Data Processing Addendum

Data Processing Addendum Effective Date: September 29, 2026 This Data Processing Addendum ("DPA") forms part of the Terms of Service between E Labs Ventures Ltd ("Reggiee", "we") and the organiser using Reggiee ("you"). It applies whenever we process personal data on your behalf while providing the Platform, and it meets the requirements of Article 28 of the UK GDPR and the EU GDPR. 1. Roles For personal data about your registrants, attendees, contacts, fans and other people you add or collect through Reggiee ("Customer Personal Data"), you are the controller and Reggiee is your processor. For data about you as our customer and about visitors to Reggiee's own website, Reggiee is the controller and our Privacy Policy applies. 2. What we process Subject matter and duration: providing the Platform for as long as your account is active, plus the deletion period in section 9. Nature and purpose: hosting, storing, organising and sending Customer Personal Data (including through email, SMS, WhatsApp, webhooks and connected tools) so you can run events, registrations and marketing. Types of data: names, email addresses, phone numbers, dates of birth or ages, gender, location, answers to custom questions, consent records, message and engagement history, and technical data such as IP address and browser. People: your registrants, attendees, contacts, subscribers and fans. 3. Our duties We will process Customer Personal Data only on your documented instructions, which are these Terms, this DPA and your use of the Platform's features, unless the law requires otherwise (in which case we will tell you first if the law allows). We make sure people authorised to process it are bound by confidentiality. We apply the security measures on our Security page. We help you respond to requests from individuals. The Platform includes tools to export and erase a contact's data. If we receive a request directly we will forward it to you rather than answer it ourselves. We help you meet your obligations on security, breach notification, impact assessments and consulting regulators, taking into account the information we hold. We tell you without undue delay, and within 48 hours of confirming it, if we become aware of a personal data breach affecting Customer Personal Data. We make available the information needed to show we comply with this DPA and allow reasonable audits, once a year unless there has been a breach or a regulator requires more, on 30 days' written notice, during working hours and at your cost. 4. Subprocessors You give general authorisation for the subprocessors listed on our Subprocessors page. We will give 30 days' notice of additions or replacements. We impose data protection terms on them that are no less protective than this DPA and remain responsible for their performance. 5. International transfers We handle transfers as described on our International Data Transfers page and will use an approved transfer mechanism where personal data leaves the UK or EEA. 6. Your responsibilities You confirm that you have a lawful basis, and where needed valid consent, for the personal data you collect or upload and for the messages you send. You will honour opt-outs and legal minimum age rules for your events, keep your contact lists accurate, and not upload data you are not allowed to use. You are responsible for reading and accepting the risk notice before using any unofficial WhatsApp connection, and for the special-category data you choose to collect in custom questions. 7. Individuals' rights and requests You stay responsible for answering individuals. Use the export and erasure tools in each contact record, or contact us if you need help. 8. US privacy laws Where US state privacy laws such as the CCPA apply, Reggiee acts as your service provider or processor. We will not sell or share Customer Personal Data, keep it or use it outside our direct business relationship with you, or combine it with other data, except as those laws allow. 9. Return and deletion When your account or a brand is deleted we delete its Customer Personal Data promptly. Encrypted backups are overwritten within 35 days. You can export your data before you delete it. We may keep a minimal suppression record so we can honour opt-outs, and data we must keep by law. 10. Liability and law Liability under this DPA is subject to the limits in the Terms of Service. This DPA is governed by the law that governs the Terms. 11. Contact E Labs Ventures Ltd, 128 City Road, London, EC1V 2NX. Email hello@reggi.ee.