This Data Processing Agreement ("DPA") forms part of the Strobo Terms of Service between TOURINGTUNES Sp. z o.o. (the "Processor") and the Organizer (the "Controller") and is concluded by accepting the Terms during organizer onboarding. It implements Article 28 GDPR.
1. Subject matter and roles
The Processor processes personal data on behalf of the Controller to the extent the Controller uses Strobo to manage attendee and marketing data: guest lists, CRM contacts and their attributes, marketing opt-ins collected at checkout for the Controller, blast recipients, waitlist entries tied to the Controller's events, entry-scan records of the Controller's events, and — where advertising pixels are enabled for the Controller — the loading of the Controller's advertising pixels on its event pages, as set out in §3A.
For clarity, the following are outside this DPA (Processor acts as independent controller): platform account data, billing, security logs, aggregated product analytics — see the Strobo Privacy Policy.
2. Details of processing
- Duration: the term of the Organizer's use of Strobo, plus the deletion window in §7.
- Nature and purpose: hosting, storage, display, segmentation, export, and dispatch of communications initiated by the Controller; preparing entry lists for the Controller's door devices, including for offline use (the list is held on the door device used by the Controller's staff).
- Data subjects: the Controller's event attendees, ticket buyers, marketing contacts, guest-list entrants.
- Categories of data: name, email, phone, city, event attendance and ticket/order references, opt-in status and source, follower status, check-in timestamps, messages sent by the Controller and their recipients, and admission codes the Controller imports from another ticketing service (stored only as a one-way hash, with the holder name, ticket type and source label the Controller supplies). No special categories are intended; the Controller must not upload them.
- Advertising pixels (§3A): online identifiers and technical data that the vendor's script reads in the visitor's browser (cookie identifiers, IP address, user agent, page address), and the conversion events the platform emits (page view, checkout started, purchase with order value and currency). The Processor does not store this data; the visitor's browser transmits it directly to the vendor.
3. Controller instructions
The Processor processes such data only on documented instructions of the Controller, given through the platform's functions (import, export, blast, segment, delete) and this DPA, unless EU/member-state law requires otherwise (in which case the Processor informs the Controller unless prohibited).
3A. Advertising pixels
- Availability. Advertising pixels are available only to Controllers for whom the Processor has enabled the feature. The Processor may decline, suspend or withdraw it for one Controller or for all Controllers at any time — in particular for legal, security or consent-compliance reasons — without liability.
- Instruction. By entering a pixel identifier in the platform and enabling it, the Controller instructs the Processor to load that pixel on the Controller's public event, checkout and order-confirmation pages and to emit the conversion events listed in §2. Only the vendors listed in the Strobo Cookie Policy are supported; the Controller cannot add its own code, events or parameters.
- Consent. The Processor loads a Controller's pixels only after the visitor has given marketing consent for that Controller through the Strobo consent banner, keeps a record of that consent as described in the Strobo Cookie Policy, and stops loading the pixels once consent is withdrawn. Consent given for one Controller does not extend to any other Controller.
- The Controller's responsibilities. The Controller is the controller of the data its pixels send to the vendor and of any use of that data in its vendor account (audiences, targeting, retention). The Controller: (a) has accepted, and complies with, the vendor's own business terms for the pixel; (b) does not use the pixels to process special categories of data or to target minors; (c) handles data-subject requests concerning data held in its vendor account — the Processor forwards any such request it receives without undue delay.
- Vendors. Pixel vendors receive data under the Controller's own agreement with them and are not subprocessors of the Processor under §5.
- End of use. When the Controller disables a pixel or its account ends, the Processor stops loading the pixel and deletes its identifier. The Processor holds no pixel event data to return or delete under §7.
4. Confidentiality and security
Persons authorized to process the data are bound by confidentiality. Taking into account the state of the art, the Processor implements appropriate technical and organizational measures (Art. 32 GDPR), including: encryption in transit and at rest, row-level security isolating each Controller's data, role-based access (door staff see no financial or contact data), signed single-purpose access tokens, audit trails of entry scans, and least-privilege service credentials.
5. Subprocessors
The Controller grants general authorization to engage the subprocessors listed at /legal/subprocessors (currently: Stripe Payments Europe, Supabase, Vercel, Clerk, Resend, and their hosting providers). The Processor will announce changes to the list at least 14 days in advance; the Controller may object on reasonable data-protection grounds, in which case the parties will seek a solution or the Controller may terminate the affected service. Subprocessors are bound by data-protection obligations no less protective than this DPA. Transfers outside the EEA rely on adequacy decisions (including the EU–US Data Privacy Framework) or Standard Contractual Clauses. Advertising pixel vendors are not subprocessors — see §3A(5).
6. Assistance
The Processor assists the Controller, insofar as possible and taking into account the nature of processing: with data-subject requests (the platform provides search and export functions; correction and deletion are carried out by the Processor on the Controller's written request), and with obligations under Articles 32–36 GDPR (security, breach notification, DPIAs). The Processor notifies the Controller of a personal data breach affecting the Controller's data without undue delay after becoming aware of it, providing the information required by Article 33(3) GDPR as it becomes available.
7. Deletion and return
Upon termination of the Organizer's account, the Processor provides an export of the Controller's data on written request made within 30 days; thereafter the Processor deletes it, unless EU or Polish law requires further storage (e.g. accounting records). Backup copies are purged on backup rotation.
8. Audit
The Processor makes available information necessary to demonstrate compliance with Article 28 GDPR (including summaries of security measures and subprocessor agreements) and allows audits — in the first instance by written questionnaire; on-site audits no more than once per year, on 30 days' notice, at the Controller's cost, without access to other controllers' data.
9. Liability and final provisions
Liability follows Article 82 GDPR and the limitations of the Terms of Service to the extent permitted. Polish law governs. In case of conflict between this DPA and the Terms regarding personal data, the DPA prevails.