OPVII

Data Processing Addendum

The processor agreement, with both annexes, published in full.

Get Started See Pricing

Professional Onboarding No Contracts Cancel Anytime

Email And Text, On Schedule

The full reminder cadence runs off one registration, with nobody sending anything.

One Inbox For Replies

Texts and emails come back already matched to the attendee and the event.

Attendance In One Click

Mark who walked in and the show rate updates itself.

This Addendum was last updated on October 10, 2026. It takes effect automatically for every customer whose use of the platform involves personal data subject to the GDPR or the UK GDPR, with no signature required. A countersigned copy is available on request.

Parties And Incorporation

This Data Processing Addendum is entered into between you, the customer named on the account, and OPVII, operator of OPVII. It forms part of the Terms of Service and applies whenever we process personal data on your behalf.

You do not need to sign anything for it to apply. Creating an account and loading registrant data into a workspace is what brings it into effect, so there is never a window in which your data is processed without it.

Definitions

"Controller", "processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" carry the meanings given to them in the GDPR. "Data Protection Law" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and any other data protection law applicable to the processing. "Subprocessor" means a third party we engage to process personal data on your behalf.

Roles Of The Parties

For registrant data in your workspace, you are the controller and we are the processor. Where you are yourself acting as a processor for another controller, we are the subprocessor and this Addendum applies as if the obligations owed to a controller were owed to you.

Each party is independently responsible for its own compliance with Data Protection Law. You warrant that you have a lawful basis for the registrant data you load, and that any consent you rely on was properly obtained and recorded.

Scope, Subject Matter And Duration

We process personal data only to provide the platform, to act on your documented instructions, and to meet a legal obligation. Using the product is itself a documented instruction. We do not process your registrants' personal data for our own purposes, do not sell it, do not share it for cross-context behavioral advertising, and do not use it to train any model.

Processing lasts for as long as your account does, and then for the limited period described under Deletion And Return.

If an instruction from you would, in our view, breach Data Protection Law, we will tell you rather than carry it out quietly.

Confidentiality And Personnel

Access to personal data is limited to the people who need it to operate or support the platform, each of whom is bound by a duty of confidentiality that survives the end of their engagement. Access is by individual account with two-factor authentication available, never a shared credential, and administrative actions are recorded.

Security Measures

We implement the technical and organizational measures set out in Annex II, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. Annex II describes the measures as they are today, not as we intend them to be.

We may update a measure, and will not reduce the overall level of security while doing so.

Subprocessors

You give a general authorization for us to engage the subprocessors published at /subprocessors. Each one is bound by written terms imposing data protection obligations no less protective than those in this Addendum, and we remain liable to you for its performance.

We will give you notice before adding or replacing a subprocessor. You may object on reasonable data protection grounds within 30 days, and we will work with you to find a solution. If none is available, you may terminate the affected part of the service and receive a prorated refund of any prepaid fees for the unused period.

Assisting With Data Subject Requests

The product gives you direct access to the registrant records in your workspace, so you can answer most access, correction and erasure requests yourself and immediately. Registrants can also handle common requests themselves through the attendee portal.

If a registrant comes to us directly, we will not act on their records without your instruction. We will tell them that the business running the event is the controller and, where we can identify you, pass the request on promptly.

Where you need help beyond what the product offers, we will provide reasonable assistance at no charge for a request of ordinary volume.

Personal Data Breach

We will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting personal data we process for you. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

We will send what we know at the time rather than waiting for a complete picture, and follow up as the picture fills in. We will not make a notification to a supervisory authority or to affected data subjects on your behalf unless you ask us to, because that decision is the controller's.

Data Protection Impact Assessments And Audits

We will provide the information reasonably needed for you to carry out a data protection impact assessment or a prior consultation with a supervisory authority, to the extent it concerns our processing and you cannot obtain it elsewhere.

On written request, no more than once in any twelve month period, we will answer a reasonable security questionnaire and provide the documentation we hold. We have no SOC 2 report or third-party penetration test to supply, and say so here rather than in the reply to your questionnaire.

An on-site audit is available where Data Protection Law requires one, on 30 days' notice, during business hours, subject to confidentiality, and limited to what is relevant to the processing.

Deletion And Return

You can export your workspace data at any time while the account is open. On termination we delete personal data we process for you within 30 days of your request, or within 90 days of the account closing if you make no request, except where a law requires us to keep it.

Backups age out of rotation rather than being surgically edited, so a copy may persist in an encrypted backup for a short period after deletion from the live system. Nothing is restored from a backup into the live product once deletion has run.

