Last revised: May 2026
This Data Processing Agreement (“DPA”) is entered into between the customer identified in the applicable Software Subscription Agreement (the “Venue”) and the VenueSumo Entity identified in the Software Subscription Agreement or otherwise determined in accordance with clause 17 (Governing Law) of the Terms and Conditions of Use available at https://venuesumo.com/terms-conditions/ (the “Terms”). This DPA, including its Annexes and Schedules, is incorporated by reference into the Terms and the Software Subscription Agreement (together, the “Agreement”).
Capitalised terms used but not defined in this DPA have the meanings given in the Terms and the Software Subscription Agreement.
1. Definitions
For the purposes of this DPA, the terms below have the meanings set out below. Capitalised terms used but not defined in this DPA have the meanings given in the Agreement.
1.1 Applicable Data Protection Laws means the privacy, data protection and data security laws and regulations of any jurisdiction applicable to the Processing of Venue Guest Data under the Agreement, including (without limitation) the Privacy Act 1988 (Cth), European Data Protection Laws and State Privacy Laws.
1.2 Venue Guest Data means Personal Information that constitutes Data (as that term is defined in the Terms) that is provided or made available to VenueSumo for Processing on Venue’s behalf in order to perform the VenueSumo Services.
1.3 EEA means the European Economic Area.
1.4 EEA SCCs or EEA Standard Contractual Clauses means MODULE TWO of the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
1.5 EU GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, as amended from time to time.
1.6 European Data Protection Laws means the GDPR and other data protection laws and regulations of the European Union, its Member States, Switzerland, Iceland, Liechtenstein, Norway, and the United Kingdom, in each case, to the extent applicable to the Processing of Venue Guest Data under the Agreement.
1.7 GDPR means the EU GDPR and the UK GDPR, as amended from time to time, together with any applicable implementing or supplementary legislation in any member state of the EEA or the UK (including the UK Data Protection Act 2018).
1.8 Information Security Incident means a breach of VenueSumo’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Venue Guest Data in VenueSumo’s possession, custody or control. Information Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Venue Guest Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
1.9 Personal Information has the meaning assigned to the terms “personal information”, “personal data”, or “personally identifiable information” (as applicable) in Applicable Data Protection Laws, or information of a similar character regulated thereby.
1.10 Processing means any operation or set of operations which is performed on Venue Guest Data or on sets of Venue Guest Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
1.11 Relevant Body means:
(a) in the context of the UK and the UK GDPR, means the UK Information Commissioner’s Office and/or the UK Government (as and where applicable); and/or
(b) in the context of the EEA and EU GDPR, means the European Commission.
1.12 Restricted Country means:
(a) in the context of the UK, means a country or territory outside the UK;
(b) in the context of the EEA, means a country or territory outside the EEA (which shall, as and where applicable, be interpreted in line with Article FINPROV.10A(1) of the Trade and Cooperation Agreement between the EU and the UK); and
(c) in respect of which the Relevant Body has not deemed that the country or territory provides an ‘adequate’ level of protection for Venue Guest Data pursuant to a decision made in accordance with Article 45(1) of the GDPR.
1.13 Security Measures has the meaning given in clause 4.1 (VenueSumo’s Security Measures).
1.14 Standard Contractual Clauses or SCCs means the EEA SCCs or UK SCCs, as appropriate.
1.15 State Privacy Laws means as applicable: the California Consumer Privacy Act of 2018, as amended, and any regulations promulgated thereunder; and other applicable state privacy laws in the United States, such as (but not limited to) the Virginia Consumer Data Protection Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act, and the Colorado Privacy Act.
1.16 Subprocessors means third parties that VenueSumo engages to Process Venue Guest Data in relation to the VenueSumo Services.
1.17 Supervisory Authority means:
(a) in the context of the UK and the UK GDPR, means the UK Information Commissioner’s Office; and
(b) in the context of the EEA and EU GDPR, has the meaning given to that term in Article 4(21) of the EU GDPR.
