Gaytherings← Back

Global Data Processing Agreement

Effective Date: August 17, 2026 - Gatherings LLC

This Global Data Processing Agreement ("DPA") applies if and to the extent that Gatherings LLC dba Gaytherings ("Gaytherings," "we," "us," or "our") Processes Organizer Personal Data on behalf of an Organizer ("Organizer," "you," or "your") under the Gaytherings Terms of Service and Organizer Agreement (collectively, the "Agreement"). This DPA is made pursuant to the Agreement, supplements and forms an integral part of the Agreement, and is effective as of your first use of the Services. Unless stated otherwise, all terms, conditions, and definitions in the Agreement apply to this DPA. Should a conflict between this DPA and the Agreement exist, the terms of this DPA control.

Acceptance of this DPA

By providing Organizer Personal Data to Gaytherings for Processing under the Agreement, Organizer agrees to the terms and conditions of this DPA on its own behalf and, where applicable, on behalf of any entity or organization that it represents. Organizer represents and warrants that it has the authority to enter into this DPA and to bind any such entity or organization to this DPA. If Organizer does not agree to the terms of this DPA, Organizer must not provide Organizer Personal Data to Gaytherings for Processing under the Agreement.

Modification to this DPA

We may modify this DPA from time to time by posting an updated version at https://www.gaytherings.com/legal/global-data-processing-agreement or through other reasonable means. If we make material changes to this DPA, we will use reasonable efforts to provide notice to you, which may include email notification, notifications through the Services, or other communications. The "Last Updated" date at the top of this DPA indicates when this DPA was most recently revised. You are responsible for regularly reviewing this DPA. Unless otherwise specified in the notice, any modifications to this DPA will become effective upon the effective date stated in the updated DPA. Your continued provision of Organizer Personal Data to Gaytherings for Processing or continued use of the Services following the effective date of an updated DPA constitutes your acceptance of the modified DPA. If you do not agree to any modification to this DPA, Organizer must cease providing Organizer Personal Data to Gaytherings for Processing and discontinue any use of the Services that involves such Processing.


If you have any questions about this DPA, contact us at support@gaytherings.com.

Definitions

Capitalized terms not defined below have the meaning given to them in the Agreement.


"Controller" means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the Processing of Organizer Personal Data.


"Data Protection Laws" means data protection laws or privacy laws of any country or state applicable to our and/or your Processing of Organizer Personal Data.


"Data Subjects" means the identified or identifiable natural person to whom Personal Data relates.


"European Economic Area" or "EEA" means the member states of the European Union together with Iceland, Liechtenstein, and Norway, as may be updated from time to time.


"EU GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).


"Organizer Personal Data" means any Personal Data that is submitted to, collected through, or otherwise made available via the Services by or on behalf of Organizer or its customers, and that is Processed by us on your behalf in our role as a processor in connection with the provision of the Services.


"Personal Data" means any information relating to an identified or identifiable natural person, including any information that can reasonably be used to identify, contact, or locate such person, whether directly or indirectly. This includes identifiers such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. Personal Data includes any information defined as "personal data," "personal information," or an equivalent term under Data Protection Laws.


"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Organizer Personal Data transmitted, stored, or otherwise Processed. A Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security, integrity, or availability of Organizer Personal Data, such as unsuccessful login attempts, pings, port scans, or denial-of-service attacks that do not result in access to Organizer Personal Data.


"Process" or "Processing" means any operation or set of operations that is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure or destruction.


"Processor" means any entity (including us) that Processes Organizer Personal Data on your behalf and in accordance with your documented instructions, as further described in this DPA.


"Restricted Transfer" means any transfer of Organizer Personal Data via the Services, whether directly or through onward transfer, that is subject to restrictions under Data Protection Laws, including: (i) where the EU GDPR applies, a transfer from the EEA to a country or recipient outside the EEA not recognized by the European Commission as providing adequate protection; (ii) where the UK GDPR applies, a transfer from the United Kingdom to a country or recipient not subject to adequacy regulations under Section 17A of the U.K. Data Protection Act 2018; and (iii) where the Swiss Federal Act on Data Protection applies, a transfer from Switzerland to a country or recipient not recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC) as providing adequate protection. A Restricted Transfer includes remote access to Organizer Personal Data from such a country or by such a recipient.


"Sensitive Data" means any category of Personal Data that is subject to heightened protection under Data Protection Laws outside the European Economic Area, including U.S. state privacy laws such as the CCPA, CPRA, VCDPA, and similar legislation. Such data may include financial account information, government-issued identifiers, precise geolocation data, health or medical data, biometric information, racial or ethnic origin, or other data deemed sensitive or requiring additional safeguards under applicable law.


"Special Category Data" means the categories of Personal Data described in Article 9(1) of the EU GDPR and similar laws, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning a natural person's sex life or sexual orientation.


"Standard Contractual Clauses" or "SCCs" means (i) where the EU GDPR applies, the standard contractual clauses annexed to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries ("EU SCCs"); (ii) where the UK GDPR applies, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office under Section 119A of the UK Data Protection Act 2018 ("UK Addendum"); and (iii) where Personal Data is transferred from Switzerland to outside of Switzerland or the EEA, the EU SCCs as amended in accordance with guidance from the Swiss Federal Data Protection and Information Commissioner ("Swiss SCCs"); in each case as they may be amended, superseded, or replaced from time to time.


"Sub-Processor" means any third party engaged by us to Process Organizer Personal Data on your behalf in connection with the provision of the Services. A Sub-Processor may include hosting providers, infrastructure and cloud service providers, analytics or automation vendors, communication platforms, or other subcontractors that Process Organizer Personal Data under our instructions. Sub-Processors do not include: (i) third parties that provide us services without Processing Organizer Personal Data (such as accounting, legal, or general business services); or (ii) third-party integrations or products that you choose to use independently of the Services.


"UK GDPR" means the EU GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of Section 3 of the European Union (Withdrawal) Act 2018, as amended by the Data Protection Act 2018 and subsequent legislation.

Scope

This DPA governs our Processing of Organizer Personal Data, including the collection, storage, transmission, use, disclosure, and deletion of such data, and applies to all Organizer Personal Data processed by us in any location worldwide on your behalf. This DPA applies to all Processing of Organizer Personal Data by us on your behalf in connection with your use of the Services. The purpose of this DPA is to ensure that such Processing is conducted in compliance with all Data Protection Laws and the terms of the Agreement. Under this DPA, you act as the Controller (or, where applicable, the Processor on behalf of your own Controller), and we act as the Processor (or, where applicable, Sub-Processor) of Organizer Personal Data. If and to the extent that the Processing of Organizer Personal Data is subject to the EU GDPR, the UK GDPR, or other comparable Data Protection Laws, this DPA constitutes the written data processing agreement required by such laws.

