Data Processing Agreement

• "Personal Data" means any information relating to an identified or identifiable individual that is collected, stored, or processed by Processor in the course of providing the Services, including but not limited to names, phone numbers, email addresses, company affiliations, job titles, and event-related preferences.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transmission, and deletion.
• "Data Subjects" means the individuals to whom the Personal Data relates, including event attendees, registrants, invitees, and contacts.
• "Services" means the Boop services Controller uses under the Agreement.

Processor will Process Personal Data solely for the purpose of providing the Services under the Agreement, including:

• Event registration, ticketing, and RSVP capture
• SMS, email, and web-based communications (confirmations, reminders, and updates)
• Lead capture, meeting booking, and contact management
• Curated matchmaking and networking functionality
• Badge printing and on-site check-in

Processor will not use Personal Data for any purpose outside the scope of the Services without Controller's prior written consent.

Controller is the data controller and determines the purposes and means of Processing. Processor acts solely as a data processor on Controller's behalf and will Process Personal Data only in accordance with Controller's documented instructions, as reflected in the Agreement and this DPA.

Processor agrees to:

• Process Personal Data only as necessary to provide the Services
• Maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction
• Ensure that personnel authorized to Process Personal Data are subject to confidentiality obligations
• Not sell Personal Data or use it for any third-party marketing purposes
• Notify Controller without undue delay upon becoming aware of a Personal Data breach affecting Data Subjects' Personal Data
• Assist Controller, as reasonably requested, in responding to Data Subject requests to access, correct, or delete their Personal Data

Processor may engage third-party service providers (e.g., SMS/communications infrastructure, payment processing, cloud hosting) to support the Services ("Subprocessors"). Processor will ensure that any Subprocessor is bound by data protection obligations materially consistent with this DPA. Current Subprocessors are listed at boop.me/subprocessors.

Processor will retain Personal Data only for as long as necessary to provide the Services and fulfill the purposes described in Section 2, or as otherwise required by law. Controller may request an export of Personal Data in a standard format (e.g., CSV) at any time during the term of this DPA, and Processor will provide such export within a reasonable timeframe. Upon written request from Controller, or upon termination of the Agreement, Processor will delete or return Personal Data within a reasonable timeframe, except where retention is required by law.

Where a Data Subject contacts Processor directly to exercise a right regarding their Personal Data (e.g., access, correction, deletion, or opt-out of communications), Processor will promptly notify Controller and reasonably cooperate with Controller in responding to such requests. Data Subjects may opt out of SMS communications at any time using standard opt-out mechanisms (e.g., replying "STOP").

In the event of a confirmed unauthorized access to or disclosure of Personal Data ("Security Incident"), Processor will notify Controller without undue delay after becoming aware of the incident, and will provide reasonably available information to assist Controller in assessing and responding to the incident.

Processor will Process Personal Data primarily within the United States. Processor will not transfer Personal Data outside the United States without providing prior notice to Controller.

This DPA remains in effect for the duration of the Agreement. Upon termination of the Agreement, Processor's obligations under this DPA with respect to deletion or return of Personal Data under Section 6 will survive.

This DPA supplements and forms part of the Agreement. In the event of a conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA will control. Where Controller has signed a separate data processing agreement with Processor, that agreement governs instead of this one.