1.18 Third Party Subprocessors has the meaning given in clause 5 (Subprocessors) of Annex 1.
1.19 controller, data subject, processor as used in this DPA have the meanings given in the GDPR.
1.20 UK means the United Kingdom of Great Britain and Northern Ireland.
1.21 UK GDPR means the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended (including by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019).
1.22 UK SCCs or the UK Standard Contractual Clauses means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0, in force 21 March 2022, including their “part 2: mandatory clauses”), issued by the Commissioner under S119A(1) of the UK Data Protection Act 2018.
2. Duration, Scope and Applicability of this DPA
2.1 This DPA will remain in effect for so long as VenueSumo Processes Venue Guest Data, notwithstanding the expiration or termination of the Agreement.
2.2 This DPA applies only as follows:
- clauses 3 to 7 (inclusive) apply generally to the Processing of Venue Guest Data by VenueSumo;
- Annex 1 (Europe Annex) applies solely to Processing of Venue Guest Data that is subject to European Data Protection Laws pursuant to the territorial scope of the GDPR (including pursuant to Article 3 of the GDPR);
- Annex 2 (U.S. Privacy Laws Annex) applies solely to Processing subject to State Privacy Laws, where the Venue is a “business”, “processor”, “contractor” or “service provider” (as defined in State Privacy Laws) with respect to such Processing; and
- this DPA does not apply to Personal Information pertaining to the Venue’s Personnel or representatives who are business contacts of VenueSumo, in respect of which VenueSumo acts as a controller.
3. Nature of Processing Venue Guest Data
3.1 Venue Instructions. VenueSumo will Process Venue Guest Data only in accordance with the Venue’s instructions. This DPA, together with the Agreement, is the complete expression of those instructions. The Venue instructs VenueSumo to Process Venue Guest Data to provide the VenueSumo Services as contemplated by the Agreement. The Venue’s additional instructions other than the foregoing must (a) be consistent with the characteristics and nature of the VenueSumo Services; and (b) be made in writing pursuant to an amendment to this DPA signed by both parties.
3.2 De-Identified and Aggregated Data. The Venue acknowledges and agrees that, consistent with clause 12 of the Terms (“Aggregated Data”), VenueSumo may Process Venue Guest Data in aggregated, anonymised and/or de-identified form, and may use such resulting data for quality assurance and for the development and enhancement of VenueSumo’s products and services (including the Platform and any associated applications, websites, and kiosks). VenueSumo will not re-identify, or permit the re-identification of, any such Aggregated Data.
4. Security
4.1 VenueSumo Security Measures. VenueSumo will implement and maintain technical and organisational measures designed to protect Venue Guest Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Venue Guest Data (the “Security Measures”). VenueSumo may update the Security Measures from time to time, provided that the updated measures do not materially decrease the overall protection of Venue Guest Data. The Security Measures supplement, and are without prejudice to, the security commitments set out in clause 6 (Security and integrity) of the Terms.
4.2 Information Security Incidents. VenueSumo will notify the Venue without undue delay of any Information Security Incident of which VenueSumo becomes aware. Such notifications will describe the available details of the Information Security Incident, including information to allow the Venue to meet any obligations under Applicable Data Protection Laws to report the Information Security Incident to affected data subjects or to the relevant Supervisory Authority or other enforcement or investigative authorities. VenueSumo’s notification of, or response to, an Information Security Incident will not be construed as VenueSumo’s acknowledgement of any fault or liability with respect to the Information Security Incident.
4.3 Venue’s Security Responsibilities and Assessment.
(a) Venue’s Security Responsibilities. The Venue agrees that, without limiting VenueSumo’s obligations under this clause 4, the Venue is solely responsible for its use of the VenueSumo Services, including (i) making appropriate use of the VenueSumo Services to ensure a level of security appropriate to the risk in respect of the Venue Guest Data; (ii) securing the account authentication credentials, systems and devices the Venue uses to access the VenueSumo Services; (iii) securing the Venue’s systems and devices that VenueSumo uses to provide the VenueSumo Services; and (iv) backing up Venue Guest Data. This clause is consistent with, and supplements, the Venue’s responsibilities under clauses 5 and 6 of the Terms.
