Data Processing Agreement

1. Purpose

This DPA governs the processing of personal data by ConnectApp on behalf of the Organizer in connection with the provision of event management and engagement services.

2. Roles of the Parties

The Organizer determines what personal data is collected, the purpose and duration of processing, and data retention requirements. ConnectApp processes personal data solely in accordance with the Organizer's documented instructions and applicable law.

3. Categories of Personal Data

• Names and email addresses
• Telephone numbers and professional affiliations
• User profiles and biographies
• Event registration information
• Abstract submissions
• Messaging and networking information
• Session attendance information
• Sponsor engagement information
• Analytics and usage information

4. Purpose of Processing

Personal data may only be processed for event administration, conference and programme management, networking and communication services, event analytics and reporting, technical support and troubleshooting, security and fraud prevention, and backup and disaster recovery.

5. Processor Obligations

ConnectApp shall:

• Process personal data only upon lawful instructions from the Organizer
• Maintain appropriate technical and organizational security measures
• Ensure confidentiality of personnel handling personal data
• Maintain appropriate access controls
• Implement reasonable safeguards against unauthorized access

6. Sub-processors

ConnectApp may engage reputable third-party service providers including cloud hosting providers, email delivery services, monitoring and analytics services, and backup service providers. All sub-processors are contractually obligated to maintain appropriate data protection standards.

7. Security Measures

• Encrypted communications
• Secure hosting environments
• Access controls and password protection
• Backup procedures
• Security monitoring and logging

8. Data Retention

Event-related data shall be retained only for as long as reasonably necessary to deliver the contracted services, facilitate data export to the Organizer, resolve disputes, and conduct support and audit activities. Following the applicable retention period, personal data shall be deleted from active systems.

9. Data Export and Deletion

Upon completion of the event, the Organizer may request an export of all available event data. ConnectApp shall provide such data in a commercially reasonable format. Data shall subsequently be deleted in accordance with contractual obligations.

10. Thirty-Day Audit Period

The Organizer shall have 30 calendar days following confirmation of data export or deletion to request audit reports, verification of exported data, or clarification of retained records. Following the expiration of the audit period, ConnectApp may permanently delete any remaining event-related records unless otherwise required by law.

11. Data Breach Notification

ConnectApp shall notify the Organizer without undue delay upon becoming aware of any personal data breach that materially affects Organizer data.

12. International Transfers

Where personal data is transferred across jurisdictions, ConnectApp shall implement commercially reasonable safeguards to comply with applicable data protection laws.

13. Termination

This DPA shall automatically terminate upon the expiration or termination of the Organizer Service Agreement and the completion of all data deletion obligations.