Data processing agreement

How this agreement is entered into

This data processing agreement is between the organisation you act for on heer(ish), as named in its details in the console, the controller, and thatUkrainianGuy, the processor. heer(ish), the trade name Heerish, is run by thatUkrainianGuy, a sole proprietorship registered in the Netherlands with the Chamber of Commerce (KvK) under number 98959964, VAT number NL005363781B34, at Berlaarstraat 53, 1066 PJ Amsterdam, the Netherlands, reachable at privacy@heerish.app about personal data and at security@heerish.app about a vulnerability or a breach.

You accept it, with the terms of service, by ticking the box when the organisation is created on heer(ish). The tick is recorded against the organisation, with the admin who ticked it, the date and the version of this text, which is 2026-10-18.2, and confirms two things: that you are entitled to accept it for the organisation, and that the organisation is the controller of the attendee data on its event pages.

It forms part of the terms of service at heerish.app/terms and applies to every event of the organisation, paid or free. Every admin of the organisation acts under it. Where this agreement and the terms say different things about the processing of attendee data, this agreement wins.

Subject matter, duration, nature and purpose

Subject matter: running the event pages you create on heer(ish), so that the people attending your event can add a card, see who else is in town and arrange to meet.

Nature and purpose: storage, display, retrieval, erasure and transmission by email, including an email to the people going to a plan when it is called off, whether the organiser or the plan's proposer calls it off, and transmission as a notification to the devices on which an attendee has switched notifications on. All of it is carried out only to run those pages for you.

Duration: from its acceptance until the deletion date of the last event of the organisation, or until the organisation is deleted, whichever is later.

Types of personal data: what attendees put on their cards (name, role or organisation, a photo, the dates they are in town, a named lodging place, a phone number), the meetups they propose and join, any list of names and email addresses you upload, sign-in identifiers (an email address, or the identifier a provider issues for Google, LinkedIn, Apple or Mighty Networks sign-in, and with Mighty Networks the email address the community returns as well), the push subscription of each device on which an attendee switches notifications on (the address its push service issued and the keys that encrypt notifications to it), consent records, moderation reports and blocks, and a log of changes.

Categories of data subjects: the people attending your event, and the people you invite to it.

Special category data: none is asked for and none may be uploaded. The terms forbid collecting health details, dietary or accessibility needs, identity documents and emergency contacts, and no field on any page asks for them.

Processing on documented instructions

heer(ish) processes attendee data only on your documented instructions. Your instructions are this agreement, the terms, and the settings you confirm for each event — the privacy preset, the lodging precision, the retention period, the sign-in mode, the sign-in providers it offers and the moderation contacts.

Connecting a Mighty Networks community of yours and offering it on an event instructs heer(ish), each time an attendee signs in through it, to read that member's identifier, name, profile picture, short bio and email address from the community, to keep the identifier and the email address with their card, and to fill in the card form with the rest. heer(ish) reads nothing else from the community and keeps no access to it afterwards. Your use of Mighty Networks, and the app you register there, stay under your own agreement with Mighty Networks.

heer(ish) never uses attendee data for purposes of its own: no per-attendee analytics, no profiling, no training of models, no email to attendees about heer(ish) itself.

heer(ish) transfers attendee data to a third country only as set out below. If Union or Member State law requires a transfer, heer(ish) informs you before processing unless that law forbids it.

heer(ish) tells you if, in its opinion, an instruction infringes the GDPR or other data protection law.

Confidentiality

Everyone heer(ish) authorises to process attendee data is bound to confidentiality, by contract or by statutory duty, and that duty survives the end of their engagement. Access is limited to the people who need it to run or repair the service.

Security

heer(ish) applies the technical and organisational measures required by GDPR Article 32. They are described at heerish.app/security, which is Annex II to the standard contractual clauses, and include encryption in transit and at rest, the separation of each event from every other, storage in the region your event setting names, no personal passwords for organisers or attendees, two-factor sign-in for every organiser account, and an append-only log of changes to cards and plans and of removals from the roster.

heer(ish) may change a measure, but not in a way that lowers the overall level of protection.

Sub-processors

You give general written authorisation for heer(ish) to engage sub-processors. The current list is at heerish.app/subprocessors, which is Annex III to the standard contractual clauses.

heer(ish) tells you by email at least 30 days before adding or replacing a sub-processor. If you object within those 30 days you may end the agreement for the events affected by closing them before the change takes effect; the refund rule in the terms applies to an event that has not opened.

heer(ish) binds each sub-processor by contract to obligations no weaker than these, and remains fully liable to you for their performance.

Helping you answer attendees

Attendees exercise most of their rights themselves: a card can be edited, hidden or deleted from the page at any time. Deleting it takes it off the event for everyone at once and deletes its photo at once; the card's row and its edit history are erased with the rest of the event on the deletion date. Removing an address from the roster in the console stops every invitation and announcement to it and deletes the record kept for its called-off emails. Where attendees sign in by email, it also deletes the card signed in with that address in the same way, which stops those emails, and where the roster is the sign-in list, it ends that person's sign-in at once.

Where that is not enough, heer(ish) helps you meet a request under Articles 15 to 22 by appropriate technical and organisational measures, taking into account the nature of the processing. If an attendee writes to heer(ish) directly, heer(ish) does not answer on the substance: it passes the request to you and tells the attendee it has done so.

Helping you with Articles 32 to 36

heer(ish) gives you the information you need for your own impact assessment and for any prior consultation with a supervisory authority. A pre-filled template is at heerish.app/legal/dpia, and the security description at heerish.app/security may be attached to it.

heer(ish) tells your named security contact about a personal data breach affecting your events without undue delay and within 24 hours of becoming aware of it. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken. Where all of that is not yet known it is sent in phases, the first within the same 24 hours. Notifying the supervisory authority under Article 33 and the data subjects under Article 34 is yours to do, because you are the controller; heer(ish) supplies what you need to do it.