(b) Venue’s Security Assessment. The Venue agrees that the VenueSumo Services, the Security Measures, and VenueSumo’s commitments under this DPA are adequate to meet the Venue’s needs, including with respect to any security obligations of the Venue under Applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Venue Guest Data.
5. Data Subject Rights
5.1 VenueSumo’s Data Subject Request Assistance. Taking into account the nature of the Processing of Venue Guest Data, VenueSumo will provide the Venue with assistance reasonably necessary and technically possible in the circumstances for the Venue to perform its obligations under Applicable Data Protection Laws to fulfil requests by data subjects to exercise their rights under Applicable Data Protection Laws (“Data Subject Requests”) with respect to Venue Guest Data in VenueSumo’s possession or control. The Venue shall compensate VenueSumo for any such assistance at VenueSumo’s then-current professional services rates, which shall be made available to the Venue upon request.
5.2 Venue’s Responsibility for Requests. If VenueSumo receives a Data Subject Request, VenueSumo will advise the data subject to submit the request to the Venue, and the Venue will be responsible for responding to the request.
6. Venue Responsibilities
6.1 Venue Compliance. The Venue shall comply with its obligations under Applicable Data Protection Laws. The Venue shall ensure (and is solely responsible for ensuring) that its instructions under clause 3, and the representations it has made under clause 10 (Privacy) and clause 11 (Your Data) of the Terms, comply with Applicable Data Protection Laws.
6.2 Prohibited Data. The Venue represents and warrants to VenueSumo that Venue Guest Data does not, and will not, without VenueSumo’s prior written consent, contain any social security numbers or other government-issued identification numbers; protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; health insurance information; biometric information; passwords for online accounts; credentials to any financial accounts; tax return data; credit reports or consumer reports; any payment card information subject to the Payment Card Industry Data Security Standard; or information subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act or the regulations promulgated under either such laws.
For clarity, payment card data captured in connection with the VenueSumo Services is processed by the 3rd Party Payment Processors referred to in clause 4 of the Terms and is subject to those processors’ terms.
7. Data Deletion
This clause 7 operates in addition to, and is to be read consistently with, the “Exporting Data and Data Purging” and “Effect of termination” provisions of the Terms. Upon termination or expiry of the Agreement (for any reason), and subject to the 60-day data retrieval period set out in the Terms, VenueSumo shall delete all Venue Guest Data on VenueSumo’s systems on the Venue’s request, and shall delete existing copies, unless continued storage of the Venue Guest Data is required by (i) applicable laws of the European Union, the member states of the European Union or the EEA, or the United Kingdom, with respect to Venue Guest Data subject to European Data Protection Laws, or (ii) Applicable Data Protection Laws, with respect to all other Venue Guest Data. VenueSumo will comply with such instruction as soon as reasonably practicable and, in any event, no later than 90 days after the expiration of the 60-day retrieval period referred to in the Terms, unless Applicable Data Protection Laws require storage.
The Venue may request a copy of Venue Guest Data from VenueSumo for an additional charge by requesting it in writing at least 30 days prior to the expiration or termination of the Agreement. Upon the parties’ agreement to such charge pursuant to a work order or other amendment to the Agreement, VenueSumo will provide such copy of Venue Guest Data before it is deleted in accordance with this clause.
8. Miscellaneous
Except as expressly modified by this DPA, the terms of the Agreement remain in full force and effect. In the event of any conflict or inconsistency between this DPA and the other terms of the Agreement in respect of the Processing of Venue Guest Data, this DPA will govern. Notwithstanding anything in the Agreement or any Software Subscription Agreement entered in connection with it to the contrary, the parties acknowledge and agree that VenueSumo’s access to and Processing of Venue Guest Data does not constitute part of the consideration provided to VenueSumo in respect of the Agreement.
