Enterprise Data Processing Agreement

1. Purpose of this DPA

This Data Processing Agreement governs the processing of personal data by WoWYou Concepts Ltd on behalf of the Customer in connection with the Customer's use of the WoWYou EventTech / EventOS platform.

EventOS may be used for event planning, registration, ticketing, digital passes, QR check-in, attendee engagement, networking, analytics, AI-assisted event workflows, sponsor and vendor management, communications and related platform services.

This DPA applies where WoWYou Concepts Ltd processes personal data as a processor on behalf of the Customer.

Where WoWYou Concepts Ltd determines the purposes and means of processing, including for its own account administration, billing, security, platform improvement, marketing or legal compliance, WoWYou Concepts Ltd acts as an independent controller and that processing is governed by the EventOS Privacy Policy.

2. Definitions

Applicable Data Protection Laws means all laws and regulations relating to the protection of personal data that apply to the processing, including where applicable the EU General Data Protection Regulation 2016/679, Irish data protection law, UK GDPR and Data Protection Act 2018, ePrivacy and cookie rules, and applicable African data protection laws in countries where EventOS operates or serves users.

Controller, Processor, Personal Data, Processing, Data Subject, Personal Data Breach, Special Category Data and Sub-processor have the meanings given under Applicable Data Protection Laws.

Customer Data means personal data processed by WoWYou Concepts Ltd on behalf of the Customer through EventOS.

Services means the EventOS platform and related services provided by WoWYou Concepts Ltd.

3. Roles of the Parties

The Customer is the Controller of Customer Data and determines the purpose and lawful basis for collecting and using personal data through EventOS.

WoWYou Concepts Ltd is the Processor of Customer Data and processes such data only on documented instructions from the Customer, except where required by law.

The Customer remains responsible for:

• Providing any required privacy notices to data subjects.
• Identifying and documenting lawful bases for processing.
• Obtaining consents where required.
• Ensuring event registration forms are lawful and proportionate.
• Ensuring special category data is only collected where legally justified.
• Responding to data subject rights requests where the Customer is the controller.
• Complying with local event, employment, consumer, accessibility, safeguarding, marketing and data protection laws.

4. Customer Instructions

The Customer instructs WoWYou Concepts Ltd to process Customer Data only as necessary to provide and operate the Services.

WoWYou Concepts Ltd will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws, unless prohibited from doing so by law.

• Provide, operate, maintain and support EventOS.
• Manage registrations, ticketing, check-in and event workflows.
• Send event-related communications.
• Generate analytics and reports for the Customer.
• Enable attendee engagement and networking features.
• Provide AI-assisted features where enabled.
• Support security, fraud prevention, troubleshooting and service improvement.
• Comply with the Customer's documented instructions.
• Comply with legal obligations applicable to the Processor.

5. Description of Processing

The subject matter, duration, nature, purposes, categories of data subjects and categories of personal data processed under this DPA are described in Schedule 1.

6. Confidentiality

WoWYou Concepts Ltd will ensure that persons authorised to process Customer Data are subject to appropriate confidentiality obligations.

Access to Customer Data will be limited to personnel, contractors and authorised Sub-processors who need access for the purpose of providing the Services.

7. Security Measures

WoWYou Concepts Ltd will implement appropriate technical and organisational measures to protect Customer Data against unauthorised or unlawful processing, accidental loss, destruction, damage, alteration or disclosure.

These measures may include:

• Access controls.
• Password and authentication controls.
• Role-based permissions.
• Encryption in transit and, where appropriate, at rest.
• Secure hosting.
• Logging and monitoring.
• Backup and recovery controls.
• Vulnerability management.
• Secure software development practices.
• Incident response procedures.
• Staff confidentiality controls.
• Supplier due diligence.
• Data minimisation and retention controls.

8. Personal Data Breach

WoWYou Concepts Ltd will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data.

The notification will include, where available:

WoWYou Concepts Ltd will provide reasonable assistance to the Customer in meeting applicable breach notification obligations.

The Customer remains responsible for determining whether to notify a supervisory authority or affected data subjects unless WoWYou Concepts Ltd is legally required to do so.

