1. Preamble
This Data Processing Agreement (the “DPA” or the “Agreement”) sets out the terms on which Jérémy BODIN, sole trader trading as ARLOAD, publisher of Evora and technical provider (“Evora” or the “Processor”), processes, on behalf of each organiser (the “Organiser” or the “Controller”), the personal data of platform users registered for that Organiser's events.
This DPA supplements and forms an integral part of the Terms of Use, the Terms of Sale and the Privacy Policy. Where they conflict on the processing of personal data, this DPA prevails.
Each Organiser must sign the DPA electronically before publishing their first event on the platform. Until then, any attempt to publish an event is blocked by the system.
2. Purpose of the agreement
Under this DPA, the Organiser, acting as controller within the meaning of article 4(7) GDPR, entrusts Evora, acting as processor within the meaning of article 4(8) GDPR, with the following processing operations on its registrants' personal data:
- Hosting and secure storage of the data;
- Making the data available to the Organiser through the dashboard;
- Sending push notifications and emails to registrants on the Organiser's behalf;
- Producing aggregated event statistics;
- Technical handling of registrations and payments;
- Fulfilling registrants' GDPR rights (access, export, erasure).
Evora undertakes to process this data only on the Organiser's documented instructions — signing up to the Service counts as a standing instruction for standard operations — and for the purposes set out in the Privacy Policy.
3. Categories of data processed
The categories of data Evora processes on the Organiser's behalf include:
- Registrant identity data: first name, last name, email address, profile picture and, where applicable, date of birth;
- Registration data: event identifier, registration date, attendance status and any additional information provided by the registrant;
- Payment data (for paid events): amount, Stripe status, transaction ID — the card number is never accessible to the Organiser;
- Communication data: messages exchanged through the Q&A feature and reactions to announcements.
Evora processes no special-category data within the meaning of article 9 GDPR (racial origin, political opinions, religion, health, sex life, biometrics and the like) on the Organiser's behalf, unless the Organiser has itself obtained separate explicit consent.
4. Categories of data subjects
The data subjects are:
- Registrants for an event published by the Organiser on the Evora platform;
- Visitors who interacted with the event page (favourites, sharing, Q&A) without registering.
5. Duration of the processing
This DPA takes effect when the Organiser signs it electronically and remains in force for as long as the Organiser holds an active Evora account.
When the Organiser account is terminated, Evora undertakes, on the Organiser's written instruction given within 30 days, to either:
- Return the data in a structured, commonly used, machine-readable format (ZIP export); or
- Permanently delete the data or irreversibly anonymise it.
Absent instructions within 30 days, Evora defaults to anonymisation. Statutory retention obligations (10 years for invoicing, and so on) still apply.
6. Evora's obligations (processor)
In accordance with article 28 GDPR, Evora undertakes to:
6.1 Processing on documented instructions
Process the data only on the Organiser's documented instructions, including for transfers outside the EU, unless required otherwise by law — in which case Evora informs the Organiser beforehand, unless the law prohibits it on important grounds of public interest.
6.2 Confidentiality
Ensure that everyone authorised to process the data (employees, contractors, sub-processors) is bound by a contractual or statutory duty of confidentiality.
6.3 Security
Implement the appropriate technical and organisational measures required by article 32 GDPR:
- TLS 1.3 encryption in transit, AES-256 at rest;
- Pseudonymisation wherever technically possible;
- PostgreSQL Row Level Security (RLS) on 100% of tables;
- bcrypt password hashing;
- Two-factor authentication available;
- Daily backups plus 7-day point-in-time recovery;
- Audit logs on every administrative action;
- Quarterly continuity and restore testing;
- Annual independent security audit.
6.4 Assistance to the Organiser
Help the Organiser meet its own GDPR obligations (responding to rights requests, impact assessments, breach notification, prior consultation with the supervisory authority where needed) by providing suitable tools in the dashboard and answering any request within 7 business days.
6.5 Documentation
Keep an up-to-date record of the processing activities carried out on the Organiser's behalf, available on request.