Notwithstanding anything to the contrary in the Agreement, any notices required or permitted to be given by VenueSumo to the Venue under this DPA may be given (a) in accordance with the notices provisions of clause 17 of the Terms; (b) to VenueSumo’s primary points of contact with the Venue; or (c) to any email address provided by the Venue for the purpose of receiving VenueSumo Services-related communications or alerts. The Venue is solely responsible for ensuring that such email addresses are valid.
Annex 1 to the DPA: Europe Annex
1. Processing of Data
1.1 Subject Matter and Details of Processing. The parties acknowledge and agree that the details of VenueSumo’s Processing of Venue Guest Data are specified in Schedule A.
1.2 Roles, Regulatory Compliance and Authorisation. The parties acknowledge and agree that (i) VenueSumo is a processor of the Venue Guest Data under European Data Protection Laws; (ii) the Venue is a controller (or a processor acting on the instructions of a controller) of that Venue Guest Data under European Data Protection Laws; and (iii) each party will comply with the obligations applicable to it in that role under the European Data Protection Laws with respect to the Processing of the Venue Guest Data. If the Venue is itself a processor, the Venue represents and warrants to VenueSumo that the Venue’s instructions and actions with respect to Venue Guest Data, including its appointment of VenueSumo as another processor, have been authorised by the relevant controller.
1.3 VenueSumo’s Compliance with Instructions. VenueSumo will Process Venue Guest Data only in accordance with the Venue’s instructions pursuant to this DPA unless applicable European Data Protection Laws require otherwise, in which case VenueSumo will notify the Venue (unless that law prohibits VenueSumo from doing so on important grounds of public interest).
2. Data Security
2.1 VenueSumo Security Measures, Controls and Assistance.
(a) VenueSumo Security Assistance. VenueSumo will (taking into account the nature of the Processing of Venue Guest Data and the information available to VenueSumo) provide the Venue with reasonable assistance necessary for the Venue to comply with its obligations in respect of Venue Guest Data under European Data Protection Laws, including Articles 32 to 34 (inclusive) of the GDPR, by (i) implementing and maintaining the Security Measures; (ii) complying with the terms of clause 4.2 (Information Security Incidents) of the DPA; and (iii) complying with this Annex 1.
(b) Security Compliance by VenueSumo Staff. VenueSumo ensures that its Personnel who are authorised to access Venue Guest Data are subject to appropriate confidentiality obligations.
2.2 Reviews and Audits of Compliance.
(a) Frequency. The Venue may audit VenueSumo’s compliance with its obligations under this DPA up to once per year and on such other occasions as may be required by European Data Protection Laws, including where mandated by the Venue’s Supervisory Authority.
(b) Provision of Information. VenueSumo will contribute to such audits by providing the Venue or the Venue’s Supervisory Authority with the information and assistance that VenueSumo considers appropriate in the circumstances and reasonably necessary to conduct the audit.
(c) Third Party Auditor. If a third party is to conduct the audits referred to above, VenueSumo may object to the auditor if the auditor is, in VenueSumo’s reasonable opinion, not independent, a competitor of VenueSumo, or otherwise manifestly unsuitable. Such objection by VenueSumo will require the Venue to appoint another auditor or conduct the audit itself.