• A description of the nature of the breach.
• Categories and approximate number of affected data subjects.
• Categories and approximate number of affected records.
• Likely consequences.
• Measures taken or proposed to address the incident.
• Contact details for follow-up.

9. Data Subject Rights

WoWYou Concepts Ltd will provide reasonable assistance to the Customer to respond to data subject rights requests, including requests for:

If WoWYou Concepts Ltd receives a request directly from a data subject relating to Customer Data, WoWYou Concepts Ltd will, where appropriate, forward the request to the Customer or advise the requester to contact the Customer directly.

WoWYou Concepts Ltd will not respond to such requests on behalf of the Customer unless instructed or legally required.

• Access.
• Rectification.
• Erasure.
• Restriction.
• Objection.
• Portability.
• Withdrawal of consent, where applicable.

10. Sub-processors

The Customer authorises WoWYou Concepts Ltd to engage Sub-processors to provide the Services.

WoWYou Concepts Ltd will ensure that Sub-processors are bound by written obligations that provide an appropriate level of protection for Customer Data.

WoWYou Concepts Ltd will maintain a current Sub-processor List through the published EventOS Sub-processors page.

WoWYou Concepts Ltd will provide reasonable notice of material changes to Sub-processors where required by law or contract.

The Customer may object to a new Sub-processor on reasonable data protection grounds. If the Customer objects, the Parties will work in good faith to resolve the concern. Where resolution is not possible, the Customer may stop using the affected Services.

11. International Transfers

WoWYou Concepts Ltd will aim to process and store Customer Data within the EU/EEA, UK or other appropriate jurisdictions where practical.

Where Customer Data is transferred outside the EU/EEA, UK or another jurisdiction with transfer restrictions, WoWYou Concepts Ltd will ensure that appropriate safeguards are in place.

Such safeguards may include:

Further transfer provisions are described in Schedule 4.

• An adequacy decision.
• EU Standard Contractual Clauses.
• UK International Data Transfer Agreement.
• UK Addendum to the EU Standard Contractual Clauses.
• Equivalent local transfer mechanisms.
• Transfer risk assessments where required.
• Appropriate technical and organisational safeguards.

12. Special Category Data

EventOS is not designed to require Special Category Data by default.

The Customer must not use EventOS to collect Special Category Data unless it has identified a lawful basis and, where required, a special condition for processing, provided clear notices to data subjects, obtained explicit consent where required, configured EventOS appropriately and informed WoWYou Concepts Ltd where additional safeguards are required.

Examples may include accessibility requirements, dietary requirements, religious preferences, health-related access needs or similar information.

Device-native biometric login, such as Face ID, Touch ID or Android biometric authentication, does not mean EventOS collects or stores biometric templates where authentication remains handled by the user's device operating system.

13. AI-Assisted Processing

Where the Customer enables AI-assisted features within EventOS, WoWYou Concepts Ltd may process Customer Data to provide features such as event planning support, attendee recommendations, networking suggestions, analytics, reporting, content generation or workflow automation.

WoWYou Concepts Ltd will not use Customer Data to train general-purpose AI models unless expressly agreed with the Customer.

The Customer remains responsible for reviewing AI outputs before relying on them and for ensuring AI-assisted features are not used unlawfully, unfairly or discriminatorily.

WoWYou Concepts Ltd will implement reasonable safeguards for AI-assisted features, including transparency, human oversight, security controls and monitoring for accuracy and potential misuse.

14. Assistance with Compliance

Taking into account the nature of processing and information available to WoWYou Concepts Ltd, WoWYou Concepts Ltd will provide reasonable assistance to the Customer with:

The Customer remains responsible for its own compliance decisions and regulatory filings.

• Data protection impact assessments.
• Security assessments.
• Breach response.
• Data subject requests.
• Regulatory queries.
• Audits and compliance documentation.
• Records of processing where relevant.

15. Audit and Information Rights

WoWYou Concepts Ltd will make available reasonable information necessary to demonstrate compliance with this DPA.

Where required by Applicable Data Protection Laws, the Customer may request an audit of WoWYou Concepts Ltd's processing of Customer Data.

Audits must be reasonable in scope, subject to confidentiality, limited to once per year unless required by law or following a material breach, conducted with reasonable notice, and conducted in a way that does not compromise the security, confidentiality or availability of EventOS or other customers' data.

