the information needed for the Organizer's own 72-hour notification;
- at the end of processing, delete or return the data per section 7;
- make available the information necessary to demonstrate compliance and allow audits per section 6; and
- inform the Organizer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.
4. Subprocessors
The Organizer grants a general authorization to engage the subprocessors listed at Subprocessors. Bookitive imposes on each subprocessor data protection obligations equivalent to this DPA and remains fully liable for their performance.
Changes: we announce new or replaced subprocessors on the subprocessor page and to organizers at least 30 days in advance. The Organizer may object within that period on reasonable data-protection grounds; the parties will seek a solution in good faith, and if none is found, the Organizer may terminate the affected services with a pro-rata refund of prepaid fees, if any.
5. International transfers
Processing takes place primarily in the EU (AWS eu-central-1, Frankfurt). Where a subprocessor processes personal data outside the EEA, the transfer relies on an EU adequacy decision (including the EU–US Data Privacy Framework for certified recipients) and/or the EU Standard Contractual Clauses (Module 3, processor→subprocessor), which are incorporated by reference and apply automatically if the relied-upon adequacy decision ceases to be valid. Details per vendor are on the subprocessor page.
6. Audits
Bookitive demonstrates compliance primarily through documentation: this DPA, the subprocessor page, the Security page and completed security questionnaires. Where these are insufficient, the Organizer may audit — including through an independent auditor bound by confidentiality — at most once per year, with 30 days' notice, during business hours, at the Organizer's cost, unless a material non-compliance was found, in which case the audit is at our cost.
7. Deletion and return
Upon termination of the Terms of Service, the Organizer chooses deletion or return of the personal data (export tools are available for 30 days after termination). Absent an instruction, Bookitive deletes the data within 90 days of termination. Copies in encrypted backups are purged within the backup rotation period of up to 90 days and remain protected by this DPA until purged. Data whose retention is required by law (accounting, tax) is retained for the statutory period only.
8. Liability, term, law
Liability follows the Terms of Service, including its cap and statutory exceptions. This DPA lasts as long as processing on the Organizer's behalf and is governed by Czech law. In case of conflict between this DPA and the Terms regarding personal data, this DPA prevails.
Annex 1 — Description of processing
Data subjects: ticket buyers, event guests and attendees, the Organizer's customers, sponsor contact persons (where sponsor campaigns are used).
Categories of personal data: identification and contact data (name, email, phone), order data (tickets, seats, amounts, payment status, payment reference, payer account identification from bank matching), attendee names, ticket delivery and device-binding data, check-in records (time, result, entrance), phone verification records, sponsor contact and correspondence data. No special categories of data are intended to be processed; the Organizer shall not use free-text fields for them.
Processing operations: collection via checkout and box office, storage, payment matching against bank transactions, email delivery, PDF/wallet ticket generation, QR validation and check-in, exports for the Organizer, AI-assisted drafting of sponsor emails (sponsor data only), deletion.
Annex 2 — Technical and organizational measures
- Encryption: TLS 1.2+ in transit; AES-256-GCM at rest for credentials and secrets (bank tokens, SMTP passwords, ticket TOTP secrets); passwords stored as bcrypt hashes (cost 12); key material manageable via AWS KMS.
- Access control: role-based permissions at organization and event level (e.g. the scanner role sees only check-in); authenticated APIs; per-organization data isolation.
- Auditability: administrative actions recorded in an audit log (actor, action, target, IP, user agent), retained 365 days.
- Availability: managed EU cloud infrastructure (AWS eu-central-1), backups with rotation ≤90 days, offline-capable check-in to withstand connectivity loss.
- Development: code review before deployment, dependency updates, environment separation, no production credentials in code.
- Organizational: confidentiality obligations of persons with access; documented incident-response process; data protection by design in feature development.
Bookitive may update these measures provided the overall security level is not materially reduced.
Annex 3 — Subprocessors
The current list is maintained at bookitive.com/en/subprocessors/.
Effective from 1 September 2026