(d) Arrangements for On-Site Audits. If the Venue (acting reasonably) is able to provide documentary evidence that the information made available by VenueSumo is not sufficient in the circumstances to demonstrate VenueSumo’s compliance with this DPA, VenueSumo shall allow for and contribute to audits, including on-premises inspections, by the Venue or a third party auditor mandated by the Venue in relation to the Processing of the Venue Guest Data by VenueSumo. To request an audit, the Venue must submit a proposed audit plan to VenueSumo at least two weeks in advance of the proposed audit date and any third party auditor must sign a customary non-disclosure agreement mutually acceptable to the parties (such acceptance not to be unreasonably withheld) providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings of the audit. The proposed audit plan must describe the proposed scope, duration and start date of the audit. VenueSumo will review the proposed audit plan and provide the Venue with any concerns or questions (for example, any request for information that could compromise VenueSumo security, privacy, employment, or other relevant policies). VenueSumo will work cooperatively with the Venue to agree on a final audit plan.
(e) Conducting On-Site Audits. The on-site audits referred to above must be conducted during regular business hours, subject to the agreed final audit plan and VenueSumo’s safety, security, or other relevant policies, and may not unreasonably interfere with VenueSumo’s business activities. The Venue shall use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing, and hereby indemnifies VenueSumo in respect of, any damage, injury or disruption to VenueSumo’s premises, equipment, Personnel, data, and business (including any interference with the confidentiality or security of the data of VenueSumo’s other customers or the availability of the VenueSumo Services to such other customers) while its personnel and/or its auditor’s personnel (if applicable) are on those premises in the course of any on-premises inspection.
(f) Confidentiality. Nothing in this clause 2.2 shall require VenueSumo to breach any duties of confidentiality.
(g) Audit Results. The Venue will promptly notify VenueSumo of any non-compliance discovered during the course of an audit and provide VenueSumo any audit reports generated in connection with any audit under this clause 2.2, unless prohibited by European Data Protection Laws or otherwise instructed by a Supervisory Authority. The Venue may use the audit reports only for the purposes of meeting the Venue’s regulatory audit requirements and/or confirming compliance with the requirements of this DPA.
(h) Costs. Any audits are at the Venue’s sole expense. The Venue shall reimburse VenueSumo for any time expended by VenueSumo and any third parties in connection with any audits or inspections under this clause 2.2 at VenueSumo’s then-current professional services rates, which shall be made available to the Venue upon request. The Venue will be responsible for any fees charged by any auditor appointed by the Venue to execute any such audit.
(i) Auditor Reports in Lieu of Inspections. If the controls or measures to be assessed in a requested audit are addressed in an SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third party auditor within twelve (12) months of the Venue’s audit request, and VenueSumo has confirmed there have been no known material changes in the controls audited since the date of such report, the Venue agrees to accept such report in lieu of requesting an audit of such controls or measures.
3. Data Protection Impact Assessments and Consultations
Taking into account the nature of the Processing and the information available to VenueSumo, VenueSumo will reasonably assist the Venue, at the Venue’s cost, in complying with its obligations under Articles 35 and 36 of the GDPR, in each case solely in relation to Processing of Venue Guest Data, by (a) making available documentation describing relevant aspects of VenueSumo’s information security program and the security measures applied in connection therewith; and (b) providing the other information contained in the Agreement, including this DPA.
4. Data Transfers
4.1 Data Processing Facilities. Subject to clauses 4.2 (Transfers out of the EEA) and 4.3 (Transfers out of the UK), VenueSumo may store and Process Venue Guest Data in Australia or the United States or anywhere VenueSumo or its Subprocessors maintain facilities. However, if the Venue is established in the European Union, the United Kingdom or the United Arab Emirates, VenueSumo will store and Process Venue Guest Data in a data centre located in the European Union (without prejudice to Processing locations of VenueSumo’s other Subprocessors).
