Data Processing Addendum

This Data Processing Addendum (“DPA”) supplements an agreement between SpooLoo LLC d/b/a SpooLink and an eligible merchant, municipal, or enterprise customer when SpooLink processes personal data on that customer’s behalf. It does not replace the SpooLink Privacy Policy or apply where SpooLink determines the purposes and means of processing as an independent controller or business.

For covered customer personal data, the customer acts as controller or business and SpooLink acts as processor or service provider, as those terms are defined by applicable law. SpooLink processes covered data to provide, secure, support, and improve the contracted services; comply with documented lawful instructions; and meet legal obligations.

Covered processing may include event and attendee records, ticket orders, assigned seats and tables, temporary reservation and hold records, QR and admission activity, POS purchaser and receipt records, staff permissions, support communications, and customer-provided branding assets or AI inputs, to the extent processed on the customer’s behalf under the applicable agreement. Data subjects may include attendees, purchasers, customer personnel, and other individuals whose data the customer lawfully provides.

SpooLink does not use covered customer personal data, AI inputs, or AI outputs to train or fine-tune AI models without the customer’s prior written consent. A payment, calendar, or meeting provider may separately act in an independent role under its own terms and privacy notice; that processing is not converted into covered processing by this DPA.

The customer is responsible for lawful collection, notices, consents, instructions, account permissions, data accuracy, and responding to individuals. The customer will not provide sensitive or regulated data unless the applicable agreement and SpooLink documentation expressly permit it.

SpooLink will require personnel authorized to process covered data to protect its confidentiality and will maintain reasonable administrative, technical, and organizational safeguards appropriate to the services and risks. No system can be guaranteed completely secure.

SpooLink may use subprocessors to provide hosting, database, authentication, payment integration, communications, support, analytics, AI-assisted generation, and related services. When the customer requests an AI feature, relevant prompts and reference images may be provided to the AI subprocessor to perform that request. SpooLink remains responsible for imposing data-protection obligations appropriate to the services performed. Customers requiring a current subprocessor list or contractual notice process may contact support@spoolink.com.

Taking into account the nature of processing, SpooLink will provide reasonable assistance with data-subject requests, security inquiries, impact assessments, regulatory consultations, and compliance information when required by applicable law and the customer agreement.

SpooLink will notify the customer without undue delay after confirming a breach of covered customer personal data when notice is required by applicable law or contract. Notice does not constitute an admission of fault or liability.

At the end of the applicable services, SpooLink will delete or return covered customer personal data as required by the agreement, subject to legal retention requirements, security records, backup cycles, dispute preservation, and data SpooLink processes in another lawful role.

If covered processing requires an international data-transfer mechanism, the parties will use a legally recognized mechanism appropriate to the transfer and jurisdiction. Additional terms may be executed when required.

This public DPA is informational unless incorporated into a signed order form, municipal or enterprise agreement, or other written agreement authorized by SpooLink. Contact support@spoolink.com to request an applicable executed version or discuss organization-specific requirements.