Legal

Data Processing Addendum

Last updated 27 October 2026

This Addendum forms part of the Wakebooked Terms of Service.

1. Roles. The Customer is the controller of Attendee Data; Wakebooked is the processor (a "service provider" under CCPA/CPRA and a "data processor" under India's DPDP Act).
2. Instructions. Wakebooked processes Attendee Data only to provide the Service and according to the Customer's documented instructions (the Terms and the Customer's settings), unless the law requires otherwise.
3. No sale or sharing. Wakebooked will not sell or share Attendee Data, or use it outside the direct business relationship with the Customer.
4. Confidentiality. Personnel with access are bound by confidentiality.
5. Security. Encryption in transit and at rest, per-customer access control, least-privilege keys, access logs kept 12 months, backups and timely patching.
6. Subprocessors. Listed on our Subprocessors page. We give 14 days' notice of new subprocessors; the Customer may object and terminate if we cannot resolve the objection.
7. Assistance. Wakebooked helps the Customer answer data-subject requests (export and deletion) and with impact assessments where reasonable.
8. Breach. Wakebooked notifies the Customer without undue delay (target: within 48 hours) after becoming aware of a personal-data breach affecting Attendee Data.
9. Transfers. Where GDPR or UK GDPR applies, the EU Standard Contractual Clauses (Module 2) and the UK Addendum are incorporated by reference.
10. Deletion. On termination, Wakebooked deletes Attendee Data within 60 days after the 30-day export window, unless the law requires retention.
11. Audit. Wakebooked provides information reasonably needed to demonstrate compliance, on 30 days' notice, at most once a year.