Data Processing Agreement

This Data Processing Agreement (the "DPA") is entered into by the legal entity or sole trader identified as the venue customer in the applicable Tapino order or registration (the "Controller") and Miletra, a Swedish sole trader, organisation number 650306-9053, Roliasgatan 4, 553 39 Jönköping, Sweden (the "Processor" or "Tapino").

This DPA supplements the agreement for Tapino services (the "Main Agreement"). For conflicts about personal-data processing, this DPA prevails. Mandatory data-protection law always prevails.

The venue is the Controller for personal data where it determines the purposes and means in its operations. Tapino is the Processor when it processes that data on the venue's behalf.

Tapino is a separate controller for processing whose purposes Tapino determines, including Tapino accounts for venue users, authentication, platform security, Tapino support, contract administration, and legal obligations. That processing is governed by Tapino's Privacy Policy, not the instructions in this DPA.

Tapino may process venue-controlled data only on the venue's documented instructions unless EU or Swedish law requires otherwise. The Main Agreement, the venue's use and configuration of the service, authorised support requests, and this DPA constitute documented instructions.

If Tapino believes an instruction infringes the GDPR or other applicable data-protection law, Tapino will inform the venue and may suspend the affected processing until the matter is resolved.

• ensure a legal basis, transparency, and lawful instructions
• grant access only to people who need it and keep roles and contacts current
• inform Tapino of retention requirements, restrictions, objections, and data-subject requests
• not use the service for unlawful, disproportionate, or incompatible purposes
• avoid unnecessary sensitive data and use free-text fields responsibly

• process data only on documented instructions and applicable law
• ensure that authorised personnel are bound by confidentiality
• implement appropriate technical and organisational security measures
• assist with data-subject rights, incidents, impact assessments, and regulator consultation to the extent relevant to the processing
• provide information reasonably needed to demonstrate Article 28 compliance
• delete or return data at the end of service as described in section 13

• encrypted transmission and provider encryption of stored data
• authentication and role-, account-, and venue-based access control
• server-side authorisation, validation, and separation between venue accounts
• database and storage rules, least privilege, and protection of administrative functions
• logging, monitoring, error handling, and incident procedures with minimised personal data in diagnostics
• abuse controls, secure development, review, and risk-proportionate testing
• backup and recovery capabilities through relevant infrastructure services
• access-change, confidentiality, and offboarding procedures

Measures may evolve provided the overall level of protection is not materially reduced.

The venue gives general written authorisation for Tapino to engage subprocessors. Tapino will impose data-protection obligations providing at least equivalent protection for the processing they perform.

The current list of subprocessors that may process venue-controlled data will be provided to the venue as an annex to the Main Agreement or through a separate, continuously accessible customer notice before processing begins. The list will contain the information the venue needs to meet its obligations, including each subprocessor's identity, processing function, and relevant processing country and transfer basis. The list does not need to be published publicly.

Tapino will give reasonable advance notice of a new or replacement subprocessor. The venue may object on documented, reasonable data-protection grounds. The parties will seek a practical solution; if none is available, the affected feature or Main Agreement may be terminated under its terms.

Tapino may transfer venue-controlled data outside the EU/EEA only where GDPR Chapter V is satisfied. Without an adequacy decision, Tapino or the relevant subprocessor will use a valid mechanism such as the European Commission's Standard Contractual Clauses and supplementary measures where needed.

If Tapino receives a request concerning venue-controlled data, Tapino will, where legally permitted, forward it to the venue and not respond substantively without instructions. Tapino will provide reasonable assistance through available features and supplementary measures, taking account of the nature of processing.

Tapino will notify the venue without undue delay after becoming aware of a personal-data breach affecting venue-controlled data. To the extent available, notice will describe the nature of the breach, affected categories and approximate numbers, likely consequences, and measures taken or proposed. Information may be supplied in phases where it is not available at once.

Tapino will reasonably assist with impact assessments and prior consultation where the assistance concerns Tapino's processing and information available to Tapino.

On request, Tapino will provide relevant documentation, summaries of security controls, or responses to reasonable questionnaires. If insufficient, the venue may conduct a proportionate audit no more than annually, or more often following a serious incident or regulator requirement, with reasonable notice, confidentiality, and minimal disruption. The venue normally bears its audit costs.

When processing ends, Tapino will, at the venue's choice and to the extent supported by the service, return or delete venue-controlled data and existing copies. Tapino may retain data where EU or Swedish law requires it and will then restrict processing to that requirement. Backup data is deleted when overwritten in the normal backup cycle.

This DPA applies while Tapino processes personal data for the venue. Liability, limitations, fees, and termination follow the Main Agreement to the extent compatible with the GDPR. Swedish law governs and disputes follow the Main Agreement without limiting data-subject or supervisory-authority rights.

Data-protection notices are sent to the parties' registered contacts. Tapino's contact is support@tapino.app.

This DPA is designed to meet GDPR Article 28 with reference to the European Commission's controller–processor Standard Contractual Clauses.