WoWYou Concepts Ltd may satisfy audit requests through security documentation, certifications, policies, questionnaires, third-party reports or other reasonable evidence.

16. Data Return and Deletion

At the end of the Services, or upon written request, WoWYou Concepts Ltd will delete or return Customer Data unless retention is required by law.

The Customer may export data from EventOS where export functionality is available.

WoWYou Concepts Ltd may retain limited records where necessary for:

Where data is retained, it will remain protected under this DPA and Applicable Data Protection Laws.

• Legal compliance.
• Tax and accounting obligations.
• Dispute resolution.
• Security logs.
• Fraud prevention.
• Backup integrity.
• Enforcement of agreements.

17. Customer Responsibilities

The Customer confirms that:

• It has the legal right to provide Customer Data to WoWYou Concepts Ltd.
• It has provided appropriate privacy notices.
• It has identified a lawful basis for processing.
• It will not upload unlawful, excessive or unnecessary personal data.
• It will configure EventOS in a privacy-conscious manner.
• It will not collect children's data, Special Category Data or Criminal Offence Data unless legally permitted and properly safeguarded.
• It will ensure authorised users are trained and permitted to access Customer Data.
• It will comply with applicable marketing, cookie, consumer protection and event laws.

18. Children and Vulnerable Individuals

EventOS is not intended by default for the processing of children's data or data relating to vulnerable individuals.

If the Customer uses EventOS for events involving children, minors or vulnerable persons, the Customer is responsible for:

WoWYou Concepts Ltd may require additional safeguards or refuse processing where the risk is inappropriate.

• Obtaining parental or guardian consent where required.
• Implementing safeguarding procedures.
• Limiting data collection.
• Applying appropriate access restrictions.
• Complying with applicable child protection and data protection laws.

19. African Market Compliance

Where EventOS is used in African countries, the Customer is responsible for complying with applicable local data protection, consumer protection, marketing, event and sector-specific laws applicable to its activities.

WoWYou Concepts Ltd will take reasonable steps to support compliance with applicable African data protection laws where it operates or directly serves users in those markets.

Where local law requires additional terms, local hosting, regulatory registration, data transfer mechanisms or specific notices, the Parties will cooperate in good faith to implement them.

20. Liability

Liability under this DPA is subject to the limitation of liability provisions in the main agreement between the Parties, except where liability cannot be limited under applicable law.

Nothing in this DPA excludes or limits liability for fraud, wilful misconduct, death or personal injury caused by negligence, or any liability that cannot legally be excluded.

21. Conflict

If there is a conflict between this DPA and the main agreement, this DPA will prevail in relation to personal data processing matters.

If Standard Contractual Clauses or other mandatory transfer terms apply, those terms will prevail to the extent required by law.

22. Term

This DPA remains in effect for as long as WoWYou Concepts Ltd processes Customer Data on behalf of the Customer.

Obligations relating to confidentiality, security, deletion, audit, liability and data protection will survive termination where necessary.

23. Governing Law

Unless otherwise stated in the main agreement, this DPA is governed by the laws of Ireland.

Where UK GDPR applies, the relevant UK data protection provisions will apply to UK personal data.

Where local African data protection laws apply, the Parties will comply with those laws to the extent applicable.

24. Contact

Processor: WoWYou Concepts Ltd

Platform: WoWYou EventTech / EventOS

Privacy Contact: enquiries@wowyouconcepts.com

Registered Address: Michael Galvin (MG) Building, B.A.S.E Enterprise Centre, Ladyswell Road, D15 NX4W, Damastown, Mulhuddart, Ireland.

Schedule 1 — Details of Processing

Subject Matter: Provision of the EventOS platform and related services for event planning, registration, ticketing, check-in, attendee engagement, analytics, AI-assisted features, communications, vendor and sponsor management and event operations.

Duration: For the term of the Customer's use of EventOS and any additional retention period required by law, contract, backup integrity, dispute resolution or Customer instructions.