4.2 Transfers out of the EEA. If the VenueSumo Entity contracting with the Venue under the Agreement and this DPA is VenueSumo Pty Ltd (Australia), then the parties hereby agree to the EEA Standard Contractual Clauses, the terms of which are hereby incorporated by reference into this DPA, in accordance with Schedule A and as follows:
- the data importer will provide copies of the subprocessor agreements that must be sent by the data importer to the data exporter pursuant to Clause 5(j) of the EEA Standard Contractual Clauses upon the data exporter’s request, and the data importer may remove or redact all commercial information or clauses unrelated to the EEA Standard Contractual Clauses or their equivalent beforehand;
- the audits described in Clause 5(f) and Clause 12(2) of the EEA Standard Contractual Clauses shall be performed in accordance with clause 2.2 of this Annex 1 (Reviews and Audits of Compliance);
- the Venue’s authorisations in clause 5 (Subprocessors) of this Annex 1 will constitute the Venue’s prior written consent to the subcontracting by VenueSumo of the Processing of Venue Guest Data if such consent is required under Clause 5(h) of the EEA Standard Contractual Clauses; and
- certification of deletion of Venue Guest Data as described in Clause 12(1) of the EEA Standard Contractual Clauses shall be provided upon the data importer’s request.
4.3 Transfers out of the UK. If the VenueSumo Entity contracting with the Venue under the Agreement and this DPA is VenueSumo Pty Ltd (Australia), then the parties hereby agree to the UK Standard Contractual Clauses in accordance with Schedule B.
4.4 Notwithstanding the foregoing, the Standard Contractual Clauses (or obligations the same as those under the Standard Contractual Clauses) will not apply to the extent an alternative recognised compliance standard for the transfer of Venue Guest Data outside the EEA or the UK in accordance with European Data Protection Laws applies to the transfer. In the event of any conflict or inconsistency between (a) this Annex 1 and any other provision of this DPA, this Annex 1 will govern; or (b) the Standard Contractual Clauses and any other provision of the Agreement, the Standard Contractual Clauses will govern.
5. Subprocessors
5.1 Consent to Subprocessor Engagement. The Venue specifically authorises the engagement of VenueSumo’s corporate group affiliates (including, without limitation, those VenueSumo Entities identified in clause 17 of the Terms) as Subprocessors, and generally authorises the engagement of other third parties as Subprocessors (“Third Party Subprocessors”). This authorisation is consistent with, and supplements, the Venue’s consent under the “Subcontract” provision of clause 17 of the Terms.
5.2 Information about Subprocessors. Information about Subprocessors, including their functions and locations, is available at: https://venuesumo.com/subprocessors/ (as may be updated by VenueSumo from time to time) or such other website address as VenueSumo may provide to the Venue from time to time.
5.3 Requirements for Subprocessor Engagement. When engaging any Subprocessor, VenueSumo will enter into a written contract with such Subprocessor containing data protection obligations which are the same in substance as those in this DPA with respect to Venue Guest Data to the extent applicable to the nature of the services provided by such Subprocessor. VenueSumo shall be liable for all obligations under the Agreement subcontracted to the Subprocessor, or its actions and omissions related thereto.
5.4 Opportunity to Object to Subprocessor Changes. When VenueSumo engages any new Third Party Subprocessor after the effective date of the Agreement, VenueSumo will notify the Venue of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) by written means (email permissible). If the Venue objects to such engagement in a written notice to VenueSumo within 15 days after being informed of the engagement on reasonable grounds relating to the protection of Venue Guest Data, the Venue and VenueSumo will work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, the Venue may, as its sole and exclusive remedy, terminate the Agreement and cancel the VenueSumo Services by providing written notice to VenueSumo and pay VenueSumo for all amounts due and owing under the Agreement as of the date of such termination.
Annex 2 to the DPA: U.S. Privacy Laws Annex
1. For the purposes of this Annex 2, the terms “business”, “commercial purpose”, “consumer”, “sell”, “share”, “collect”, “business purpose” and “service provider” have the respective meanings given thereto in State Privacy Laws, and “personal information” shall mean Venue Guest Data that constitutes personal information governed by State Privacy Laws.
2. It is the parties’ intent that, with respect to any personal information, VenueSumo is a service provider. The parties agree that the Venue is disclosing the personal information to VenueSumo only for the following limited and specified business purpose: the provision of the VenueSumo Services to the Venue as contemplated by the Agreement. VenueSumo shall not sell or share any personal information.
