Version 1.2 · Effective 2026-10-09
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Convenio Terms of Service (the "Terms"). It is accepted together with the Terms at Company onboarding; no separate signature is required. Capitalised terms not defined here have the meaning given in the Terms.
2.1 Roles. The Customer is the Controller of Customer Personal Data. Faccilis is the Processor. Where the Customer is itself a processor acting for a third-party controller, the Customer warrants that it has the authority to instruct us on that controller's behalf, and references in this DPA to the Customer's instructions are to instructions passed through from that controller.
2.2 Scope. This DPA applies only to our Processing of Customer Personal Data as described in Annex 1. It does not apply to any other processing.
2.3 Our own controller processing — outside this DPA. We act as an independent controller, not as Processor, in respect of: account and contact details of the individuals who administer the Customer's account, used to operate and secure the Service and to communicate about it; billing and tax records; security, fraud-prevention and system logs; and aggregated, anonymised usage statistics as permitted by Terms §7.5. That processing is governed by our privacy notice, not by this DPA.
2.4 Payments are not covered. Paid subscriptions are sold by Paddle as merchant of record (Terms §6.1). Paddle determines the purposes and means of its own processing of payment data and acts as an independent controller, not as our Sub-processor. We are not responsible for Paddle's processing, and Paddle is not listed in Annex 3.
2.5 Precedence. In the event of conflict, on matters of Personal Data Processing this DPA prevails over the Terms, except that Terms §12 (Limitation of liability) prevails over this DPA, as set out in §10. Annex 4 (SCCs) prevails over both to the extent of any conflict, but only in respect of the transfers it covers, and only where the GDPR requires it.
This DPA takes effect when the Terms are accepted and continues for as long as we Process Customer Personal Data. Sections 5.2, 6.8, 9, 10 and 11 survive its termination.
4.1 The Customer is solely responsible for: the lawfulness, fairness and transparency of the Processing; establishing and documenting a valid legal basis; the accuracy and adequacy of Customer Personal Data; providing privacy notices to its personnel; and complying with any employee-consultation, works-council or equivalent requirement in its jurisdiction.
4.2 The Customer warrants that its instructions, including its configuration and use of the Service, comply with applicable data protection law, and that it is entitled to transfer Customer Personal Data to us for Processing.
4.3 Prohibited data. The Customer must not submit to the Service, and must instruct its Users not to submit: special categories of Personal Data under Article 9 GDPR (health, biometric, genetic, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life or sexual orientation); Personal Data relating to criminal convictions or offences under Article 10; government identifiers; payment card or financial account numbers; or Personal Data of children. The Service is not designed, assessed or secured for such data. Free-text fields — event descriptions and goals, feedback comments, support messages, notes recorded on external guests, and questions typed into the AI assistants — are the practical risk, and the Customer is responsible for what its Users type into them. The AI assistants deserve particular attention in the Customer's internal guidance: a conversational box invites users to describe their situation in their own words, text typed there is transmitted to the Sub-processor identified in Annex 3, and the AI data assistant also transmits the records needed to answer — free-text fields included — as described in Annex 1 §5. If such data is submitted, we may delete it, and the Customer is responsible for any consequence of its submission.
4.4 The Customer is responsible for its own administration of the Service, including who it invites, which roles it grants, what visibility it configures, and what it exports. Terms §3.1 applies.
4.5 External guests. The Service lets the Customer record people outside its organisation — clients, prospects, partners, suppliers, speakers, press — as guests of its events and in its guests book, including by importing them from a file. Those individuals are not Users: the Service never contacts them, sends them no email and gives them no access. The Customer is therefore solely responsible for: having a legal basis for recording them; informing them of the Processing as Articles 13 and 14 GDPR require; the accuracy of what is recorded, imported or copied from other systems; and handling their requests through the functionality described in §5.5.
5.1 Documented instructions. We Process Customer Personal Data only on the Customer's documented instructions, including as to international transfers, unless required otherwise by law to which we are subject; in that case we inform the Customer before Processing, unless the law prohibits it on important grounds of public interest. The Terms, this DPA, the Customer's configuration and use of the Service, and any support request made through the Service constitute the Customer's complete documented instructions. Any other instruction must be agreed in writing and, where it requires effort beyond the Service's standard functionality, is subject to §11.3 (fees).
