Data processing agreement (DPA)
Last updated: 2026-10-16.
This agreement is part of the terms of service between the organiser who uses RONDZA (the controller) and RONDZA (Stockholm, Sweden) (the processor). It meets Article 28 of the GDPR. It applies automatically to every organiser account; no signature is needed, but we are happy to sign a copy – email privacy@rondza.com.
1. What we process
Purpose: running guest lists, door check-in, drink & food tickets and badges for the controller’s events. Data subjects: guests, hosts, artists, staff and others the controller adds. Data: names or labels the controller writes, group size, check-in and redemption times, badge level and access area. RONDZA does not ask for special categories of data, and controllers should not enter them.
2. Instructions
We process personal data only to provide the service and on the controller’s documented instructions – which are these terms and the controller’s use of the app. If we believe an instruction breaks data protection law, we tell the controller.
3. Confidentiality
Everyone at RONDZA with access to personal data is bound by confidentiality.
4. Security
Encrypted connections (HTTPS) everywhere, hashed passwords (scrypt), signed session cookies, separate logins per role, rate limits on logins and public links, unguessable links (at least 144 bits), and backups held by our hosting provider. Guest lists and badges are deleted automatically 30 days after the event.
5. Sub-processors
The controller gives general authorisation to use these sub-processors: Railway (hosting, EU region), Cloudflare (DNS and email forwarding) and Resend (account emails such as password resets – guest data is not sent by email). We give at least 30 days’ notice on this page before adding or replacing a sub-processor; the controller may object and close the account.
6. Transfers outside the EU/EEA
If a sub-processor processes data outside the EU/EEA, it does so under the EU Standard Contractual Clauses or an adequacy decision.
7. Helping the controller
We help the controller answer data subjects’ requests (access, correction, deletion) and with impact assessments where reasonable. Most requests the controller can handle directly in the app – for example by removing a guest.
8. Personal data breaches
We notify the controller without undue delay, and within 48 hours of becoming aware of a breach that affects its data, with the information we have.
9. End of the service
When an account is closed we delete its personal data within 30 days, unless the law requires us to keep it. The controller can ask for an export before that.
10. Audits
We give the controller the information needed to show that this agreement is followed, and allow reasonable audits with at least 30 days’ notice, at the controller’s cost.
11. Liability and law
Liability follows the terms of service. Swedish law applies; disputes are settled by a Swedish court.