Nature and Purpose of Processing: WoWYou Concepts Ltd processes Customer Data to provide EventOS services, including account setup and user management, attendee registration, ticketing and digital pass creation, QR code generation and validation, secure check-in, event communications, networking and engagement tools, AI-assisted recommendations and automation, analytics and reporting, customer support, security monitoring, troubleshooting, payment status and invoice support, and event workflow management.

Primary Processing Location: EU/EEA and/or UK where practical. Additional locations may apply depending on hosting, support, Sub-processors and Customer configuration, subject to appropriate transfer safeguards.

• Event attendees.
• Event organisers.
• Customer staff and administrators.
• Speakers.
• Panellists.
• Sponsors.
• Exhibitors.
• Vendors.
• Venue representatives.
• Volunteers.
• Guests.
• Media representatives.
• Support users.
• Prospective attendees.
• Marketplace users.

Schedule 1 — Categories of Personal Data

Special Category Data is not required by default. It may only be processed if the Customer chooses to collect it and has a lawful basis and appropriate safeguards.

Criminal Offence Data is not processed by default. The Customer must not upload Criminal Offence Data unless expressly agreed in writing and legally permitted.

• Name.
• Email address.
• Phone number.
• Organisation.
• Job title.
• Profile photo, where uploaded.
• Event registration details.
• Ticket type.
• Attendance status.
• QR code or digital pass ID.
• Check-in time.
• Session choices.
• Networking preferences.
• Interests and profile information.
• Communications and messages.
• Survey responses.
• Feedback.
• Payment status and transaction reference.
• Billing details.
• Support requests.
• IP address.
• Device and browser data.
• Usage logs.
• Security logs.
• AI prompts and outputs where AI features are used.
• Custom fields configured by the Customer.

Schedule 2 — Technical and Organisational Measures

WoWYou Concepts Ltd will maintain technical and organisational measures appropriate to the nature and risks of the processing and the maturity of the EventOS platform.

• Access Control: role-based permissions, unique user accounts, administrative access restrictions, access logging and periodic access review.
• Authentication: secure password requirements, multi-factor authentication where available, device-native biometric login support where enabled and session controls.
• Encryption: encryption in transit using secure protocols, encryption at rest where available and appropriate, and secure handling of authentication tokens and credentials.
• Secure Development: secure coding practices, code review where appropriate, vulnerability monitoring, patching and updates, and separation of development, testing and production environments where appropriate.
• Hosting and Infrastructure: reputable cloud hosting providers, backup and recovery controls, monitoring and availability controls and network security controls.
• Data Minimisation: configuration options to limit data collection, customer-controlled registration fields, deletion and export options where available and retention controls.
• Incident Response: internal breach escalation, breach investigation, containment and remediation measures and customer notification procedures.
• Personnel Controls: confidentiality obligations, access limited to authorised personnel and staff awareness of data protection responsibilities.
• Sub-processor Controls: supplier due diligence, written processor obligations, review of security and privacy terms and transfer safeguards where required.
• Business Continuity: backups, recovery procedures, availability monitoring and disaster recovery planning appropriate to platform maturity.

Schedule 3 — Approved Sub-processors

The current approved Sub-processors are maintained through the EventOS Sub-processor List.

WoWYou Concepts Ltd will keep that list updated when material Sub-processors are added, removed or replaced.

The Sub-processor List identifies the service category, purpose, relevant data processed, processing location or transfer safeguard and status of applicable providers.

Where an enterprise Customer requires a contractual Sub-processor schedule, the published list and the applicable contractual schedule should remain aligned.

Schedule 4 — International Transfer Terms

EU/EEA Data: Where Customer Data protected by EU GDPR is transferred outside the EU/EEA to a country without an adequacy decision, the Parties will rely on the EU Standard Contractual Clauses or another valid transfer mechanism.

UK Data: Where Customer Data protected by UK GDPR is transferred outside the UK to a country without adequacy regulations, the Parties will rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another valid UK transfer mechanism.

African Data: Where local African data protection laws apply, the Parties will implement any required transfer safeguards, notices, contracts, registrations, consents or regulatory approvals to the extent applicable.

Transfer Risk: Where required, WoWYou Concepts Ltd and the Customer will cooperate to assess transfer risks and implement supplementary measures such as encryption, access restrictions, data minimisation, contractual controls and supplier due diligence.