Data Hosting and Location of Processing

The Services are hosted on infrastructure provided by our third-party hosting provider located in the European Union, and Organizer Personal Data is stored at rest within the European Union. Because Gaytherings is a company organized in the United States, our personnel and certain Sub-Processors may access Organizer Personal Data from the United States or other jurisdictions as necessary to provide, operate, maintain, support, and secure the Services. Any such access or transfer that constitutes a Restricted Transfer is carried out in accordance with the transfer mechanisms described in this DPA.

Term

This DPA remains in effect for as long as we Process Organizer Personal Data on your behalf under the Agreement. If you stop using the Services, the Agreement terminates, or we otherwise stop Processing Organizer Personal Data on your behalf, we may continue to Process Organizer Personal Data only as necessary to comply with applicable law, regulatory requirements, payment processing obligations, dispute resolution obligations, security obligations, contractual obligations, or other legitimate business or legal purposes permitted under the Agreement and applicable Data Protection Laws. Subject to the foregoing, we will stop Processing Organizer Personal Data and will delete or return Organizer Personal Data according to this DPA and applicable Data Protection Laws. Any provisions of this DPA that are intended to survive termination or the end of Processing, including obligations relating to confidentiality, security, liability, and deletion or retention of Organizer Personal Data, will remain in effect for as long as we retain Organizer Personal Data.

Processing

We will Process Organizer Personal Data solely as necessary to provide, operate, maintain, support, secure, and improve the Services; to perform our obligations under the Agreement; to comply with applicable law and Data Protection Laws; and according to your documented instructions as reflected in the Agreement and this DPA. Such Processing may include collecting, receiving, organizing, structuring, storing, adapting, retrieving, using, transmitting, disclosing, and deleting Organizer Personal Data as necessary to fulfill those purposes. We will not sell Organizer Personal Data or Process Organizer Personal Data for our own independent purposes except as permitted under the Agreement, this DPA, or applicable law. If we are required by applicable law to Process Organizer Personal Data other than according to your documented instructions, we will notify you before such Processing unless applicable law prohibits such notice.

Categories of Organizer Personal Data

The Organizer Personal Data processed in connection with the Services may include, as applicable, the following categories of data. Such data may relate to end users who are Gaytherings users or non-users and may be accessed by us as a result of access granted by an Organizer to the Services or to Organizer Personal Data made available through the Services.


Contact Information. Names, usernames, display names, email addresses, phone numbers, mailing addresses, billing addresses, profile images, social media handles, and other contact or profile information relating to Organizers, Attendees, applicants, invitees, members, or other users of the Services.


Account and Access Data. Account credentials, account identifiers, authentication data, invitation codes, membership status, account preferences, access permissions, and other information associated with creating, maintaining, or accessing accounts or Events through the Services.


Event and Membership Information. Information relating to Events or Membership Events, including ticket purchases, registrations, invitations, attendance information, membership applications, organizer approvals or denials, waitlists, guest lists, event participation records, and Organizer-Specific Terms or Event Waivers accepted through the Services.


Payment and Transaction Information. Transaction-related information relating to ticket purchases, refunds, promotional purchases, or payment activity processed through the Services, including limited payment-related information made available by our Payment Processor. We do not store full payment card information.


Communications and Submissions. Communications, support requests, messages, form submissions, applications, comments, feedback, uploaded files, images, videos, waiver acknowledgements, and other content submitted through or in connection with the Services.


Usage and Device Information. Information generated through use of the Services, including activity logs, timestamps, ticket scans, navigation activity, interaction history, IP addresses, browser types, operating systems, device identifiers, cookies, and similar technical or usage information.


Sensitive or Community-Related Information. Information that may reveal or relate to a user's interests, affiliations, community participation, lifestyle preferences, or attendance at LGBTQ+ Events or Membership Events, to the extent voluntarily submitted through the Services by or on behalf of you or your users.


Other Organizer-Provided Information. Any other Organizer Personal Data or information submitted, uploaded, transmitted, or otherwise made available by or on behalf of you in connection with the Services.

Categories of Data Subjects

The Organizer Personal Data Processed in connection with the Services may relate to the following categories of data subjects, to the extent applicable:


Organizers and Organizer Personnel. Organizers and their employees, contractors, agents, representatives, event staff, moderators, administrators, or other authorized users who access or use the Services on the Organizer's behalf.


Attendees and Participants. Individuals who browse, register for, purchase tickets to, are invited to, attend, participate in, or otherwise interact with Events or Membership Events through the Services.


Applicants, Invitees, and Members. Individuals who apply for, request access to, are invited to, approved for, denied access to, or participate in Membership Events, invite-only Events, communities, or other restricted-access features available through the Services.


Customers and End Users. Individuals whose Personal Data is submitted, uploaded, transmitted, or otherwise made available by or on behalf of the Organizer in connection with the Services, including guests, companions, contacts, or other end users associated with an Event or Membership Event.


Support and Communication Contacts. Individuals who communicate with the Organizer or Gaytherings in connection with the Services, including through customer support requests, inquiries, applications, feedback, communications, or dispute resolution processes.


Other Individuals. Any other individuals whose Personal Data is submitted, uploaded, transmitted, or otherwise made available through the Services by or on behalf of the Organizer.

Processing of Special Category or Sensitive Data

Because of the nature of the Services, Organizer Personal Data Processed through the Services may include information or data that may be considered Sensitive Data or Special Category Data, including information that may reveal a person's interests, affiliations, community participation, sexual orientation, gender identity, lifestyle preferences, health-related accommodations, or participation in LGBTQ+ Events or Membership Events. You acknowledge and agree that you are solely responsible for determining whether your use of the Services involves the Processing of Sensitive Data or Special Category Data and for ensuring that you have all necessary rights, consents, notices, permissions, and legal bases required under applicable Data Protection Laws to provide such data to us for Processing. We do not intentionally collect or require Sensitive Data or Special Category Data unless such Processing is initiated, submitted, or enabled by or on behalf of you in connection with your use of the Services. To the extent we Process Sensitive Data or Special Category Data on your behalf, such Processing will occur solely according to the Agreement, this DPA, your documented instructions, and applicable Data Protection Laws. You agree not to provide Sensitive Data or Special Category Data that is not reasonably necessary for your use of the Services or otherwise prohibited under the Agreement or applicable law.

Compliance

We will comply with applicable Data Protection Laws in our Processing of Organizer Personal Data and will Process Organizer Personal Data according to the Agreement, this DPA, and your documented instructions, unless otherwise required by applicable law. If we determine that we can no longer comply with applicable Data Protection Laws, this DPA, or your documented instructions relating to the Processing of Organizer Personal Data, we will notify you without undue delay. If we reasonably believe that any Processing of Organizer Personal Data or use of the Services would violate applicable law or Data Protection Laws, we may suspend or limit the affected Processing activities or access to the applicable Services until the issue is resolved or lawful instructions are provided. We are not liable for any inability to provide the affected Services or Processing activities resulting from actions taken under this section. Your sole remedy under such circumstances is to stop using the affected Services or terminate the applicable use of the Services involving such Processing.