5.2 Unlawful instructions. If we consider an instruction to infringe applicable data protection law, we will inform the Customer without undue delay, and may suspend performance of that instruction until it is withdrawn, amended or confirmed. We are not obliged to provide legal advice, and we have no obligation to verify the lawfulness of the Customer's Processing or of the data it submits.
5.3 Confidentiality. We ensure that persons authorised to Process Customer Personal Data are bound by an appropriate obligation of confidentiality, and that access is limited to those who need it to perform the Service.
5.4 Security. We implement the technical and organisational measures set out in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing, as required by Article 32 GDPR. We may update those measures over time, provided the overall level of security is not materially reduced. Annex 2 describes the measures applicable to the Service as a whole; it is not a commitment to implement measures specific to one Customer, and it is not a warranty that the Service is secure against every attack (see Terms §10).
5.5 Data subject rights. The Service provides the Customer with functionality to access, correct, export and anonymise the Personal Data of its Users, and to access, correct, export and permanently delete the Personal Data of its external guests, without our involvement; this constitutes our assistance under Article 28(3)(e) GDPR. If a Data Subject contacts us directly, we will not respond substantively but will refer them to the Customer and inform the Customer without undue delay. Where a request cannot be satisfied through the Service's functionality, we will provide reasonable additional assistance, taking into account the nature of the Processing and the information available to us, subject to §11.3.
5.6 Assistance with Articles 32 to 36. Taking into account the nature of the Processing and the information available to us, we will provide reasonable assistance with the Customer's obligations on security, breach notification, data protection impact assessments and prior consultation. Annex 2 and this DPA constitute our standard assistance for a DPIA; anything beyond that is subject to §11.3.
5.7 Personal Data Breach. We will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide the information reasonably available to us at that time, supplementing it as more becomes known. Notification is not, and must not be treated as, an acknowledgement of fault or liability. The Customer is responsible for assessing the breach and for any notification to a Supervisory Authority or to Data Subjects; we will not make such a notification on the Customer's behalf.
5.8 Deletion or return. On termination, the Customer may export its data using the functionality available in the Service (Terms §14.1). We will delete or anonymise Customer Personal Data in accordance with Terms §14.2. Data held in backups is deleted in the ordinary course of the backup cycle, and remains subject to §5.3 until then. We may retain Personal Data where required by law, as permitted by Terms §14.3.
5.9 Records and information. We maintain records of our Processing as required by Article 30(2) GDPR and, on written request, make available the information necessary to demonstrate compliance with Article 28, in the manner set out in §7.
6.1 General authorisation. The Customer gives a general written authorisation for us to engage Sub-processors, under Article 28(2) GDPR. Those engaged at the date of this DPA are listed in Annex 3.
6.2 Changes. We will notify the Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days before it begins Processing, by email to the Company Admins on record, by in-app notice, or by updating the published version of Annex 3 where the Customer has subscribed to notifications of changes to it.
6.3 Objection. The Customer may object on reasonable data-protection grounds within that period, giving reasons in writing. We will use reasonable efforts to make the Service available without the objected-to Sub-processor or to offer a change that avoids the objection. Where the objection concerns the AI gateway used by the AI assistants, either or both assistants can be disabled for the Customer's Company at the Customer's request, at no charge and with no other effect on the Service; once both are disabled, no Customer Personal Data of that Company is transmitted to the gateway. Where we cannot avoid the objection, the Customer's sole and exclusive remedy is to terminate the affected subscription by written notice before the change takes effect; Terms §6.5 (no refunds) applies, save that we will refund the unused portion of fees already paid for the period after termination. Objection does not confer a veto and does not delay the change.
6.4 Our responsibility. We impose on each Sub-processor data protection obligations no less protective than those in this DPA, and remain responsible to the Customer for their performance of those obligations, subject always to §10.
6.5 Emergency changes. Where a Sub-processor must be replaced urgently for security, legal or continuity reasons, we may do so immediately and notify the Customer as soon as practicable; §6.3 then applies from the date of notification.
7.1 How compliance is demonstrated. We make available Annex 2, this DPA, and any documentation, certification or report we hold. On written request, we will complete one (1) reasonable security and data-protection questionnaire per twelve (12) month period, within thirty (30) days.
