Data Processing Addendum
Attached to the Terms. The organizer is the controller; Hingemark processes personal data only on its documented instructions.
1. Roles and scope
Customer is the business/controller of personal data about its attendees, buyers and staff ("Customer Data"). Hingemark is Customer's service provider/processor and processes Customer Data solely to provide the service described in the Terms.
2. Service-provider obligations (CCPA/CPRA §1798.140(ag) and equivalents)
Hingemark will not sell or share Customer Data; will not retain, use or disclose it for any purpose other than the service or outside the direct business relationship; will not combine it with personal data received from other customers except as permitted for the service; will comply with applicable privacy law and notify Customer if it can no longer meet its obligations; and grants Customer the right to take reasonable steps to stop and remediate unauthorized use.
3. Instructions
Customer's instructions are the Terms, this DPA, and configuration made in the dashboard (connections, doors, approvals). Hingemark will inform Customer if an instruction appears to infringe applicable law.
4. Confidentiality and security
Personnel with access are bound by confidentiality. Technical measures include encryption in transit and at rest, encrypted secrets, role-based access, tenant isolation, append-only hash-chained evidence records, and automated retention. A summary is maintained at /legal/security [to add].
5. Sub-processors
Customer authorizes the sub-processors listed at /legal/subprocessors. Hingemark gives 30 days' notice of additions; Customer may object on reasonable grounds, in which case either party may terminate the affected service.
6. Data-subject requests
Hingemark forwards requests it receives directly to Customer within 5 business days and, on Customer's instruction, fulfils access and deletion requests from the dashboard (Team → Privacy requests). Deletion removes direct identifiers and evidence packs; integrity records without identifiers are retained.
7. Security incidents
Hingemark notifies Customer without undue delay and no later than 72 hours after confirming a breach affecting Customer Data, with the information reasonably needed for Customer's own notifications.
8. Retention and deletion
Personal data is deleted on the schedule in the Privacy Policy (180 days after a dispute closes; 30 days after an event for guest names) and within 30 days of termination on request, except integrity records containing no direct identifiers and data retained as required by law.
9. Audit
On reasonable request, no more than once a year, Hingemark provides information sufficient to demonstrate compliance with this DPA and allows audits by Customer or an independent auditor under confidentiality, at Customer's cost.
10. International transfers
Processing takes place in the United States. If Customer Data of EU/UK residents is processed, the parties will execute the applicable standard contractual clauses [to add when relevant].