Appendix No. 1 to the Organizer’s Regulations of the SF-CONFERENCE System

Data Processing Agreement

§ 1. General Provisions

1. This Personal Data Processing Agreement (hereinafter the "Processing Agreement") constitutes an integral part of the Organizer’s Regulations of the System (hereinafter the "Regulations") and is concluded between:
   1. the Organizer – acting as the controller of the personal data of event participants and other persons using the System in connection with the organized event (hereinafter the "Controller"),
   2. SF-LABS sp. z o.o., with its registered office at ul. Józefa Marcika 6, 30-443 Kraków, entered into the Register of Entrepreneurs of the National Court Register under KRS No. 0000886671, NIP: 6793213075, REGON: 388297924 (hereinafter the "Processor" or "SF-LABS")

   – hereinafter jointly referred to as the "Parties".

2. Any terms not defined in this Processing Agreement but defined in the Regulations shall have the meanings assigned to them in the Regulations.
3. This Processing Agreement is concluded in connection with the Controller’s commencement of the use of the System on the basis of the agreement concluded between SF-LABS and the Controller through registration and acceptance of the Regulations (the "Service Agreement").
4. The purpose of this Processing Agreement is to define the rules, scope, and conditions under which the Controller entrusts SF-LABS with the processing of personal data in accordance with Article 28 of the GDPR.

§ 2. Subject matter and purpose of the processing entrustment

1. The purpose of this Agreement is to define the rules, scope, and conditions under which the Controller entrusts SF-LABS, acting as a processor, with the processing of the personal data of event participants and other persons using the System in connection with the organization of events, including, in particular, data collected through registration forms, participant panels, system communications, and payment processing, in accordance with Article 28 of the GDPR. The entrustment of personal data is intended to enable the Controller to use the SF-CONFERENCE System for the organization and management of events, including participant registration, participant management, communication, and – where payment integrations are used – the processing of payment transactions.
2. The Controller entrusts the Processor with the processing of personal data necessary for the provision of the services covered by the Regulations, in particular the data of:
   1. Participants,
   2. Representatives registering Participants,
   3. other Users.
3. The categories of personal data may include, in particular: first name, last name, email address, contact details, professional affiliation, data relating to participation in an event, data necessary for handling registrations, invoices, and payments, System activity history, as well as other data specified in the Privacy Policy applicable to the System, available at https://www.sf-conference.com/en/privacy-policy.
4. The scope of processing operations includes, in particular: collection, recording, organization, storage, review, use, disclosure on the Controller’s instructions, deletion, and destruction of personal data.
5. The processing is carried out using the technical and organizational measures implemented by the Processor, including the SF-LABS IT infrastructure, comprising hosting services, the administrative panel, communication automation tools (including mailing tools), and databases associated with the System.
6. The processing of personal data may also include data required for the provision of payment services by SF-LABS as a small payment institution within the meaning of the Act of 19 August 2011 on Payment Services, as well as data subject to financial security measures required under the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing.

§ 3. Obligations of SF-LABS as the Processor

1. The Processor undertakes to process personal data solely on the documented instructions of the Controller, unless such processing is required by European Union law or the law of a Member State to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless such information is prohibited by law.
2. The Processor ensures that persons authorized to process personal data on its behalf are bound by confidentiality obligations or are subject to an appropriate statutory obligation of confidentiality.
3. The Processor undertakes to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk to the rights and freedoms of data subjects, in accordance with Article 32 of the GDPR.
4. The Processor shall assist the Controller, taking into account the technical and organizational measures available to the Processor, in:
   1. fulfilling the obligations arising under Articles 32–36 of the GDPR (including data protection impact assessments, personal data breach notifications, and consultations with the supervisory authority),
   2. fulfilling the rights of data subjects set out in Articles 12–22 of the GDPR (including the rights of access, rectification, erasure, restriction of processing, and data portability).
5. At the Controller’s request, the Processor shall without undue delay provide all information necessary to demonstrate compliance with the obligations arising from this Processing Agreement and Article 28 of the GDPR, and shall allow for and contribute to audits or inspections conducted by the Controller or an auditor authorized by the Controller, provided that this does not result in a breach of trade secrets or the confidentiality obligations owed to other Controllers.

§ 4. Obligations of the Controller

1. The Controller represents that the personal data entrusted for processing under this Processing Agreement are processed in accordance with the applicable law, including, in particular, on the basis of one of the legal grounds set out in Article 6 or Article 9 of the GDPR, and that the data subjects have been informed of the rules governing the processing of their personal data.
2. The Controller undertakes not to entrust the Processor with the processing of personal data:
   1. belonging to the special categories of personal data referred to in Article 9(1) of the GDPR,
   2. relating to children within the meaning of Article 8 of the GDPR,

   unless the Parties agree otherwise in a separate agreement or amendment, provided that such agreement is made in writing under pain of nullity.

