This Data Processing Agreement ("DPA") forms part of the Terms and Conditions and applies when you (the Customer) process personal data of your guests or other people in Passly and Passly processes it on your behalf. It complies with Article 28 of the GDPR and the UK GDPR and with the processor obligations set out in Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). It is accepted together with the Terms; you do not need to sign anything else.
1. Roles of the parties
The Customer is the controller of the Customer Data; Passly is its processor. If the Customer in turn acts as a processor for a third party (for example, an agency organizing its client's event), Passly is its sub-processor and the Customer warrants that its instructions are authorized by that third party.
This DPA does not cover data that Passly processes as a controller (accounts, payments, platform security), which is governed by the Privacy Notice.
2. Details of the processing (Annex I)
| Element | Description |
|---|---|
| Subject matter and nature | Hosting, storage, organization, consultation, presentation, transmission and erasure of data so that the Customer can create, publish and manage invitations and events. |
| Purpose | Providing the service described in the Terms, following the Customer's documented instructions (its configuration and use of the service). |
| Duration | For the term of the contract and until the data is erased according to the Retention Policy. |
| Data subjects | Guests and their companions, family members, event staff, event vendors and attendees who take part in the gallery or the event app. |
| Data | Identification and contact (name, phone number, email), participation (RSVP, companions, table, access), content (photos, comments, messages), technical data (encrypted IP fingerprint, invitation opens). |
| Sensitive data | Only if the Customer or the guest enters it: dietary restrictions and accessibility needs (possible health data), and data of minors. |
3. Passly's obligations
- Process the data only on the Customer's documented instructions, including with regard to transfers, unless required by law (in which case we will inform the Customer if the law allows). If we believe an instruction infringes the law, we will tell the Customer.
- Ensure that persons authorized to process the data are bound by confidentiality.
- Apply the security measures in Annex II (Security), appropriate to the risk (Art. 32 GDPR).
- Assist the Customer in responding to data subject requests: Passly forwards to the Customer every request it receives about the Customer's data and offers it tools to resolve it (look-up, correction, deletion, export).
- Assist the Customer with security, breach notification, impact assessments and prior consultations, taking into account the information available.
- Notify the Customer without undue delay (and where possible within 48 hours) of any security breach affecting its data, with the information available so that it can meet its obligations.
- On termination of the service, erase the data according to the Retention Policy, unless retention is required by law. The Customer can download it beforehand from Settings → Privacy and data (Ajustes → Privacidad y datos).
- Make available to the Customer the information necessary to demonstrate compliance and allow reasonable audits, upon request with 30 days' notice, under confidentiality, during business hours, once a year except in the event of a breach or a request from an authority, and at the Customer's expense where no non-compliance is found.
- Not use the Customer Data for its own purposes, not sell it and not use it to train artificial intelligence models.
4. Sub-processors
The Customer gives Passly general authorization to engage the sub-processors listed in Sub-processors. Passly imposes on them by contract data protection obligations equivalent to those in this DPA and is liable for their compliance.
We will give notice of any new sub-processor at least 30 days in advance via the Sub-processors page and an in-app notice. The Customer may object on reasonable data protection grounds; if we cannot find an alternative, the Customer may terminate the affected service and receive a refund of the unused portion.
5. International transfers
The data is hosted in the United States. Where the Customer is subject to the GDPR or the UK GDPR, transfers to Passly and from Passly to its sub-processors are governed by the European Commission's standard contractual clauses (Decision 2021/914; Module 2 controller-to-processor or Module 3 processor-to-processor, as applicable) and the UK addendum, which are incorporated by reference. In the event of any conflict, the standard clauses prevail.
6. Customer's obligations
The Customer warrants that it has a legal basis to process the data it enters, that it has informed the data subjects (Passly makes the Guest Notice available to it, linked in every invitation) and that it has the necessary consents for sensitive data and data of minors, as set out in the Terms.
7. Liability and precedence
Each party's liability is governed by the Terms and by applicable data protection law. In the event of a conflict between this DPA and the Terms on data protection matters, this DPA prevails.
If the Customer needs a signed version of this DPA, it can request one at [PENDIENTE: Correo de privacidad (p. ej. privacidad@wepassly.com)].
Version history
- v1.0 · October 1, 2026 · Material change — First published version.