Organizer Obligations

You are responsible for complying with your obligations under applicable Data Protection Laws in connection with your use of the Services and the Processing of Organizer Personal Data. You represent and warrant that you have provided all required notices, obtained all necessary rights, consents, and permissions, and established all lawful bases required under applicable Data Protection Laws for our Processing of Organizer Personal Data under the Agreement and this DPA. Specifically, you will:


Lawful Basis and Instructions. Ensure that all Processing of Organizer Personal Data by us is lawful and supported by an appropriate legal basis under applicable Data Protection Laws. You are responsible for providing us with lawful documented instructions regarding such Processing according to this DPA and the Agreement.


Accuracy and Data Minimization. Take reasonable steps to ensure that Organizer Personal Data made available to us is accurate, relevant, and limited to what is necessary for the intended Processing.


Notifications and Changes. Notify us without undue delay if: (a) any Data Subject withdraws consent or otherwise objects to or restricts the Processing of Organizer Personal Data; or (b) you determine that any Processing of Organizer Personal Data under the Agreement or this DPA no longer complies with applicable Data Protection Laws.


Instructions to Us. Provide any instructions regarding the Processing of Organizer Personal Data in writing or through other agreed means. You acknowledge that we are not responsible for independently determining whether your instructions comply with applicable law.


Assessment of Security Measures. Before providing Organizer Personal Data to us, you are responsible for reviewing the technical and organizational measures described in this DPA and determining whether they are appropriate for your intended use of the Services and the nature of the Organizer Personal Data Processed.


Data Subject Requests and Regulatory Inquiries. Notify us without undue delay of any inquiry, complaint, request, or notice received from a Data Subject or regulatory authority that specifically relates to our Processing of Organizer Personal Data. Unless otherwise required by applicable law, you are responsible for responding to Data Subject requests that you receive directly.


Use of the Services. Ensure that your use of the Services and your disclosure of Organizer Personal Data to us comply with applicable Data Protection Laws and do not cause us to violate applicable law or this DPA.


You acknowledge that we do not provide legal advice or compliance determinations, and you are solely responsible for determining whether the Services and your use of the Services satisfy your obligations under applicable Data Protection Laws.

Security Measures

We will implement and maintain appropriate technical and organizational measures to protect Organizer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are designed to protect Organizer Personal Data and to ensure a level of security appropriate to the risk associated with the Processing. We review and update these measures on a periodic basis (at least annually) to address evolving security risks, technology developments, and applicable legal requirements. We may update or modify these measures from time to time provided that such modifications do not materially reduce the overall security of the Services. Any material changes that could significantly reduce the level of protection afforded to Organizer Personal Data will be communicated to you in advance where required by law or this DPA. These measures include:


Information Security Program. We maintain a written information security program that includes administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, availability, and resilience of systems and Processing operations involving Organizer Personal Data. This program is reviewed at least annually and updated as reasonably necessary to address evolving security risks or regulatory requirements.


Access Controls. We restrict access to systems and environments containing Organizer Personal Data to authorized personnel based on the principles of least privilege and need-to-know. Access rights are reviewed periodically and revoked promptly upon termination or role change. Multi-factor authentication is required for all administrative access to Organizer Personal Data.


Encryption and Transmission Security. Organizer Personal Data is encrypted in transit using industry-standard encryption protocols and, where appropriate, encrypted at rest using commercially reasonable encryption technologies.


Physical and Environmental Security. We rely exclusively on reputable third-party hosting and cloud service providers that maintain robust physical and environmental safeguards, including access control, monitoring, redundancy, and disaster recovery facilities. We do not operate our own data centers. Our primary hosting infrastructure is located in the European Union.


Vulnerability and Incident Management. We maintain processes to identify, assess, and remediate vulnerabilities and to detect and respond to potential security incidents. Security updates and patches are applied promptly based on severity. We will notify you of Personal Data Breaches as described in the Security Incident Notification section of this DPA.


Business Continuity and Disaster Recovery. We maintain and periodically test disaster recovery and business continuity plans to ensure the timely restoration of access to Organizer Personal Data in the event of a physical or technical incident. Testing occurs at least once annually.


Personnel Security and Training. Personnel with access to Organizer Personal Data are subject to written confidentiality and non-disclosure obligations, complete data protection and security training at least once per year, and are required to comply with our internal security policies.


Vendor and Sub-Processor Oversight. We conduct due diligence on our Sub-Processors to verify they maintain commercially reasonable security measures appropriate to the nature of the services provided. We monitor Sub-Processor compliance through periodic reviews and contractual assurances.


Restricted Transfers. To the extent that we engage in a Restricted Transfer of Organizer Personal Data, Exhibit B is intended to satisfy the requirements of Annex II (Technical and Organizational Measures) of the EU SCCs and equivalent requirements under other Data Protection Laws governing such transfers.

Confidentiality

We will ensure that any person acting under our authority who has access to Organizer Personal Data is subject to an appropriate written obligation of confidentiality and will Process such data only as necessary to provide the Services or to comply with Data Protection Laws. We will not disclose Organizer Personal Data to any third party except: (i) as expressly permitted by this DPA or the Agreement; (ii) as instructed by you; or (iii) where disclosure is required by law, in which case we will promptly, but in any event within 72 hours, notify you (unless prohibited by law) before making such disclosure.

Specific Exclusions

Except as otherwise expressly stated in this DPA or required by applicable Data Protection Laws, we are not responsible for any Processing of Organizer Personal Data arising from or relating to: (i) your instructions, configurations, settings, permissions, workflows, integrations, Organizer-Specific Terms, or use of the Services; (ii) your failure to comply with applicable Data Protection Laws, including failing to provide required notices, obtain required consents or permissions, establish lawful bases for Processing, or respond to Data Subject requests; (iii) the acts or omissions of you, your personnel, your authorized users, Organizers, Attendees, Members, applicants, invitees, or other users acting on your behalf, including unauthorized access, disclosures, transfers, or misuse of Organizer Personal Data; (iv) third-party services, systems, applications, integrations, payment processors, networks, or platforms selected, enabled, controlled, or managed by you or your users; or (v) the accuracy, completeness, legality, or appropriateness of Organizer Personal Data or other information provided to us for Processing.

Organizer Instructions

We will Process Organizer Personal Data only according to your documented instructions, including with respect to transfers of Organizer Personal Data, unless otherwise required by applicable law. If applicable law requires us to Process Organizer Personal Data other than according to your instructions, we will notify you as soon as reasonably practicable and, unless legally prohibited, no later than 72 hours before carrying out such Processing. Your documented instructions are initially set forth in the Agreement and this DPA and may be supplemented, amended, or replaced by additional written instructions as reasonably necessary for us to provide the Services and comply with applicable Data Protection Laws. If we reasonably believe that an instruction violates applicable law or Data Protection Laws, we may notify you and suspend the affected Processing activities until the issue is resolved in good faith between the parties. If complying with an instruction would require material additional costs, technical changes, security risks, or operational burdens beyond the scope of the Services or this DPA, the parties will work together in good faith to identify a commercially reasonable solution.