3. VenueSumo is: (a) prohibited from retaining, using, or disclosing the personal information for any commercial purpose other than the foregoing business purposes, unless expressly permitted by State Privacy Laws; and (b) prohibited from retaining, using, or disclosing the personal information that it collects outside the direct business relationship between the Venue and VenueSumo, unless expressly permitted by the CCPA. VenueSumo shall comply with all applicable sections of State Privacy Laws and shall provide, with respect to personal information it collects, the same level of privacy protection as required by State Privacy Laws.
4. The parties acknowledge that VenueSumo’s retention, use and disclosure of personal information authorised by the Venue’s instructions documented in this DPA are integral to VenueSumo’s provision of the VenueSumo Services and the business relationship between the parties.
5. VenueSumo grants the Venue the right to take reasonable and appropriate steps to ensure that VenueSumo uses the personal information it collects in a manner consistent with VenueSumo’s obligations under State Privacy Laws. VenueSumo grants the Venue the right, upon notice, to take reasonable and appropriate steps to stop and remediate VenueSumo’s unauthorised use of personal information.
6. VenueSumo must promptly notify the Venue when it makes a determination that it can no longer meet its obligations under this DPA or State Privacy Laws.
7. Subprocessors
7.1 Consent to Subprocessor Engagement. The Venue specifically authorises the engagement of VenueSumo’s corporate group affiliates as Subprocessors and generally authorises the engagement of other third parties as Subprocessors (“Third Party Subprocessors”).
7.2 Information about Subprocessors. Information about Subprocessors, including their functions and locations, is available at the URL referenced in clause 5.2 of Annex 1 (as may be updated by VenueSumo from time to time).
7.3 Requirements for Subprocessor Engagement. When engaging any Subprocessor, VenueSumo will enter into a written contract with such Subprocessor containing data protection obligations which are the same in substance as those in this DPA with respect to Venue Guest Data to the extent applicable to the nature of the services provided by such Subprocessor. VenueSumo shall be liable for all obligations under the Agreement subcontracted to the Subprocessor, or its actions and omissions related thereto.
7.4 Opportunity to Object to Subprocessor Changes. When VenueSumo engages any new Third Party Subprocessor after the effective date of the Agreement, VenueSumo will notify the Venue of the engagement by written means (email permissible). If the Venue objects to such engagement in a written notice to VenueSumo within 15 days after being informed of the engagement on reasonable grounds relating to the protection of Venue Guest Data, the Venue and VenueSumo will work together in good faith to find a mutually acceptable resolution. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, the Venue may, as its sole and exclusive remedy, terminate the Agreement and cancel the VenueSumo Services by providing written notice to VenueSumo and pay VenueSumo for all amounts due and owing under the Agreement as of the date of such termination.
