Data processing agreement

This agreement applies where you use EntryWick to hold personal data about other people — your registrants, their households, your attendees — and it sets out what EntryWick may and may not do with it. It forms part of the terms of service. Where the two disagree about personal data, this one wins.

You are the controller. EntryWick is the processor. You decided to collect the information, you decided what to ask for, and you decide how long it is kept. We act on your instructions and on nothing else.

[OWNER: to be executed between the legal entity named in the terms and the customer. A customer who needs a signed copy on their own paper should be able to get one — decide who signs, and where a countersigned copy is filed.]

1. What we process, and why

2. Our obligations

1. Only on your instructions. We process the data to provide the product, to keep it secure, and where the law requires us to. Nothing else. Not to train a model, not to build a profile, not to market to your people.
2. Confidentiality. Everyone with access is bound to it, and access is limited to those who need it to do their job.
3. Security. The measures in §6 — not as an aspiration but as what is in the product today.
4. Sub-processors as set out in §3.
5. Helping you answer people. Every list exports and the API reads everything, so a request for a copy, a correction or a deletion can be answered by you directly. Where you need our help, you have it at no charge.
6. Deleting it. On your instruction, or when the account closes, as §7 sets out.
7. Telling you about a breach — §5.
8. Audits. On reasonable notice, we will answer a security questionnaire and show you what we hold about our controls. [OWNER: whether an audit in person is offered, and at whose cost.]

3. Sub-processors

We use the companies on the sub-processor list, and that page is the notice: it names each one, what it does, and what it sees. We remain responsible for them.

Before a new one starts handling your data we will publish it there and tell account owners by email, with at least 30 days before it begins. If you object on reasonable grounds we will look for another way to provide the feature; if there is none, you may stop using that feature or end the agreement for that reason, with a refund of the unused part of your year.

4. Transfers

Some of those companies process data outside your country. Each transfer is covered by the standard contractual clauses or another lawful mechanism in our agreement with them. [OWNER: the hosting region customers' data sits in, and whether an in-region option is offered.]

5. If something goes wrong

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and within 72 hours, with what we know: what happened, whose data, what we have done, and what we recommend you do. We will keep telling you as we learn more. We will not wait until we have a complete picture, and we will not decide on your behalf whether it is worth reporting to an authority — that is your call to make, and you cannot make it if we have not told you.

6. Security measures

What the product does today, not a wish list:

• In transit — HTTPS everywhere, with certificates issued and renewed at the edge.
• At rest — provider credentials, API tokens, signing keys, DKIM keys and webhook secrets are encrypted in the database; passwords are hashed. None of them is ever written to a log.
• Separation — every tenant-owned record carries its organization and every query is scoped to it; a test suite asserts a cross-organization read fails for each table rather than trusting that it does.
• Access — roles with permissions, optionally scoped to one part of your group tree; two-factor sign-in available to every member and requirable by an owner; single sign-on on the plans that include it.
• Accountability — every write is recorded in an audit log with who did it, from which surface, and when. Check-ins are append-only: a correction is a new row, never an edit.
• Backups — a nightly database dump with a 24-hour recovery point, restorable and tested by a restore drill.
• Least data — a support message from inside the product shows you exactly what it carries before it is sent, and it never carries a registrant's details.

7. Return and deletion

Export. Your Owner can download everything at any time from Settings → Your data: every table as JSON and CSV, with every stored file, in one archive. Passwords, keys, tokens and webhook secrets are left out. One person's data can be exported from their own page.

Deleting one person. Your Owner can erase one person's details from their page, with a reason and a second factor. Their name, date of birth, contact details, answers and uploads are removed at once and their tickets voided; their check-ins and payments are kept without those details, and audit rows written before the erasure are kept until your plan's retention removes them.

Deleting the account. Your Owner can schedule the deletion from Settings → Your data, with a reason and a second factor, or ask us to. It is carried out 30 days later unless it is cancelled in that time; then every record and file of yours is deleted — audit rows and check-in rows included — together with the accounts of your staff who belong to no other organization. Backups containing it roll off within a further 30 days. We will confirm deletion in writing if you ask.

What survives deletion. A one-way hash of any address that complained about your email, so it is never mailed on your behalf again, and our own record that the deletion happened — who asked, when and why — without any of the data.

While the account is open, two things are kept as long as the record they belong to, deliberately: audit rows and check-in rows. An audit log that can be edited is not an audit log, and a check-in that can be altered is not a record of who came.

8. Liability

As set out in the terms of service §5, and nothing in this agreement changes it.