Consent and opt-out records are retained after deletion where carrier rules or consumer protection law require us to be able to demonstrate them. That retention protects the person who asked not to be contacted.

International Transfers And The Standard Contractual Clauses

Where we process personal data transferred out of the EEA, the United Kingdom or Switzerland, the European Commission's Standard Contractual Clauses of 4 June 2021 are incorporated into this Addendum, Module Two, controller to processor, with the following selections: Clause 7, the docking clause, applies; Clause 9, option 2, general written authorization, applies with the 30 day notice period above; Clause 11, the optional independent dispute resolution language, does not apply; Clause 17 is governed by the law of Ireland; Clause 18 names the courts of Ireland. Annex I and Annex II below serve as the Clauses' annexes.

For a transfer from the United Kingdom, the Information Commissioner's International Data Transfer Addendum, version B1.0, applies to those Clauses, with Tables 1 to 4 populated from this Addendum and from Annex I. For a transfer from Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

Annex I, Details Of The Processing

This Annex serves as Annex I to the Standard Contractual Clauses. Your account record identifies you as the data exporter; the data importer is OPVII, reachable at dev@opvii.local.

Item Detail
Roles You are the controller and data exporter. We are the processor and data importer.
Subject Matter Providing event registration, reminder, messaging and attendance software.
Nature Of Processing Collecting, recording, storing, organizing, transmitting, displaying, erasing.
Purpose Operating your workspace and sending the messages your events are configured to send.
Categories Of Data Subject Your event registrants and attendees; your own staff who sign in to the account.
Categories Of Personal Data Name, email address, phone number, event and registration history, consent and opt-out records, message content and delivery status, survey and feedback responses, and for account holders a billing contact and card token.
Special Category Data None requested and none required. Do not load health, biometric, genetic, racial, political, religious or sexual orientation data, or any protected health information.
Frequency Continuous, for as long as the account is open.
Retention For the life of the account, then as set out under Deletion And Return. Audit records two years, security events seven years, consent records as required.
Subprocessors As published at /subprocessors, each for the purpose, data and duration stated there.
Competent Supervisory Authority The authority of the Member State in which the data exporter is established, or the Irish Data Protection Commission where the exporter is not established in the Union.

Annex II, Technical And Organizational Measures

This Annex serves as Annex II to the Standard Contractual Clauses. Each measure below is in place today. The Trust Center at /trust states what is not in place, and that list is part of an honest answer to this Annex rather than a separate marketing page.

Measure How It Is Implemented
Pseudonymization And Encryption TLS 1.2 and 1.3 in transit, with older versions refused rather than downgraded. HTTP Strict Transport Security for one year including subdomains. Integration credentials encrypted at rest. Card data never received: Stripe tokenizes it in the browser.
Confidentiality Every workspace is isolated at the query layer rather than by a filter somebody remembered to apply. Access by individual account with optional TOTP two-factor authentication, a ten character minimum password with mixed case, a number and a symbol, and no shared credentials.
Integrity Content Security Policy with object sources blocked and form action locked to our own origin. Framing blocked site wide. MIME sniffing disabled. Cross-site request forgery tokens on every form. Session cookies marked Secure, HttpOnly and SameSite.
Availability And Resilience Managed hosting with automated database backups and a public status page. Queue workers and the scheduler run under process supervision so a failure restarts rather than stopping silently.
Testing And Evaluation An automated test suite runs on every change, including tests that pin the security headers and the consent behavior. Dependency advisories are reviewed and patched. There is no third-party penetration test report.
Access Control Role-based permissions in the product. Administrative access limited to named operators. Rate limiting per route and per API key. reCAPTCHA on public forms.
Logging And Accountability Administrative actions recorded with the actor, the time, the originating address, and the values before and after, with passwords and authentication secrets masked before anything is written. Login events recorded and pruned on a schedule. Audit records kept two years, security events seven.
Data Minimization We ask for a name, an email address and a phone number because that is what a reminder needs. No special category data is requested, and no profiling or automated decision making is performed.
Subprocessor Governance A published register, written terms no less protective than this Addendum, a transfer impact assessment before onboarding, and a 30 day objection window before a change takes effect.
Incident Response Notification to you without undue delay and within 72 hours of becoming aware, with what is known at the time and a follow-up as the picture fills in.

Liability And Order Of Precedence

Each party's liability under this Addendum is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Law does not permit that.

If this Addendum conflicts with the Terms of Service, this Addendum governs for matters of data protection. If this Addendum conflicts with the Standard Contractual Clauses, the Clauses govern.

Contact

A countersigned copy of this Addendum, a security questionnaire, or a vendor review request goes to dev@opvii.local.