Data Processing Addendum.

The organization accepting the Organizer Agreement is the Customer; Cicada Group, LLC, doing business as Private Event Tickets is the Service Provider/Processor. For Customer Personal Data, Customer is the Controller/Business and PET is the Processor/Service Provider, except where PET acts independently for account security, platform billing, fraud prevention, legal compliance, and its own business operations. Capitalized privacy terms have the meanings given by applicable data-protection law.

Subject: event ticketing, delivery, Wallet passes, claims, guest management, checkout, and check-in. Duration: the service term plus the retention period described in the Privacy Policy or Customer’s documented deletion instruction. People: Customer personnel, invitees, employees, members, guests, ticket holders, buyers, and scanner users. Data: identifiers, contact information, organization and roster fields, event participation, ticket and delivery status, purchases, refunds, device/security data, and Customer notes. Operations: collection, recording, organization, storage, retrieval, transmission, display, matching, scanning, support, deletion, and related security processing.

PET will process Customer Personal Data only on Customer’s documented instructions, including use of configured Service features, this DPA, the Agreement, and support requests, unless law requires otherwise. If legally permitted, PET will notify Customer of a conflicting legal requirement. PET will inform Customer if an instruction appears to violate applicable data-protection law and may suspend that instruction while the parties resolve it.

PET will ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations and will maintain reasonable administrative, technical, and organizational safeguards appropriate to risk. These include access controls, secure authentication, transport encryption where supported, password hashing, signed ticket credentials, role restrictions, logging, backup practices, vulnerability and patch management, and incident response. Customer remains responsible for its users, configurations, exports, devices, and data minimization.

Customer generally authorizes PET to use subprocessors needed to provide the Service, including hosting/infrastructure, database, email, SMS, payment, Wallet, logging, and support providers. PET will require subprocessors to protect Customer Personal Data under obligations appropriate to their services. PET will maintain a current subprocessor list in the Legal Center before general public launch and will provide reasonable notice of material new subprocessors when required. Customer may object on reasonable data-protection grounds; the parties will seek a practical solution, which may include discontinuing the affected feature.

Taking into account the nature of processing, PET will provide reasonable assistance for verified requests to access, correct, delete, restrict, object, or port Customer Personal Data. If PET receives a request that clearly concerns Customer-controlled data, PET may direct the requester to Customer and notify Customer where permitted. Customer is responsible for responding and for determining whether an exception applies.

PET will notify Customer without undue delay after confirming a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Notice will include available information about the nature, likely consequences, affected data, and mitigation, and will be supplemented as information becomes available. Notification is not an admission of fault. Customer is responsible for regulatory or individual notices unless law assigns that duty to PET.

PET will provide information reasonably necessary to demonstrate compliance and reasonable assistance with risk assessments, consultations, and regulator inquiries, considering the nature of processing and information available to PET. Customer may request a written security summary or relevant independent report when available. If that is insufficient, Customer may conduct one reasonable audit per year through an independent, confidential auditor, with advance notice, during normal business hours, without accessing other customers’ data or disrupting operations. Customer bears its audit costs unless a material PET breach is found.

At termination or upon documented request, PET will delete or return Customer Personal Data, unless retention is required by law or reasonably necessary for payment, dispute, fraud, security, backup, or legal-claim records. Data retained for those limited purposes remains protected and is not used for unrelated purposes. Backups are deleted through normal rotation rather than immediate selective deletion.

Customer acknowledges processing may occur in the United States and other locations used by PET’s providers. If restricted-transfer safeguards are required, the parties will cooperate in good faith to execute the applicable standard contractual clauses or another lawful mechanism. This DPA does not itself certify PET under a transfer framework or replace safeguards that must be separately executed.

This DPA controls over conflicting data-processing terms in the Agreement. The Agreement’s limitation of liability applies to this DPA to the maximum extent permitted by law. Customer’s acceptance of the Organizer Agreement also constitutes acceptance of this DPA. Privacy questions may be sent to hello@privateeventtickets.com.