7.2 Limits. Audits are documentary and remote only. They are subject to: at least thirty (30) days' written notice; a written confidentiality undertaking; the Customer bearing its own costs and reimbursing our reasonable costs under §11.3; and conduct that does not disrupt our operations. They do not include access to our premises, systems, source code, infrastructure, credentials or personnel beyond the questionnaire, nor any test, scan or penetration test, nor access to data or information relating to any other customer.
7.3 Supervisory Authorities. Nothing in this §7 limits the powers of a competent Supervisory Authority, or the audit rights that Clause 8.9 of the SCCs confers where Annex 4 applies. Where those rights are exercised, they take precedence over the limits in §7.2 to the extent legally required, and to that extent only.
8.1 Where the data is hosted. Customer Personal Data is stored at rest in the European Union, in the database and support-ticketing Sub-processors identified in Annex 3, and transactional email is delivered from within the EEA. This is a commitment about storage, not about every path the data takes: the application front end is served globally, some Sub-processors are established outside the EU and access data from outside it, and data processed by the AI assistants is transmitted outside the EEA as stated in Annex 1 §7. Annex 1 §7 states each case, and §8.2 to §8.5 state the mechanisms.
8.2 The transfer that does occur. Faccilis is established in the United Arab Emirates — FACCILIS Enterprise Solutions L.L.C-FZ, licensed in the Meydan Free Zone, Dubai — a country for which the European Commission has not adopted an adequacy decision. Our personnel access Customer Personal Data from the UAE for support, maintenance, security and incident resolution, and certain Sub-processors may Process from outside the EEA as stated in Annex 3. These are restricted transfers, and the Customer instructs us to make them for those purposes.
8.3 Transfer mechanism. Where the GDPR applies to the Customer's Processing, the SCCs, Module Two (controller to processor), are incorporated into this DPA by reference and completed as set out in Annex 4. The Customer is the data exporter and Faccilis is the data importer. Annex 1 serves as Annex I.B of the SCCs, Annex 2 as Annex II, and Annex 3 as Annex III.
8.4 United Kingdom. Where the UK GDPR applies, the SCCs apply as amended by the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, completed as set out in Annex 4.
8.5 Switzerland. Where the FADP applies, the SCCs apply with the adaptations set out in Annex 4, including references to the Swiss Federal Data Protection and Information Commissioner as competent authority.
8.6 Government access requests. If we receive a legally binding request from a public authority for Customer Personal Data, we will, unless legally prohibited: notify the Customer without undue delay; challenge the request where there are reasonable grounds to consider it unlawful; and disclose only the minimum required. We will not voluntarily grant a public authority access to Customer Personal Data.
The indemnity in Terms §11 applies to this DPA, and extends to any claim, fine, penalty, proceeding, loss or cost arising out of: the Customer's breach of §4; the submission of data prohibited by §4.3; any instruction given by the Customer; or any determination that the Customer lacked a valid legal basis for the Processing.
10.1 One cap, not two. The limitations and exclusions in Terms §12 apply to this DPA and to the SCCs to the maximum extent permitted by law, and the liability arising under the Terms and under this DPA is subject to a single aggregate cap calculated under Terms §12.2 — not a separate cap for each document. Claims under this DPA reduce the amount available under the Terms, and vice versa.
10.2 What cannot be capped. §10.1 does not apply to, and nothing in this DPA purports to limit or exclude: (a) a Data Subject's rights under Article 82 GDPR; (b) liability towards a Supervisory Authority, including any administrative fine; or (c) the rights that Data Subjects have as third-party beneficiaries under the SCCs where Annex 4 applies. Where the SCCs apply, and only to the extent the GDPR so requires, they prevail over §10.1.
10.3 Apportionment. As between the parties, each party is liable for the damage caused by Processing that infringes the GDPR only to the extent it is responsible for that damage, in accordance with Article 82(2) and (5) GDPR. Where one party has paid full compensation, it may claim back from the other the part corresponding to that other party's responsibility. Nothing in this DPA makes us responsible for the Customer's obligations as Controller.
10.4 Fines. Each party bears its own administrative fines. We are not liable for any fine imposed on the Customer, except to the extent it is attributable to our breach of this DPA and subject to §10.1.
11.1 Order of precedence. As set out in §2.5.
11.2 Changes to this DPA. We may amend this DPA in accordance with Terms §15, and will do so where required by a change in applicable law, in the SCCs, or in our Sub-processors. Changes required by law take effect on the date the law requires.
