Annex C, Appendix 1A — Record of Processing Vepino
Which personal data Vepino processes and for what purpose.
Introduction
Appendix to the Data Processing Agreement Human Syntax AB
This Appendix specifies the personal data processing that the Supplier performs as a processor on behalf of the Customer in the Vepino service, in accordance with §3 of the Data Processing Agreement (Annex C).
1Subject matter
Provision of Vepino — a platform for event management with related communication to participants via email and SMS, as well as newsletters to the Customer’s recipient lists. Includes registration, participant management, check-in and badge printing via connected equipment.
2Nature of processing
The processing comprises collection, recording, storage, organisation, use, disclosure by transmission (in email campaigns), structuring and erasure of personal data. Processing takes place both via the Service’s interface and via automated processes (e.g. campaign delivery).
3Purpose of processing
- Enable the Customer’s sending of email and SMS to recipients defined by the Customer
- Enable registration, management and follow-up of events organised by the Customer
- Enable check-in of participants via mobile application and badge printing via connected equipment
- Enable tracking of campaign engagement (delivery, opens, clicks, bounces, unsubscribes) and reporting to the Customer
- Enable invoicing and payment handling for paid events
- Security, troubleshooting and operation of the Service
4Duration
Processing continues for as long as the Agreement is in force. Upon termination of the Agreement, the Customer has a 30-day read and export period. Total erasure of Personal Data takes place within 90 days of termination of the Agreement, except for statutorily required retention and the backup rotation schedule (see §14 of the Data Processing Agreement).
5Categories of data subjects
| Category | Description |
|---|---|
| Invitees and participants | Persons whom the Customer invites to events or sends campaigns to |
| Visitors to registration pages | Persons who visit or begin registration on the Customer’s registration pages without completing registration |
| Users at the Customer | Employees or representatives of the Customer with an account in the Service |
| Contact persons at the Customer | Representatives of the Customer who handle contract and billing matters |
6Types of personal data
6.1Standard data (ordinary personal data, Article 6 GDPR)
| Field | Use |
|---|---|
| Name | Identification of participants and users |
| Email address | Campaign recipient, account identification, communication |
| Mobile number | Contact when needed, SMS reminders, check-in codes, possibly urgent information during events |
| Company name | Professional context for participants |
| Role/title | Professional context for participants |
| User ID and login data | Operation of the Service |
| Log data (IP address, browser and operating system, timestamps, referrers) | Security, troubleshooting, operation of the Service |
| Engagement data per campaign (opens, clicks, bounces, unsubscribes, delivery status) | Measurement of campaign performance and reporting to the Customer |
6.2Financial data (ordinary personal data, Article 6 GDPR)
| Field | Use |
|---|---|
| Billing information for the Customer’s own invoicing | Collection and export to the Customer for the Customer’s invoice handling at paid events |
| Swish payment confirmation (reference number, amount paid, timestamp) | Verification of payment for paid events via Swish |
Credit card details are not processed directly in the Service but are handled by a payment service provider (where applicable).
6.3Custom fields (may contain special categories)
The Service allows the Customer to create custom fields for participant registration. These may contain special categories of personal data under Article 9 GDPR depending on the Customer’s choice. Depending on the nature of the event, this may include data on health, religion or belief, political opinions, sexual orientation or gender identity, biometric data, or other data covered by Article 9. Commonly occurring:
| Field | Category | Note |
|---|---|---|
| Food allergies, dietary preferences | Health (Article 9) | Common at events with catering |
| Disabilities, accessibility needs | Health (Article 9) | When adjustments are needed |
Other custom fields may consist of non-sensitive data, for example golf handicap, T-shirt size, hotel preferences, conference track selection, information about accompanying persons or other requests.
Customer’s responsibility: When processing special categories, the Customer is responsible for obtaining explicit consent from Data Subjects in accordance with Article 9(2)(a) or another applicable basis, and for providing correct information in accordance with Articles 13–14 GDPR. Note that explicit consent under Article 9(2)(a) requires an active action by the Data Subject — a pre-ticked box or consent included in general terms acceptance is not sufficient.
7Legal basis
Vepino requires the Customer to specify the legal basis for processing of participant data, selected among:
- Contract (Article 6(1)(b)) — when processing is necessary for performance of a contract with the Data Subject, e.g. event registration.
- Consent (Article 6(1)(a)) — when the Customer wishes to process based on consent, and always as a complement for data in special categories (Article 9(2)(a)).
- Legitimate interests (Article 6(1)(f)) — when the Customer has carried out a balancing of interests. The Customer is responsible for ensuring the balancing test is documented.
The Customer is responsible for the chosen basis being correct and for fulfilling any formal requirements (consent documentation, balancing of interests, information to Data Subjects, etc.).