Data Subject Requests

To the extent that we receive a request directly from a Data Subject relating to the exercise of their rights under applicable Data Protection Laws with respect to Organizer Personal Data, we will notify you of the request as soon as reasonably practicable and, unless legally prohibited, no later than 5 business days after receipt of the request. We will not independently respond to such request except: (i) on your documented instructions; (ii) as necessary to comply with applicable law; or (iii) where the request relates solely to our own Processing activities as an independent controller. You are solely responsible for responding to and fulfilling Data Subject requests relating to Organizer Personal Data in accordance with applicable Data Protection Laws. You agree to respond to Data Subject requests in a timely manner and to provide any information, instructions, or cooperation reasonably requested by us in connection with such requests. Taking into account the nature of the Processing, we will provide commercially reasonable assistance, at your cost, through appropriate technical and organizational measures, insofar as reasonably possible, to assist you in fulfilling your obligations relating to Data Subject requests under applicable Data Protection Laws. Where permitted by applicable law, we may charge a reasonable fee for assistance relating to Data Subject requests that are excessive, repetitive, technically burdensome, or manifestly unfounded.

Data Protection Impact Assessments and Cooperation

Upon your written request, we will provide reasonable assistance, at your cost, to enable you to comply with your obligations under Data Protection Laws relating to Data Protection Impact Assessments or prior consultations with supervisory authorities, to the extent that such assistance relates to the Processing of Organizer Personal Data and the information is reasonably available to us. Such assistance may include providing information about our technical and organizational measures, data protection practices, and Sub-Processor arrangements relevant to the Processing of Organizer Personal Data. If we receive any official written inquiry, notice, or request from a supervisory authority concerning the Processing of Organizer Personal Data, we will promptly, but in any event within 5 business days, notify you (unless legally prohibited) and cooperate reasonably with you in responding to such inquiry.

Sub-Processors

You authorize us to engage Sub-Processors to Process Organizer Personal Data in connection with the Services, as listed on our website at https://www.gaytherings.com/legal/subprocessors. We must: (i) enter into a written agreement with each Sub-Processor imposing commercially reasonable obligations substantially similar to those set out in this DPA; (ii) remain responsible for the Sub-Processor's compliance with such obligations; and (iii) provide you with advance notice of any intended addition or replacement of Sub-Processors by updating the Sub-Processor list made available to you. You may object in writing to the appointment of a new Sub-Processor, provided that such objection is reasonable and based on documented data protection concerns, within 30 days of notice, in which case the parties will work together in good faith to resolve the objection. If the parties cannot reach resolution, you may terminate the affected portion of the Services upon written notice, without penalty. We will ensure that Sub-Processors located outside the jurisdiction where Organizer Personal Data originates provide a level of protection for such data consistent with the requirements of Data Protection Laws and the transfer mechanisms described in this DPA, including, where applicable, the SCCs. The parties agree that by complying with this section, we fulfill our obligations under Clause 9 of the SCCs, if applicable. For the purposes of Clause 9(c) of the SCCs, you acknowledge that we may be restricted from disclosing Sub-Processor agreements, but we will use reasonable efforts to require any Sub-Processor we appoint to permit us to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can.

Security Incident Notification

If we become aware of a Personal Data Breach involving Organizer Personal Data, we will notify you without undue delay and, in any event, within 72 hours after becoming aware of the Personal Data Breach. Our notification will include information reasonably available at the time to describe: (i) the nature of the incident; (ii) the categories and approximate number of affected Data Subjects; (iii) the types of Organizer Personal Data involved; and (iv) the measures taken or proposed to address the breach. Where it is not possible to provide all of this information at the same time, we may provide it in phases as it becomes available, without undue further delay. We will take all reasonable steps to mitigate the effects of the breach and prevent its recurrence, and will cooperate with you as reasonably necessary to meet your obligations under Data Protection Laws, including any legal requirements to notify Data Subjects or supervisory authorities. Our obligation to report or respond to a Personal Data Breach under this DPA is not an acknowledgment by us of fault or liability with respect to the incident.

International Processing

Our primary hosting infrastructure is located in the European Union, and Organizer Personal Data is stored at rest within the European Union. We and our Sub-Processors may nonetheless access and Process Organizer Personal Data from the United States and other jurisdictions where we or our Sub-Processors operate, as necessary to provide, maintain, support, secure, and improve the Services. You authorize us to transfer and Process Organizer Personal Data across jurisdictions according to the Agreement, this DPA, and applicable Data Protection Laws. To the extent that Organizer Personal Data is transferred outside the jurisdiction in which it was originally collected, or is accessed from outside that jurisdiction, and such transfer or access is subject to Restricted Transfer requirements under applicable Data Protection Laws, the parties agree that an appropriate lawful transfer mechanism will apply as described below.

Transfer Mechanisms

To the extent applicable to a Restricted Transfer of Organizer Personal Data, the following transfer mechanisms will apply.


We will not transfer or permit the transfer of Organizer Personal Data to a country or territory outside the jurisdiction where it was originally collected unless such transfer complies with Data Protection Laws governing international transfers. For purposes of the SCCs, the parties agree that Exhibit A (List of Parties, Description of Processing and Transfer of Personal Data) and Exhibit B (Technical and Organizational Security Measures) to this DPA collectively satisfy the requirements of Annexes I and II to the SCCs. Where applicable, our Sub-Processor list will satisfy the requirements of Annex III to the SCCs. Where such transfer constitutes a Restricted Transfer, the parties agree that one or more of the following lawful mechanisms will apply, as appropriate:


EU Standard Contractual Clauses. The SCCs issued by the European Commission under Implementing Decision (EU) 2021/914 are incorporated into this DPA by reference and will apply to any Restricted Transfer of Organizer Personal Data from the EEA to Gaytherings. The SCCs will be completed as follows:


  • Module Two (Controller to Processor) applies where you act as a Controller.

  • Module Three (Processor to Processor) applies where you act as a Processor.

  • Clause 7 (Docking Clause) applies.

  • Clause 9: Option 2 (General Authorization) applies, with the notice period for Sub-Processor changes specified in this DPA.

  • Clause 11: the optional language is deleted.

  • Clause 17: the SCCs are governed by Irish law.

  • Clause 18(b): disputes will be resolved in the courts of Ireland.

  • Annexes I and II are satisfied by Exhibits A and B of this DPA, respectively.


UK Transfers. For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference and supplements the SCCs. Tables 1 through 3 of the UK Addendum are deemed completed with the information contained in Exhibits A and B of this DPA, and Table 4 is deemed completed by selecting "neither party."