3. The Controller undertakes to notify the Processor without undue delay of any personal data breach, security incident, or other significant event affecting the processing of personal data entrusted under this Processing Agreement, in particular where such event originates on the Controller’s side. The notification shall be submitted electronically to office@sf-labs.com or another email address designated by the Processor, without undue delay and no later than 24 hours after the event has been detected. The notification shall include at least: a description of the event, its potential consequences, the known categories of personal data and data subjects affected, and the contact details of the person responsible on the Controller’s side for further communication regarding the incident.

§ 5. Sub-processing of Personal Data

1. The Controller authorizes the Processor to engage further processors ("Sub-processors") to the extent necessary for the provision of the services covered by this Processing Agreement, in particular for hosting services, email services, communication automation systems, and other tools supporting the operation of the System.
2. The list of categories of entities to whom personal data may be entrusted is available in the SF-LABS Privacy Policy published on the System’s website. The Processor undertakes to update this list whenever the categories of Sub-processors change.
3. The Processor undertakes to conclude a personal data processing agreement with each Sub-processor, ensuring a level of data protection that is no less stringent than that provided under this Processing Agreement.
4. The Processor shall monitor the activities of its Sub-processors and take appropriate measures if it identifies any breach, or risk of a breach, of personal data protection by any Sub-processor.
5. The Processor shall remain fully liable to the Controller for the acts and omissions of each Sub-processor as if they were its own acts and omissions with respect to the processing of the entrusted personal data.
6. The Controller has the right to object, on reasonable grounds, to a specific new Sub-processor within 7 days of receiving notification thereof. Failure to raise an objection within this period shall be deemed acceptance of the new Sub-processor.

§ 6. Breaches and liability

1. In the event of a personal data breach, the Processor shall notify the Controller without undue delay, and no later than within 48 hours from the moment the breach is detected, together with the provision of available information required under Article 33(3) of the GDPR. The notification shall include at least:
   1. the nature of the breach and the categories of data affected,
   2. the possible consequences of the breach,
   3. the measures taken or proposed by the Processor to address the breach and mitigate its effects,
   4. the contact details of the Data Protection Officer (if appointed).
2. The Processor undertakes to maintain a register of personal data breaches and to make it available to the Controller upon request.
3. The Processor shall be liable solely for damages arising from its culpable breach of obligations under this Processing Agreement or the GDPR, to the extent that such breach was the direct cause of the damage. Such liability does not include indirect damages or lost profits.
4. The Processor shall not be liable for breaches resulting from:
   1. unlawful acts or omissions of the Controller,
   2. the Controller’s failure to comply with its information obligations prior to data disclosure,
   3. errors in the content or scope of the entrusted data,
   4. unauthorized access resulting from inadequate security of accounts on the Controller’s side or its users,
   5. improper configuration of external integrations, including payment tools or forms, for which the Controller is responsible.
5. In the event of joint liability of the Parties towards data subjects, the Parties shall promptly take actions to determine the extent of each Party’s liability and to allocate it proportionally.

§ 7. Duration and termination of processing

1. This Data Processing Agreement shall apply for the entire duration of the Service Agreement concluded on the basis of the Controller’s acceptance of the Regulations, as well as for the period necessary to perform all actions related to the termination of cooperation and securing the data.
2. After the termination of the services related to data processing, the Processor shall:
   1. upon the Controller’s request – return all personal data and their copies, unless further storage of such data is required under European Union law or the law of a Member State,
   2. in other cases – permanently delete personal data and their copies in a manner that prevents their recovery, no later than within 90 days from the termination of this Processing Agreement.
3. The Processor’s obligations regarding personal data protection set out in this Agreement shall remain in force even after its termination or expiry, to the extent required by law or necessary to protect the rights and interests of data subjects.
4. The Processor may retain data for evidential purposes (e.g. related to service settlements) for the period required by applicable law or until the expiry of limitation periods for potential claims.

§ 8. Final provisions

1. The laws of Poland shall apply to this Processing Agreement.
2. Any disputes arising from this Processing Agreement shall be resolved by the court having jurisdiction over the registered office of the Processor, unless mandatory provisions of law provide otherwise.
3. This Processing Agreement constitutes Appendix No. 1 to the Organizer’s Regulations and applies exclusively in connection with its acceptance by the Controller.