7. The Organiser's obligations (controller)
The Organiser undertakes to:
- Have a valid legal basis for every processing operation it carries out (consent, contract, legitimate interest and so on);
- Inform its registrants that Evora acts as processor and of this DPA;
- Not instruct Evora to carry out processing that breaches the GDPR or any other applicable rule;
- Answer its registrants' rights requests itself, Evora providing only the necessary technical assistance;
- Notify Evora without undue delay of any data breach it detects on its side.
8. Sub-processors
The Organiser authorises Evora to engage sub-processors to deliver the Service. The full, up-to-date list of sub-processors is published on the /legal/subprocessors page.
Evora undertakes to:
- Notify the Organiser 30 days before adding or replacing any sub-processor, by email and by publishing it on the dedicated page;
- Enter into a contract with each sub-processor imposing at least the same obligations as this DPA;
- Remain fully liable to the Organiser for its sub-processors' performance of their obligations.
Within 30 days of being notified of a new sub-processor, the Organiser may object on reasonable grounds. Failing an amicable agreement, the Organiser may terminate its subscription at no cost.
9. Personal data breach notification
In the event of a breach of personal data processed on the Organiser's behalf (within the meaning of article 4(12) GDPR), Evora undertakes to:
- Notify the Organiser within 24 hours of becoming aware of it, by email to the contact address on its account;
- Provide everything the Organiser needs to notify the supervisory authority within 72 hours (article 33 GDPR): the nature of the breach, the categories and number of data subjects, the likely consequences and the measures taken;
- Cooperate actively with any investigation carried out by the Organiser or by the authorities.
Evora's 24-hour deadline is deliberately shorter than the 72 hours the supervisory authority allows the Organiser, precisely so the Organiser can meet its own obligations.
10. Audit
At its own cost and with 30 days' written notice, the Organiser may request an annual audit of Evora's compliance with this DPA. The audit may take the form of:
- A written questionnaire (the standard route);
- Sharing existing independent audit reports (SOC 2, ISO 27001 where available);
- An on-site visit, only after a proven serious breach and an unanswered formal notice.
The audit must not disrupt Evora's normal operations and remains subject to mutual confidentiality. The Organiser undertakes not to access other organisers' data during the audit.
11. End of the agreement — what happens to the data
On expiry or termination of this DPA (subscription cancellation, deletion of the Organiser account, or breach of contract):
- Future events: cancelled, with registrants notified by email and push that the Organiser has ceased activity;
- Past events: kept for the registrants' own history, but the Organiser's identity is replaced by “Deleted account”;
- Registrant data under the Organiser's responsibility: returned to the Organiser as an export on request, then deleted from Evora within 30 days.
Statutory retention obligations (invoices 10 years, connection logs 12 months, accounting records) still apply and take precedence over a deletion request.
12. Possible joint controllership
In exceptional cases, Evora and the Organiser may jointly determine the purposes and means of a specific processing operation — for example, cross-event analytics used to improve the Evora product. In those cases the parties act as joint controllers within the meaning of article 26 GDPR.
A specific addendum may be signed to formalise that joint controllership, setting out how the obligations are shared (informing data subjects, handling rights requests, breach notification). Absent an addendum, the parties undertake to cooperate in good faith.
13. Electronic signature
The Organiser signs this DPA electronically through the following mechanism:
- The full DPA (this page) is shown before the first attempt to publish an event;
- The box “I, the undersigned Organiser, accept this Data Processing Agreement version v2026.05.01 and confirm I have read the document in full” is ticked;
- The “Sign electronically” button is clicked, which records the exact date and time (UTC), the IP address, the browser User-Agent, the Supabase user id and the DPA version.
Proof of signature is kept in Evora's database for the lifetime of the account plus 5 years after closure, in line with civil limitation periods.
Any substantial update to this DPA requires a fresh electronic signature, notified 30 days before it takes effect. If the Organiser does not accept it, it may terminate its subscription at no cost before the effective date.
The interactive signing page (with its “Sign electronically” button) is available to organisers from their dashboard or directly at /organizer/dpa-signature. This /legal/dpa page stays read-only for the public.