Swiss Transfers. For transfers subject to the Swiss Federal Act on Data Protection (FADP), the SCCs apply with the following modifications: references to "EU Member State" and "EU GDPR" include Switzerland and the FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC); and the term "Member State" shall not be interpreted to exclude Swiss Data Subjects from bringing claims in Switzerland.


Other Transfer Mechanisms. If we adopt an alternative lawful transfer mechanism (such as Binding Corporate Rules, approved codes of conduct, or a new or successor data privacy framework), such mechanism will automatically govern Restricted Transfers, provided it ensures an adequate level of protection under Data Protection Laws.

Non-Compliance with Transfer Mechanisms

If we determine that we cannot comply with our obligations under an applicable transfer mechanism (including the SCCs and UK Addendum), we will promptly notify you. You may suspend the relevant transfer until compliance is restored or terminate the affected portion of the Services if such compliance cannot be achieved. Before suspension or termination, the parties will cooperate in good faith to implement additional safeguards to remedy the issue. If any transfer mechanism used by the parties is invalidated or otherwise becomes unavailable under Data Protection Laws, the parties will promptly cooperate to implement an alternative lawful mechanism to ensure the continued Processing and transfer of Organizer Personal Data in compliance with applicable law. We will notify you without undue delay if any data privacy framework certification we rely on, if applicable, is withdrawn, expires, or otherwise ceases to be valid.

Return or Deletion of Information

Upon termination of the Agreement, cessation of the applicable Processing activities, or your written request, we will delete or return Organizer Personal Data Processed on your behalf, unless retention of such Organizer Personal Data is required or permitted under applicable law, regulation, legal process, payment processing requirements, dispute resolution obligations, security requirements, fraud prevention purposes, backup procedures, contractual obligations, or other legitimate business purposes consistent with applicable Data Protection Laws. We will complete such deletion or return within a commercially reasonable period and, unless otherwise required by applicable law or operational limitations, generally within 60 days following the applicable request or termination event. You acknowledge that deletion of Organizer Personal Data from backup systems, archives, logs, disaster recovery systems, or other retained copies may not occur immediately and may continue according to our standard retention, archival, and backup practices, provided that any retained Organizer Personal Data will remain subject to the confidentiality, security, and other applicable protections described in this DPA. Where we retain Organizer Personal Data as permitted under this DPA or applicable law, we will limit further Processing of such Organizer Personal Data except to the extent required or permitted under applicable law. Upon your written request, we will provide reasonable confirmation that deletion or return has been completed in accordance with this section.

Audits and Certifications

Upon your written request, we will make available information reasonably necessary to demonstrate our compliance with this DPA and Data Protection Laws, including summaries of relevant third-party audits or certifications (such as ISO 27001, SOC 2, or equivalent). We will, at your cost, permit and reasonably cooperate with an audit by you or an independent auditor mandated by you, provided that: (i) such audit occurs no more than once in any 12-month period, unless required by law or following a confirmed Personal Data Breach; (ii) you provide at least 30 days' prior written notice; and (iii) the audit is conducted in a manner that minimizes disruption and protects the confidentiality and security of our systems and other customers' data. The audit may be conducted by your data protection officer or a mutually accepted authorized representative or third-party auditor, and any such officer, representative, or auditor must sign a confidentiality agreement acceptable to us or otherwise be bound by a statutory or legal confidentiality obligation. Such third-party auditor may not disclose to you anything other than the results of our compliance or non-compliance with this DPA, and an audit does not entitle you to view or access records or processes: (a) not directly related to Organizer Personal Data Processed by us; (b) not directly related to the Services provided to you under the Agreement; (c) in violation of applicable laws; or (d) in violation of our confidentiality obligations owed to a third party. Before any audit, we must agree in writing on the scope, which must describe the proposed duration and start date. You agree to provide us with the audit results, including any documented reports, which shall be subject to the confidentiality terms of the Agreement. We may satisfy audit requests by providing copies of independent audit reports or certifications demonstrating compliance with comparable data protection standards. Upon written request, we will make available to you summary information or certification reports demonstrating our Sub-Processors' compliance with standards substantially equivalent to those described in this DPA.

Compliance with Law and Legal Requests

If we receive a legally binding request from a governmental authority, court, or law enforcement agency to disclose Organizer Personal Data, we will, unless prohibited by law, promptly, but in any event within 72 hours, notify you of the request and provide reasonable information about its nature and scope. We will disclose only the minimum amount of Organizer Personal Data necessary to comply with the request and will take all reasonable steps to challenge or limit the scope of any disclosure that we believe to be unlawful or disproportionate. Where disclosure is legally prohibited (for example, under criminal investigation secrecy laws), we will use reasonable efforts to notify you once the prohibition is lifted. We will document any disclosures made and, upon written request, provide you with a summary of the relevant legal process, to the extent permitted by law.

California-Specific Provision

To the extent that the Processing of Organizer Personal Data is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), the parties acknowledge that you are a "business" and we are a "service provider" (or, where applicable, "contractor") under the CCPA. We will Process Organizer Personal Data solely for the purpose of providing the Services and will not sell or share such data, retain, use, or disclose it for any purpose other than as necessary to provide the Services or as otherwise permitted by the CCPA, nor combine such data with Personal Data received from other sources except as allowed under the CCPA (for example, to detect or prevent security incidents or fraudulent activity). We will comply with these restrictions and will ensure that any Sub-Processors engaged as "service providers" or "contractors" under the CCPA are bound by written obligations that provide substantially the same level of protection.

Limitation of Liability

The parties' liability arising out of or relating to this DPA is subject to the limitations, exclusions, disclaimers, and allocation of risk provisions set forth in the Agreement, which are incorporated into this DPA by reference. Nothing in this DPA limits either party's liability to the extent such limitation is prohibited under applicable Data Protection Laws, including liability arising from: (a) breach of confidentiality obligations; (b) fraud or willful misconduct; or (c) death or personal injury caused by negligence. This DPA does not create or expand any additional liabilities, remedies, or obligations beyond those expressly set forth in the Agreement, and nothing in this DPA will increase either party's total aggregate liability beyond the liability limits established in the Agreement. To the extent the Agreement does not contain an enforceable limitation of liability applicable to claims arising under this DPA, each party's aggregate liability arising out of or relating to this DPA will not exceed the greater of: (i) $1,000,000; or (ii) the total fees paid or payable by you to us under the Agreement during the 12 months preceding the event giving rise to the claim.

Governing Law

This DPA will be governed by and construed in accordance with the same governing law and jurisdiction specified in the Agreement, except to the extent otherwise required by Data Protection Laws. If there is any inconsistency between this DPA and Data Protection Laws, the Data Protection Laws shall prevail to the extent necessary to ensure compliance.

Regional Supplements

Where required by Data Protection Laws, this DPA shall be supplemented by jurisdiction-specific terms that apply to the Processing of Organizer Personal Data from such jurisdiction. In the event of any conflict between the terms of this DPA and any regional supplement, the supplement will prevail to the extent necessary to comply with Data Protection Laws.