11.3 Fees for assistance. Assistance under §5.5, §5.6 and §7 that goes beyond the Service's standard functionality and the standard documentation is chargeable at our then-current rates, with an estimate given before work begins, save where applicable law requires it to be provided free of charge.
11.4 Governing law and jurisdiction. This DPA is governed by DIFC law, and disputes are subject to Terms §16 — except for the SCCs in Annex 4, which are governed by the law and subject to the courts stated in Annex 4, as Clause 17 of the SCCs requires.
11.5 Contact. Data protection enquiries: legal@faccilis.com. We have not appointed a Data Protection Officer and are not required to do so; that address is the contact point for the purposes of this DPA.
1. Subject matter. Provision of the Convenio service: planning and management of employee attendance at business and professional events.
2. Duration. For the term of the Terms, plus the retention period in Terms §14.2.
3. Nature and purpose. Hosting, storage, organisation, retrieval, display, transmission by email and in-app notification, backup, and deletion or anonymisation of Customer Personal Data, in order to provide the Service and its support. This includes the recording of the Customer's external guests and their invitation and attendance status, entered by hand or imported from a file supplied by the Customer, and their export by the Customer. This also includes, for Customers whose subscription plan includes the AI assistants and who have not asked for them to be disabled, the transmission to an AI model provider of a User's typed question and, for the AI data assistant, of the Customer Data needed to answer it that the asking User is already permitted to see, in order to generate an answer about the Customer's own data or about how to use the Service, as described in §5 and §7 below.
4. Categories of Data Subjects.
5. Categories of Personal Data.
6. Special categories. None. Their submission is prohibited by §4.3 of this DPA.
7. Transfers outside the EEA.
Transfers made by Faccilis are covered by Annex 4. Transfers made by a Sub-processor within its own chain are covered by that Sub-processor's transfer mechanisms, as required by §6.4.
8. Retention. For the term, and thereafter in accordance with Terms §14.2 (deletion or anonymisation permitted after thirty days from termination). The free text of questions to the AI assistants is deleted ninety (90) days after it is submitted, irrespective of the term; the associated usage record is retained without the text, as a record of consumption. The conversation itself is held only in the User's browser for the duration of the session and is cleared at sign-out; no copy is kept on our systems. External guests are kept until the Customer removes them: a guest removed from the guests book who is on no event is deleted, and the Customer's administrators can permanently delete a guest on that person's request, which also removes them from every event. Anonymisation, rather than physical deletion, is the mechanism used when the Customer requires a User's data to be erased, in order to preserve the integrity of historical aggregated records; this is stated in Terms §9.4 and accepted by the Customer.
Measures in place for the Service as a whole, as at the effective date. They may be updated under §5.4 provided the overall level of security is not materially reduced.
Tenant isolation and access control
Authentication
Encryption
Logging and accountability
Segregation of environments
Change management and availability
Personnel
AI assistants — features of the Service
AI assistant tooling used for engineering and operations
Distinct from the feature described above. This concerns internal tools, not the Service's functionality.
Deletion and anonymisation
Stated honestly — measures NOT in place
These are stated because a security annex that overstates the position is a contractual promise that will not be met, and a Customer relying on it is the worse outcome of the two.
Entity names verified against each provider's own legal pages on 07/09/2026; the AI gateway role added 10/09/2026 and extended to the AI data assistant in version 1.1.