Deletion

Every event is deleted on the deletion date fixed by its retention setting. Live systems are clear within 24 hours of that date and backups within 30 days. An email delivered through Resend is the exception: Resend keeps it for 30 days after it was sent, and in its backups for 7 more. Deletion is final and cannot be undone.

Nothing is returned at the end of the processing, because everything on a page is visible to you in the console for as long as the event exists. After deletion heer(ish) keeps only a receipt that records what was deleted and when, as counts per table with no personal data in it, which the console prints as a deletion certificate. Keeping those counts is required to show compliance under Article 28(3)(h). The receipt also keeps the totals of the event (cards, cards with a place, plans, RSVPs and expected attendance), which the console shows on the deleted event; they are numbers, with no personal data in them.

Audits and information

heer(ish) makes available to you all information needed to show that the obligations in Article 28 are met. An audit or inspection by you, or by an auditor you mandate, takes place at your cost, no more than once a year unless a breach or a supervisory authority makes a further one necessary, on 30 days notice, during business hours, and without access to the data of other customers.

Transfers outside the EEA

Attendee data on the EU setting is stored in the European Union, under a jurisdiction restriction that keeps it there. Attendee data on the US setting is stored in the United States, in a database and photo storage created in Cloudflare's eastern North America location, with no jurisdiction restriction behind it. Email is the exception on either setting: it is delivered through a worldwide network, the United States included, and an email delivered through Resend is stored in the United States whatever the setting. Notifications go to the push service of the attendee's browser (Apple, Google, Mozilla or Microsoft), which the attendee's browser chooses and heer(ish) does not engage; their content is encrypted for the attendee's device, so that service learns only that one was sent, and when. The sub-processor page names which country each recipient processes in.

Where attendee data reaches a country without an adequacy decision, the transfer runs on the European Commission's standard contractual clauses of 4 June 2021 (Implementing Decision (EU) 2021/914), which are incorporated into this agreement by reference and form part of it.

Module Two (controller to processor) applies where you are the controller of the attendee data, which is the normal case. Module Three (processor to processor) applies instead where you are yourself acting as a processor for another organisation, and you tell heer(ish) so in writing.

The optional docking clause in Clause 7 applies. For Clause 9(a), Option 2 — general written authorisation — applies, with the 30 days notice period set out above. The optional redress clause in Clause 11(a) does not apply. Under Clause 17 the clauses are governed by the law of the Netherlands, and under Clause 18(b) disputes go to the courts of the Netherlands. Annex I.A is the parties named in this agreement and in the organisation's details, Annex I.B is the description above, Annex I.C names the Autoriteit Persoonsgegevens as competent supervisory authority, Annex II is heerish.app/security and Annex III is heerish.app/subprocessors.

Where a recipient in the United States is certified under the EU-US Data Privacy Framework, that certification is relied on as an additional safeguard beside the standard contractual clauses, never on its own. A copy of the clauses as concluded is sent on request.

The UK International Data Transfer Addendum to the standard contractual clauses applies to events on the UK privacy preset once heer(ish) has appointed a representative in the United Kingdom. Until then the UK preset is not offered for sale.

heer(ish) notifies you if it becomes subject to a law or practice in a third country that prevents it from meeting the clauses, and if it receives a legally binding request from a public authority for attendee data, unless it is forbidden to say so.

California and other US state privacy laws

Where the California Consumer Privacy Act applies to you, heer(ish) is your service provider for attendee data and this section holds the terms that California Code of Regulations, title 11, section 7051(a) requires. Where another US state privacy law treats heer(ish) as your processor, the same terms apply.

heer(ish) does not sell or share attendee data, in the sense those words have in the CCPA.

You disclose attendee data to heer(ish) for one limited and specified business purpose only: running the event pages you create, so that the people attending your event can add a card, see who else is in town and arrange to meet, as described under "Subject matter, duration, nature and purpose" above.

heer(ish) does not retain, use or disclose attendee data for any other purpose, commercial or not, or outside its direct business relationship with you, and does not combine it with personal information it receives from another source or collects from its own interaction with the person, unless the CCPA or its regulations expressly permit it.

heer(ish) complies with the CCPA and its regulations as they apply to a service provider, and gives attendee data the same level of privacy protection they require of you, including the security measures at heerish.app/security.

You may take reasonable and appropriate steps to make sure heer(ish) uses attendee data in a manner consistent with your obligations under the CCPA, including through the audit and information rights above.

heer(ish) tells you if it determines that it can no longer meet its obligations under the CCPA.

On notice, you may take reasonable and appropriate steps to stop and remediate any unauthorised use of attendee data, including asking heer(ish) for documentation that the data of a person who has made a valid request to delete is no longer used or shown, and is erased with the rest of the event on its deletion date.

heer(ish) enables you to comply with consumer requests under the CCPA in the ways set out under "Helping you answer attendees" and "Deletion" above, and passes on any such request that reaches it directly.

Liability, term and changes

The liability limits in the terms of service apply to this agreement, except where the standard contractual clauses or mandatory law do not allow them.

This agreement ends when the last event of the organisation has been deleted and the organisation has been closed. The obligations on confidentiality, deletion and the standard contractual clauses survive for as long as any attendee data remains.

heer(ish) tells you by email at least 30 days before a change to this agreement that matters takes effect. If the organisation does not agree, an admin can have it closed before that date; continuing to use the service after it means the new version is accepted. Questions go to privacy@heerish.app.