Indemnification

In addition to any indemnification provisions provided in the Agreement, the parties further agree that: (i) if one party is held liable for a violation of Data Protection Laws committed by the other party, the latter will, to the extent to which it is liable, indemnify the first party for any cost, charge, damages, expenses, or loss it has incurred as a result; and (ii) the limitations of liability provided in the Agreement, including the aggregate liability cap, apply to this section to the maximum extent permitted by applicable law.

Amendments

We may update this DPA as reasonably necessary to comply with changes in Data Protection Laws or to implement new SCCs or other lawful transfer mechanisms. We will notify you at least 30 days before any material change becomes effective, unless a shorter period is required by law or regulatory guidance.

Severability

If any provision of this DPA is found invalid or unenforceable, the remainder of this DPA will remain in full force and effect. Any invalid provision will be replaced by a valid provision that most closely reflects the parties' intent.

Integration

This DPA forms part of, and is subject to, the terms of the Agreement. In the event of any conflict between this DPA and the Agreement, this DPA governs solely with respect to Processing of Organizer Personal Data.

Global Interpretation

References in this DPA to "Controller," "Processor," "Personal Data," and similar terms shall be interpreted in a manner consistent with their meanings under applicable Data Protection Laws, including their equivalents such as "business," "service provider," or "operator," as relevant to the jurisdiction.

Entire Agreement

This DPA, together with the Agreement and its exhibits (including the SCCs, where applicable), constitutes the entire agreement between the parties concerning the Processing of Organizer Personal Data and supersedes all prior understandings relating to that subject matter.


Exhibit A

List of Parties, Description of Processing and Transfer of Personal Data, Competent Supervisory Authority

List of Parties

The Exporter


  • Party: Organizer

  • Address: As provided by the Organizer in its Organizer Profile

  • Contact: As provided by the Organizer in its Organizer Profile and used for notification and invoicing purposes

  • Activities: Use of the Services

  • Signature: By entering into the Agreement, the Exporter is deemed to have signed the SCCs incorporated into this DPA, including their Annexes, as of the Organizer's first use of the Services

  • Role: Controller (or, where Module Three of the SCCs applies, Processor)

  • Name of Representative: Any UK or EU representative named in the Exporter's privacy policy


The Importer


  • Party: Gatherings LLC dba Gaytherings

  • Address: As set out in the Gaytherings Terms of Service

  • Contact: Privacy Officer, support@gaytherings.com

  • Activities: The provision of the Services to the Exporter, under which the Importer Processes Personal Data upon the instructions of the Exporter according to the terms of the Agreement

  • Signature: By entering into the Agreement, the Importer is deemed to have signed the SCCs incorporated into this DPA, including their Annexes, as of the Organizer's first use of the Services

  • Role: Processor (or, where Module Three of the SCCs applies, Sub-Processor)

  • Name of Representative: Not applicable

Description of Processing and Transfers

Categories of Data Subjects. The Organizer Personal Data transferred concerns the following categories of Data Subjects, as applicable:


  • Organizers and Organizer Personnel. Organizers and their employees, contractors, agents, moderators, event staff, administrators, representatives, or other authorized users who access or use the Services on the Organizer's behalf.

  • Attendees and Participants. Individuals who browse, register for, purchase tickets to, are invited to, attend, participate in, or otherwise interact with Events or Membership Events through the Services.

  • Applicants, Invitees, and Members. Individuals who apply for, request access to, are invited to, approved for, denied access to, or participate in Membership Events, invite-only Events, communities, or other restricted-access features available through the Services.

  • Guests and End Users. Individuals whose Personal Data is submitted, uploaded, transmitted, or otherwise made available by or on behalf of the Organizer in connection with the Services, including guests, companions, emergency contacts, or other end users associated with an Event or Membership Event.

  • Support and Communication Contacts. Individuals who communicate with the Organizer or Gaytherings in connection with the Services, including through support requests, applications, inquiries, waiver submissions, disputes, feedback, or Event-related communications.

  • Users of Integrated or Linked Services. Individuals whose Personal Data is processed through integrations, connected systems, Payment Processors, authentication providers, or third-party tools used in connection with the Services.


Categories of Personal Data. The Organizer Personal Data transferred may include, as applicable:


  • Identification Data. Names, usernames, display names, profile images, titles, organization names, account identifiers, invitation codes, membership identifiers, or other identifiers associated with use of the Services.

  • Contact Data. Email addresses, phone numbers, mailing addresses, billing addresses, social media handles, or other contact information relating to Organizers, Attendees, applicants, invitees, Members, or other users of the Services.

  • Account and Access Data. Usernames, authentication credentials, user IDs, account preferences, permissions, membership status, access logs, device identifiers, IP addresses, and other information relating to account creation, authentication, or access to the Services.

  • Event and Membership Data. Information relating to Events or Membership Events, including ticket purchases, registrations, invitations, attendance information, guest lists, waitlists, membership applications, organizer approvals or denials, waiver acknowledgements, and participation history.

  • Transaction and Payment Data. Transaction-related information relating to ticket purchases, donations, refunds, payouts, or promotional purchases, including transaction identifiers, payment status, and limited payment-related information made available through Payment Processors. Full payment card information is not stored by Gaytherings.

  • Communications and Support Data. Messages, support requests, feedback, communications, applications, uploaded files, comments, images, videos, waiver submissions, and other content submitted through or in connection with the Services.

  • Usage and Interaction Data. Activity logs, timestamps, navigation history, interaction records, ticket scans, device information, browser types, operating systems, cookies, analytics data, and other technical or usage-related information generated through use of the Services.

  • Marketing and Preference Data. Communication preferences, subscription preferences, opt-in or opt-out records, blocked users, visibility preferences, and responses to promotions, campaigns, invitations, or Event-related communications.

  • Sensitive or Community-Related Data. Information that may reveal or relate to a person's interests, affiliations, community participation, sexual orientation, gender identity, lifestyle preferences, health-related accommodations, or participation in LGBTQ+ Events or Membership Events, to the extent voluntarily submitted through the Services.

  • Other Organizer-Provided Data. Any other categories of Personal Data that the Organizer instructs Gaytherings to Process according to the Agreement, this DPA, and applicable Data Protection Laws.


Special Category Data. Because of the nature of the Services, Organizer Personal Data transferred or Processed through the Services may include Sensitive Data or Special Category Data (as defined under applicable Data Protection Laws, including Article 9 of the EU GDPR), to the extent voluntarily submitted, uploaded, collected, or otherwise made available by or on behalf of the Organizer in connection with the Services. Such data may include information relating to:


  • sexual orientation or participation in LGBTQ+ Events or Membership Events;

  • gender identity or pronoun preferences;

  • health-related accommodations or accessibility requests;

  • biometric or identity verification information where required for Event access or security purposes;

  • information concerning a person's sex life or community participation; and

  • other categories of Sensitive Data or Special Category Data submitted through the Services by or on behalf of the Organizer.


