PLEN
Plan an event

Data processing agreement

Draft of 25 October 2026. Annex 1 to the Terms of service.

This is a translation. In case of discrepancies, the Polish version prevails.

§ 1. Parties and conclusion

  1. This agreement is concluded between the Customer as the controller of Guests’ data and Substancja Wiążąca sp. z o.o., with its registered office in Warsaw, ul. Chmielna 2 lok. 31, 00-020 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, 12th Commercial Division, under KRS number 0001261652, tax ID (NIP) 5253102845, REGON 545522297, share capital PLN 5,000 (the “Provider”) as the processor.
  2. The agreement is annex 1 to the Terms of service. The Customer concludes it by accepting the Terms when opening an account in the Application, in electronic form (Article 28(9) GDPR).
  3. The agreement applies for as long as the Application is used and until Guests’ data is deleted under § 9.
  4. Terms defined in the Terms of service (Customer, User, Guest, Application, Message) have the same meaning here. For Guests’ data, this agreement prevails over the Terms of service.

§ 2. Subject matter, nature and purpose of the processing

  1. The Customer entrusts the Provider with processing the personal data of Guests that Users enter into the Application or that Guests provide when replying to an invitation.
  2. The processing covers storing, organising, displaying to Users, sending Messages, collecting replies and deleting the data.
  3. The sole purpose is running the Customer’s events in the Application: the guest list, the event page, Messages, Guests’ replies and the agenda.

§ 3. Categories of data subjects and types of data

  1. Data subjects: Guests, including the Customer’s employees, contractors, clients and business partners, as well as companions and children.
  2. Types of data: first and last name, email address, phone number, company, job title, language, answers to the Customer’s questions, data of companions and children, the history of Messages and their delivery.
  3. Answers about diet and allergies may be data concerning health (Article 9 GDPR). The Customer decides whether to ask for them and is responsible for the legal basis for processing them.

§ 4. The Customer’s instructions

  1. The Provider processes Guests’ data only on the Customer’s documented instructions. The instructions are this agreement, the Terms of service and what Users do in the Application, including through an AI assistant connected to the connector.
  2. If an instruction infringes the GDPR or other data protection law, the Provider informs the Customer without delay and may suspend carrying it out.
  3. Without an instruction, the Provider processes the data only where Union or Polish law requires it, and informs the Customer before the processing unless that law prohibits it.

§ 5. The Provider’s obligations

  1. Only persons authorised by the Provider and bound by confidentiality have access to Guests’ data.
  2. The Provider applies the measures of Article 32 GDPR, in particular: encrypted connections (HTTPS), access to data only for authorised persons, random, hard-to-guess keys in Guests’ links, connector keys stored only as a hash, database backups. The Application and the database run on servers in Frankfurt.
  3. The Provider helps the Customer answer Guests’ requests (Articles 15–22 GDPR): through the Application’s tools (changing and exporting data, deleting a Guest entirely) and by forwarding to the Customer, without undue delay, any request that reaches the Provider.
  4. The Provider helps the Customer meet the obligations of Articles 32–36 GDPR, to the extent of the information available to it.
  5. The Provider notifies the Customer of a personal data breach concerning Guests without undue delay and no later than 48 hours after becoming aware of it, to the email address of the Customer’s account. The notification contains the information of Article 33(3) GDPR known at the time; the Provider sends the rest when it becomes known.

§ 6. Sub-processors

  1. The Customer gives the Provider general authorisation to engage sub-processors (Article 28(2) GDPR). The current list is in § 11.
  2. The Provider informs the Customer of an intended addition or replacement of a sub-processor before that sub-processor starts processing Guests’ data, by updating the list in § 11 and sending a message to the email address of the Customer’s account. The change needs neither the Customer’s consent nor a waiting period.
  3. The Customer may object to a change by writing to kontakt@gluu.events. If the Provider does not accommodate the objection, the Customer may terminate the Terms of service and this agreement with immediate effect; Guests’ data is then deleted under § 9.
  4. The Provider imposes on each sub-processor data protection obligations no weaker than those in this agreement (Article 28(4) GDPR) and remains liable to the Customer for their performance.
  5. An AI assistant that the Customer connects to the Application’s connector (e.g. ChatGPT, Claude) acts on the Customer’s instructions. Its provider is not the Provider’s sub-processor: the Customer makes the data the assistant retrieves available to it.

§ 7. Transfers outside the European Economic Area

The sub-processors listed in § 11 are based in the USA. Transfers rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.

§ 8. Information and audits

  1. At the Customer’s request, the Provider makes available the information needed to demonstrate compliance with Article 28 GDPR: a description of the security measures, the list of sub-processors and answers to the Customer’s questions, within 30 days.
  2. An audit, including an inspection, may take place when:
    1. the information under para. 1 is not sufficient to demonstrate compliance with this agreement,
    2. a personal data breach has affected the Customer’s Guests’ data, or
    3. a supervisory authority requires it.
  3. The audit is carried out by the Customer or by an independent auditor who is not a competitor of the Provider and is bound by confidentiality. The Customer announces it at least 30 days in advance; after a breach or at a supervisory authority’s request, with reasonable notice.
  4. The audit is remote first (documents, interviews), on business days, and no more than once in 12 months unless it concerns a breach or an authority’s request. The Customer bears the costs of the audit.
  5. The audit does not cover other customers’ data or the sub-processors’ systems; for these, the Provider makes available their reports and certifications where it has them.

§ 9. End of the processing

  1. Before deleting the account, the Customer may export the guest list from the Application.
  2. After the account is deleted or this agreement is terminated, the Provider deletes Guests’ data within 30 days unless the law requires it to be kept. Data in database backups expires with them, no later than 30 days after deletion from the database.

§ 10. Liability

Liability towards Guests for damage caused by the processing is governed by Article 82 GDPR. Otherwise, the parties’ liability is governed by § 8 of the Terms of service.

§ 11. List of sub-processors

As of 25 October 2026:

  • Vercel Inc. (USA): hosting of the Application and event pages. Servers in Frankfurt.
  • Neon Inc. (USA): database. Data stored in Frankfurt.
  • ActiveCampaign, LLC, Postmark service (USA): sending Messages to Guests.