Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Event Organiser Terms & Conditions between Ticket Monkey Ltd and the event organiser (“you”). It governs our processing of personal data relating to ticket sales for your events, and applies where you act as Controller and Ticket Monkey acts as Processor.

1. Roles of the parties

For Personal Data relating to ticket sales for your Events, you are the Controller and Ticket Monkey is the Processor. For our own purposes — operating and securing the Platform, fraud prevention, charging Booking Fees, and our own marketing — Ticket Monkey is an independent Controller, and that processing is governed by our Privacy Policy rather than this DPA. Each party will comply with its obligations under UK Data Protection Law.

2. Scope and instructions

Ticket Monkey will process Controller Personal Data only on your documented instructions, including those set out in the Event Organiser Terms, this DPA and your use of the Platform’s configuration options, unless required to do otherwise by law (in which case we will tell you first, where legally permitted). The subject matter, duration, nature and purpose of the processing, and the types of Personal Data and categories of Data Subjects, are set out in Annex 1. You warrant that you have a lawful basis for the processing and that your instructions comply with UK Data Protection Law. We will inform you if, in our opinion, an instruction infringes UK Data Protection Law.

3. Confidentiality

Ticket Monkey ensures that people authorised to process Controller Personal Data are bound by appropriate obligations of confidentiality and process the data only as necessary to provide the services.

4. Security measures

Taking account of the state of the art, costs, and the nature, scope, context and purposes of processing, Ticket Monkey implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex 2. We keep these measures under review.

5. Sub-processors

You give general authorisation for Ticket Monkey to engage sub-processors to process Controller Personal Data. Our current sub-processors are listed in Annex 3. We will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance. We will give you at least 30 days’ notice (for example by updating Annex 3 or notifying your administrator) before adding or replacing a sub-processor, and you may object on reasonable data protection grounds; if we cannot resolve your objection, you may terminate the affected service.

6. Assisting you with data subject rights

Taking account of the nature of the processing, Ticket Monkey will assist you by appropriate technical and organisational measures, so far as possible, to respond to requests from Data Subjects exercising their rights under UK Data Protection Law. If we receive such a request directly, we will, where lawful, direct the Data Subject to you or forward it to you promptly.

7. Assisting you with security, breaches and impact assessments

Ticket Monkey will provide reasonable assistance to help you comply with your obligations regarding security of processing, notification of Personal Data Breaches, communication of breaches to Data Subjects, data protection impact assessments, and prior consultation with the ICO, taking into account the nature of the processing and the information available to us.

8. Personal data breaches

Ticket Monkey will notify you without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data, and will provide information reasonably available to us to help you meet your breach-reporting obligations.

9. International transfers

Ticket Monkey will not transfer Controller Personal Data outside the UK without putting in place a valid transfer mechanism under UK Data Protection Law — such as a UK adequacy decision, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses — together with any supplementary measures required.

10. Return and deletion of data

On termination of the services, and at your choice, Ticket Monkey will delete or return Controller Personal Data and delete existing copies, unless UK law requires storage. We may retain data to the extent, and for the period, required by law (for example for tax, accounting or dispute-handling purposes), during which we will continue to protect it.

11. Audits and information

Ticket Monkey will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Audits will be on reasonable prior notice, no more than once a year (unless required by a regulator or following a Personal Data Breach), during business hours, and subject to confidentiality. We may satisfy audit requests by providing relevant certifications or third-party audit reports where available.

12. Liability

Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Event Organiser Terms.

13. General

This DPA is governed by the law of England and Wales. If there is a conflict between this DPA and the Event Organiser Terms on data protection matters, this DPA prevails. If any provision is found unenforceable, the rest continues in force.

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures

Ticket Monkey maintains measures including: encryption of Personal Data in transit; access controls and role-based permissions; secure authentication for platform access; network and infrastructure security with a reputable cloud provider; segregation and protection of payment data via a PCI-DSS compliant payment processor; logging and monitoring; regular patching and secure development practices; staff confidentiality obligations and security awareness; data backup and resilience; and incident-response procedures. These measures are reviewed and updated to maintain a level of security appropriate to the risk.

Annex 3 — Approved sub-processors

This list may be updated in line with section 5. The current list is available on request.