Data Processing Agreement (DPA)

1. Parties and roles

This DPA applies between the Organizer (as data controller) and Embedbook (as data processor) where applicable under GDPR/UK GDPR, for Attendee personal data processed through the Service.

2. Organizer disclosure for embedded widgets

By embedding or sharing the Widget, the Organizer commits to informing Attendees that personal data entered on the Organizer’s website is transferred to and processed on Embedbook.com for the purpose of providing booking and communication features.

3. Processing details (Annex)

• Subject-matter: managing bookings and confirmations for events.
• Duration: for the term of the Organizer’s account, plus lawful retention periods.
• Categories of data: name, email, phone, message, player count, and operational metadata.
• Data subjects: Attendees and Organizer account users.

4. Sub-processors

Current sub-processors may include Supabase (database/auth), Resend (email delivery), Stripe (payments), and hosting providers. We will ensure appropriate contractual safeguards where required.

5. Reference documents

This DPA is incorporated into the Terms of Service and should be read together with the Privacy Policy.