Data Processing Agreement

1. Subject and duration

We process personal data only to provide FestivalOS during your access period and for the deletion period after it.

2. Data and people concerned

• People: artists, teachers, DJs, technicians, media and event team members, staff and other people the Controller adds.
• Data: names, contact details, nationality, passport/ID details and copies, travel and accommodation details, contracts, photos, schedules, payment and fee information, and notes.
• Special categories: the Service is not designed for health or other special-category data; the Controller should not upload it unless strictly necessary and lawful.

3. Our obligations

• Process data only on your documented instructions, which are given through your use of the Service and these terms.
• Ensure everyone with access is bound by confidentiality.
• Apply appropriate technical and organizational measures, including role-based access, separation between organizers, logging of sensitive document access, watermarked previews and automatic deletion of sensitive documents 30 days after the event end date.
• Help you respond to data subject requests and with security, breach notification and impact assessments, as far as reasonable.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data.
• Make available the information needed to show compliance with this DPA and allow reasonable audits, on 30 days’ notice and at your cost.

4. Sub-processors

You authorize the following sub-processors:

• Lovable — hosting, database, authentication, file storage and transactional email.
• Google Workspace — business email correspondence.

We will inform you at least 30 days before adding or replacing a sub-processor; you may object on reasonable grounds and, if we can’t resolve it, end the affected package with a pro-rata refund. We impose data protection terms on sub-processors equivalent to this DPA.

5. International transfers

Where data is transferred outside the EEA, we ensure a valid GDPR transfer mechanism, such as an adequacy decision or Standard Contractual Clauses.

6. End of processing

At the end of the access period you can export your data. We then delete it within a reasonable time, unless EU or Greek law requires us to keep it.

7. Your obligations

You are responsible for having a lawful basis for the data you upload, informing artists and staff, and managing team access in the app.

8. Signed copy

Need a countersigned copy for your records? Email info@latinario.com.