The Organizer is solely responsible for determining whether its use of the Services involves the Processing of Sensitive Data or Special Category Data and for ensuring that all necessary notices, consents, permissions, lawful bases, and additional safeguards required under applicable Data Protection Laws have been obtained or implemented. To the extent we Process Sensitive Data or Special Category Data on the Organizer's behalf, such Processing will occur solely according to the Agreement, this DPA, the Organizer's documented instructions, and applicable Data Protection Laws.


Frequency of Processing. Processing occurs on a continuous and as-needed basis during the term of the Agreement and for any period during which Organizer Personal Data is retained according to the Agreement, this DPA, or applicable law.


Nature of Processing. Processing operations may include, without limitation, the collection, receipt, recording, organization, structuring, storage, hosting, access, retrieval, consultation, use, transmission, disclosure, synchronization, analysis, moderation, restriction, deletion, destruction, or other Processing of Organizer Personal Data as necessary to provide, operate, maintain, secure, support, and improve the Services. Such Processing may occur in connection with:


  • account creation and administration;

  • Event and Membership Event management;

  • ticket sales, registrations, invitations, waitlists, and attendee management;

  • membership applications, approvals, denials, and restricted-access features;

  • communications, notifications, support requests, and dispute resolution;

  • ticket scanning, Event access verification, moderation, fraud prevention, and platform security;

  • payment processing coordination with Payment Processors;

  • analytics, troubleshooting, infrastructure management, and service optimization; and

  • compliance with applicable law, the Agreement, this DPA, and the Organizer's documented instructions.


Purpose of Data Transfer. Organizer Personal Data may be transferred to Sub-Processors, service providers, infrastructure providers, Payment Processors, hosting providers, communication providers, analytics providers, customer support providers, and other third parties engaged by Gaytherings as necessary to provide, operate, maintain, support, secure, improve, and facilitate the Services according to the Agreement, this DPA, and the Organizer's documented instructions. Such transfers may occur for purposes including:


  • account creation and authentication;

  • Event and Membership Event management;

  • ticket sales, registrations, invitations, waitlists, and attendee management;

  • membership applications and restricted-access features;

  • payment processing and payout coordination;

  • communications, notifications, and customer support;

  • ticket scanning, Event access verification, moderation, fraud prevention, and platform security;

  • hosting, cloud infrastructure, storage, backup, and disaster recovery;

  • analytics, troubleshooting, and service optimization; and

  • compliance with applicable law and Data Protection Laws.


Retention Period. Organizer Personal Data will be retained for the duration of the Agreement and for any additional period necessary to comply with the Agreement, this DPA, applicable law, payment processing obligations, dispute resolution obligations, fraud prevention purposes, security requirements, backup procedures, or other legitimate business purposes permitted under applicable Data Protection Laws, subject to the Return or Deletion of Information section of this DPA.


Sub-Processors. The Sub-Processor list on the Gaytherings website at https://www.gaytherings.com/legal/subprocessors sets out the Personal Data processed by each Sub-Processor and the services provided by each Sub-Processor.

Competent Supervisory Authority

  • Where the EU GDPR applies: the Irish Data Protection Commission (DPC).

  • Where the UK GDPR applies: the UK Information Commissioner's Office (ICO).

  • Where the FADP applies: the Swiss Federal Data Protection and Information Commissioner (FDPIC).


Exhibit B

Technical and Organizational Security Measures

Below is a description of the technical and organizational measures implemented by the Processor (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing, and the risks for the rights and freedoms of natural persons. Where applicable, this Exhibit B will serve as Annex II to the SCCs.


Pseudonymization and Encryption. We implement commercially reasonable technical and organizational measures designed to protect Organizer Personal Data against unauthorized access, disclosure, alteration, or destruction, including encryption, access controls, authentication measures, and secure transmission protocols. Personal Data transmitted through the Services is encrypted in transit using industry-standard encryption protocols (including TLS 1.2 or higher where supported). Organizer Personal Data stored by us or our Sub-Processors is encrypted at rest where appropriate using commercially reasonable encryption technologies supported by the applicable infrastructure or service provider. Where appropriate and reasonably feasible, we may use pseudonymization, data minimization, access segmentation, tokenization, or similar measures designed to reduce unnecessary exposure of Personal Data.


Confidentiality, Integrity, Availability, and Resilience. We implement and maintain commercially reasonable technical and organizational measures designed to ensure the confidentiality, integrity, availability, and resilience of systems and services used to Process Organizer Personal Data. Access to Organizer Personal Data is restricted to authorized personnel, contractors, and Sub-Processors according to least-privilege and need-to-know principles. Personnel authorized to access Organizer Personal Data are subject to written confidentiality and non-disclosure obligations that remain in effect during and after their employment or engagement. We use encryption, authentication, access controls, monitoring, and other security safeguards designed to protect Organizer Personal Data against unauthorized access, disclosure, alteration, destruction, or loss. We also maintain business continuity, backup, redundancy, and recovery measures designed to support the continued availability and restoration of Organizer Personal Data and the Services following a physical or technical incident.


Restoration of Access in the Event of an Incident. We rely on reputable third-party cloud, hosting, infrastructure, and software service providers to host, store, transmit, and Process Organizer Personal Data in connection with the Services. These providers maintain redundancy, backup, disaster recovery, and business continuity measures designed to support the availability and integrity of Organizer Personal Data in the event of a physical or technical incident. Our systems and services are designed to support the timely restoration of access to Organizer Personal Data following service interruptions, system failures, security incidents, or other operational disruptions. We maintain internal procedures for incident response, service restoration, and coordination with our Sub-Processors and service providers as reasonably necessary to restore access to Organizer Personal Data and maintain continuity of the Services. We do not operate our own physical data centers and instead rely on third-party infrastructure providers, with primary hosting infrastructure located in the European Union.


Testing and Evaluation of Security Measures. We periodically test, assess, and evaluate the effectiveness of the technical and organizational measures used to protect Organizer Personal Data and maintain the security, confidentiality, integrity, availability, and resilience of the Services. These activities may include internal security reviews, access control reviews, vulnerability assessments, monitoring, incident response evaluations, infrastructure reviews, and other security or operational assessments. Where we rely on third-party hosting, cloud infrastructure, storage, or service providers, we perform commercially reasonable diligence regarding the security practices and safeguards maintained by such providers, including reviewing publicly available certifications, audit reports, security documentation, or contractual commitments where appropriate. We maintain processes designed to identify, prioritize, and remediate material security issues identified through our security reviews and assessments.


User Identification and Authorization. Access to Gaytherings systems and applications is granted only to authorized users through unique user accounts. Each user is required to authenticate using secure login credentials, and multi-factor authentication is enabled where supported. User access rights are based on job responsibilities and follow the principle of least privilege. Access is reviewed periodically and revoked promptly when no longer required.