Schedule A: Particulars of Data Processing
Particulars under the EEA Standard Contractual Clauses
| Item | Subject Matter | Description |
|---|---|---|
| Section II (Obligations of the Parties), Clause 9(a) | Subprocessor authorisation | The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 15 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. |
| Section IV (Final Provisions), Clause 17 | Governing law | [CONFIRM – e.g. Republic of Ireland] |
| Section IV (Final Provisions), Clause 18(b) | Court jurisdiction and venue | [CONFIRM – e.g. Dublin, Ireland] |
| Annex I, A – List of Parties | Data Exporter – details of controller | The Venue, as detailed in the Software Subscription Agreement. |
| Annex I, A – List of Parties | Data Importer – details of processor | The VenueSumo Entity contracting with the Venue under the Agreement, as determined in accordance with clause 17 of the Terms. [CONFIRM – list legal entity name(s) and registered address(es), e.g. VenueSumo Pty Ltd (ABN 98 667 285 145), Level 1, 597 Church St, Richmond VIC 3121, Australia; VenueSumo US, LLC, [address]] |
| Annex I, B – Description of Transfer | Categories of data subjects | Venue guests, members, waiver signatories, group/party booking attendees, online ticket purchasers, gift voucher purchasers and recipients, survey respondents, and other end users of the Venue’s services who interact with the Venue via the Platform. |
| Annex I, B – Description of Transfer | Categories of personal data | Contact information: depending on the nature of the interaction with the data subject, this may include information such as name, email address, phone number and residential address. Engagement information: information about how the data subject interacts with the Venue through the Platform, such as: purchasing tickets, memberships, season passes or gift vouchers; attending Venue events; signing participation waivers; making party, group or event bookings; placing QR-code or POS orders; completing guest surveys or feedback; submitting an incident report; and the substance of any inquiries submitted to the Venue. Analytics information: technical and usage information such as the IP address from which the data subject accesses the VenueSumo Services, time and date of access, type of browser used, language used, links clicked, and actions the data subject has taken while using the VenueSumo Services. |
| Annex I, B – Description of Transfer | Sensitive data | None, unless otherwise agreed in writing by the data exporter and data importer. The Venue is reminded of the prohibited data warranty in clause 6.2 of this DPA. |
| Annex I, B – Description of Transfer | Frequency of transfer | Ongoing and continuous for the duration of the Agreement. |
| Annex I, B – Description of Transfer | Nature of processing | Collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, use, disclosure, combination, and erasure, in each case for the purpose of providing the VenueSumo Services. |
| Annex I, B – Description of Transfer | Purpose(s) of the data transfer and further processing | VenueSumo’s provision of the VenueSumo Services to the Venue under the Agreement. |
| Annex I, B – Description of Transfer | Retention period | From VenueSumo’s receipt of Venue Guest Data until deletion of all Venue Guest Data by VenueSumo in accordance with the Agreement (including the data retrieval and deletion provisions in clause 11 of the Terms, clause 16 of the Terms, and clause 7 of this DPA). |
| Annex I, B – Description of Transfer | Transfers to subprocessors | VenueSumo’s corporate group affiliates (including, without limitation, the VenueSumo Entities identified in clause 17 of the Terms); and the Subprocessors specified at the URL referenced in clause 5.2 of Annex 1. |
| Annex I, C – Description of Transfer | Competent Supervisory Authority | Where the data exporter is established in an EU Member State, the supervisory authority is the one established in the EU Member State where the data exporter is established. Where the data exporter is not established in an EU Member State but falls within the territorial scope of Article 3(2) of the GDPR and has appointed a representative pursuant to Article 27(1) of the GDPR, the supervisory authority is that of the Member State in which that representative is established. Where the data exporter is not established in an EU Member State but falls within the territorial scope of Article 3(2) of the GDPR without having appointed a representative pursuant to Article 27(1) of the GDPR, the supervisory authority is the one established in the EU Member State in which the data subjects whose personal data is transferred are located. |
| Annex II | Technical and Organisational Measures | The Security Measures referenced in clause 4.1 of this DPA, available at https://venuesumo.com/securitymeasures/ |
Schedule B: Particulars under the UK Standard Contractual Clauses
| Item | Subject Matter | Description |
|---|---|---|
| Table 1 – Parties | Start date | The date indicated in the Software Subscription Agreement for the commencement of the VenueSumo Services. |
| Table 2 – Parties | Parties’ details and key contacts | The Venue, as detailed in the Software Subscription Agreement. The VenueSumo Entity identified in or determined under clause 17 of the Terms. |
| Table 2 | Selected SCCs, Modules and Selected Clauses | The version of the Approved EU SCCs to which the International Data Transfer Addendum is appended is the Standard Contractual Clauses, as specified in clause 4.2 of Annex 1 (Europe Annex) to the DPA. |
| Table 4 | Ending the Addendum when the Approved Addendum changes | Data exporter. |
— END OF DATA PROCESSING AGREEMENT —