| Sub-processor | Role | Processing location | Notes |
|---|---|---|---|
| Supabase Pte. Ltd. (Singapore) | Database, authentication and storage infrastructure | Data at rest in the EU (AWS, EU region) | Holds all Customer Personal Data at rest. The contracting entity is Singaporean, not EU; Supabase's own sub-processors are largely US-based, and it discloses support access from the United States and Singapore under Standard Contractual Clauses |
| Lovable Labs Incorporated (Delaware, USA) | Application hosting, build and deployment and the AI gateway used by the AI assistants | No regional commitment — see the note in Annex 1 §7 | Serves the application front end from a globally distributed network. Lovable's terms state that it does not guarantee that data will be processed or stored in any particular country or region.<br><br>As AI gateway, it receives the data each AI assistant transmits, as listed in Annex 1 §5 — for the AI data assistant, including Customer Personal Data retrieved from the Service — and routes it to a model provider. Lovable's own model providers are OpenAI and Google, both established in the United States, and are listed in Lovable's sub-processor list at trust.lovable.dev. Lovable's DPA prohibits the use of Customer Personal Data for model training, and Lovable states publicly that the data of an application's own users is not used to train its models. The model provider does not use API data to train its models and retains it only in abuse-monitoring logs, for up to 30 days unless a longer period is required by law.<br><br>The specific model in use is a configuration choice within the providers named above; a change of model within them is not a change of Sub-processor |
| AhaSend B.V. (Netherlands, KvK 99533111) | Transactional email delivery | EEA — Germany and Finland (primary), Bulgaria (secondary), Norway | Recipient email addresses and message content; sending logs retained for a limited period per plan |
| Zoho Software Trading L.L.C (Dubai, UAE) | Support ticketing (Zoho Desk) | Data at rest in Zoho's EU data centre (Amsterdam, with Dublin as secondary) | Name, email and message content of Users who submit feedback or support requests. The contracting entity for a UAE-based customer is the Dubai entity, not Zoho's Netherlands entity. Zoho discloses occasional support access by its Indian entity under Standard Contractual Clauses |
| Microsoft Ireland Operations Limited (Ireland) | Business email (Microsoft 365) — the legal@ and info@faccilis.com mailboxes | United Arab Emirates (data at rest; verified 07/09/2026). Mail filtering in transit carries no residency commitment | Correspondence sent to us by the Customer or its Users, which may incidentally contain Personal Data of the Customer's personnel. Not used for the Service's own transactional email, which goes through AhaSend. Microsoft identifies this entity for EMEA customers, of which the UAE is one; it is not named for the UAE verbatim |
Deliberately not Sub-processors:
To be notified of changes to this Annex, write to legal@faccilis.com. Changes are governed by §6.
The SCCs (Commission Implementing Decision (EU) 2021/914, Module Two: controller to processor) are incorporated by reference and completed as follows. The official text is not reproduced here; it prevails over any summary.
| SCC provision | Selection |
|---|---|
| Module | Module Two (controller to processor) |
| Data exporter | The Customer, as identified in its Company registration |
| Data importer | FACCILIS Enterprise Solutions L.L.C-FZ, a limited liability company of the Meydan Free Zone, Dubai, United Arab Emirates (licence no. 2653583.01), of Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. |
| Clause 7 (docking clause) | Not included |
| Clause 9 (sub-processors) | Option 2 — general written authorisation, with a notice period of 30 days, as set out in §6 |
| Clause 11(a) (independent dispute resolution) | Optional wording not included |
| Clause 13 / competent authority | The Supervisory Authority of the EU/EEA member state in which the Customer is established, or, where the Customer is not established in the EU/EEA, that of the member state in which its Article 27 representative is established |
| Clause 17 (governing law) | The law of Ireland — an EU member state law that allows third-party beneficiary rights, as Clause 17 requires. This applies to the SCCs only; the rest of this DPA is governed by DIFC law (§11.4) |
| Clause 18 (choice of forum) | The courts of Ireland, for the SCCs only |
| Annex I.A (parties) | The Customer as exporter and controller; FACCILIS Enterprise Solutions L.L.C-FZ as importer and processor, at the address stated above. Activity relevant to the transfer: provision of the Convenio service as described in Annex 1. Contact for the importer: legal@faccilis.com. Signature and date: acceptance of the Terms and of this DPA at Company onboarding, recorded under Terms §2.3 |
| Annex I.B (description of transfer) | Annex 1 of this DPA. Frequency: continuous. Duration: as in Annex 1 §2 |
| Annex I.C (competent authority) | As stated for Clause 13 above |
| Annex II (technical and organisational measures) | Annex 2 of this DPA |
| Annex III (list of sub-processors) | Annex 3 of this DPA |
United Kingdom. Where the UK GDPR applies, the above is read with the ICO's International Data Transfer Addendum (version B1.0): Table 1 is completed with the parties above; Tables 2 and 3 with the selections above and Annexes 1 to 3; and in Table 4, neither party may terminate under Section 19 of the Addendum.
Switzerland. Where the FADP applies: references to the GDPR are read as references to the FADP; the competent authority is the Federal Data Protection and Information Commissioner; "member state" is read so as not to deprive data subjects in Switzerland of the right to sue in their place of habitual residence; and the SCCs also protect the data of legal entities until the FADP no longer affords them protection.