Data in Transit. We rely on reputable third-party service providers and platforms that use industry-standard encryption protocols to protect Personal Data during transmission. These providers employ Transport Layer Security (TLS 1.2 or higher) or equivalent encryption for all data sent over public or untrusted networks. Where applicable, such providers also support secure API connections, VPNs, or encrypted file transfer mechanisms to safeguard Personal Data transmitted between systems or with approved Sub-Processors.


Data Storage. We rely exclusively on reputable third-party service providers and platforms to store and process Personal Data, with primary data storage located in the European Union. These providers use industry-standard encryption and access controls to protect Personal Data at rest, typically employing AES-256 or equivalent encryption standards within their environments. We only use third-party platforms that maintain recognized security certifications or attestations (such as ISO 27001 or SOC 2). Access to Personal Data stored within these platforms is restricted to authorized Gaytherings personnel who require it to perform their duties.


Physical Security. We operate as a fully remote, cloud-based organization and do not host or maintain physical servers or on-premise data centers. All Personal Data is processed and stored within secure cloud environments operated by trusted third-party providers that implement industry-standard physical and environmental controls, including continuous monitoring, controlled facility access, redundant power systems, and disaster recovery protections. Our personnel access these platforms only through secure, encrypted connections and from devices protected by appropriate endpoint security and authentication measures.


Events Logging. We maintain system and access logs to record key events within systems that process Personal Data. These logs capture activities such as authentication attempts, configuration changes, and data access events to support security monitoring and incident investigation. Logs are protected from unauthorized modification or deletion, retained for a defined period, and reviewed periodically to detect unusual or unauthorized activity.


System Configuration. We maintain secure system configurations for all environments used to process Personal Data. Default passwords and unnecessary services are disabled, and security settings are aligned with industry best practices and vendor recommendations. Configuration changes are documented, reviewed, and approved before deployment. Automated tools or managed service providers may be used to monitor for misconfigurations and maintain compliance with our security standards.


IT Security Governance. We instruct our personnel to collect, process, and use Personal Data only as necessary for the performance of their assigned duties and solely for the purposes authorized under the Agreement. All employees and contractors are bound by written confidentiality obligations and receive training on proper data handling and information security practices. Where supported by the systems used to provide the Services, we implement logical access controls and data segregation measures designed to prevent unauthorized access to or exposure of Personal Data. Testing and production environments are separated where appropriate to protect live data from unintended use or disclosure.


Certification and Assurance. We utilize reputable third-party data centers and service providers that maintain current ISO 27001 certifications or other substantially similar or equivalent security certifications or attestations (such as SOC 2 Type II). We will not engage third-party data centers or hosting providers that lack such certifications or attestations. Upon your written request (no more than once within any 12-month period), we will provide, within a reasonable time, a copy or summary of the most recently completed certification or attestation reports relevant to the Services, to the extent such disclosure does not compromise the security or confidentiality of our systems. Any certification or audit report shared with you shall be considered Confidential Information and subject to the confidentiality obligations set forth in the Gaytherings Terms of Service.


Data Minimization. We only collect and Process Organizer Personal Data needed to provide the Services to you. Unnecessary or outdated data is not kept and is deleted or anonymized in line with our data retention practices.


Data Quality. Organizer Personal Data Processed by us consists of information provided by or on behalf of you and your users through the Services. We do not independently verify or guarantee the accuracy or completeness of Organizer Personal Data provided to us, and we do not enrich, supplement, or augment Organizer Personal Data with information obtained from external sources. We provide tools within the Services to help you review, correct, and manage Organizer Personal Data. You remain responsible for the accuracy, suitability, and lawful use of Organizer Personal Data within your own systems and processes.


Data Retention. We apply a data classification and retention policy that defines how different types of data are stored and for how long they are retained. When a record containing Organizer Personal Data is deleted, it is permanently removed from our active databases. A copy of that data may remain in system backups until those backups are automatically replaced through our regular backup rotation process, in line with our data retention policy. Organizer Personal Data is not retained longer than necessary for the purposes of providing the Services to you or as required by law.


Data Sourcing. Organizer Personal Data Processed through the Services is generally provided directly by or on behalf of the Organizer, Attendees, applicants, invitees, Members, or other users interacting with the Services. In limited circumstances, we may receive Organizer Personal Data from third-party service providers, integrations, Payment Processors, authentication providers, or communication providers as necessary to provide, operate, maintain, support, secure, or improve the Services. The Organizer is solely responsible for ensuring that it has all necessary rights, permissions, notices, consents, and lawful bases required under applicable Data Protection Laws for any Organizer Personal Data provided to us for Processing.


Accountability. We review our information security policies at least annually to ensure they remain current, effective, and properly implemented. All employees who handle Organizer Personal Data or Sensitive Data must acknowledge and follow these policies and are re-trained annually on information security practices and responsibilities. We maintain a disciplinary policy for employees who fail to comply with our information security requirements.


Data Portability and Erasure. We will provide commercially reasonable assistance to help you comply with your obligations relating to data portability and erasure under applicable Data Protection Laws, taking into account the nature of the Processing and the functionality of the Services. Upon your written request and to the extent reasonably feasible within the Services, we may provide Organizer Personal Data Processed on your behalf in a commonly used and machine-readable format. Upon your documented request to delete Organizer Personal Data, we will delete or anonymize the applicable Organizer Personal Data from active systems within a commercially reasonable period, subject to the Agreement, this DPA, applicable law, backup procedures, legal retention obligations, security requirements, fraud prevention purposes, dispute resolution obligations, and other legitimate business purposes permitted under applicable Data Protection Laws. You acknowledge that deleted Organizer Personal Data may continue to exist in backup systems, archives, logs, or disaster recovery systems for a limited period according to our standard retention and backup practices, provided that such retained data remains subject to the protections described in this DPA. We will not intentionally restore deleted Organizer Personal Data to active production systems except as reasonably necessary for disaster recovery, legal compliance, security purposes, or at your documented request.


Assistance to Organizer. We will provide commercially reasonable assistance to help you comply with your obligations under applicable Data Protection Laws relating to our Processing of Organizer Personal Data, taking into account the nature of the Processing and the information reasonably available to us. Such assistance may include: providing information regarding our Processing activities, technical and organizational measures, Sub-Processors, and security practices; assisting with Data Subject requests, regulatory inquiries, impact assessments, audits, or compliance reviews as described in this DPA; coordinating with Sub-Processors or service providers where reasonably necessary to support compliance obligations; and implementing or supporting lawful international transfer mechanisms where applicable to Restricted Transfers of Organizer Personal Data. We engage Sub-Processors and service providers under written agreements containing data protection and confidentiality obligations appropriate to the nature of the services provided. To the extent Organizer Personal Data is transferred outside the jurisdiction in which it was originally collected and such transfer is subject to Restricted Transfer requirements under applicable Data Protection Laws, we will implement appropriate lawful transfer mechanisms as described in this DPA.