Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer (the "Controller") and Innovafour, operator of IForevents (the "Processor"), for the processing of personal data contained in Customer Data. It applies whenever GDPR, the UK GDPR or a similar law applies to the Controller's use of the Service.

Data Processing Overview

• Subject matter: hosting, storing, aggregating and displaying analytics events the Controller sends through the SDKs, the HTTP API or integrations.
• Duration: the term of the Service agreement plus the deletion period in the Privacy Policy.
• Nature and purpose: collection at the Controller's direction, storage in the Controller's project, aggregation for dashboards, exports and MCP answers; no other use.
• Categories of data subjects: the Controller's end users, customers and staff whose actions the Controller tracks.
• Categories of data: event names, timestamps, properties chosen by the Controller, device and browser attributes, the client address of ingest requests, and any identifiers the Controller assigns.
• Instructions: the Controller instructs the Processor through the Service's configuration and APIs; the Processor processes only on documented instructions and informs the Controller if an instruction appears to infringe the law.

Subprocessors

The Processor notifies Controllers of new subprocessors at least 30 days in advance by email to organization owners; the Controller may object on reasonable data-protection grounds, in which case the parties seek a solution or the Controller may terminate the affected Service.

Security Measures in Place

Encryption in transit (TLS 1.2+), backups on access-controlled storage, tenant isolation verified by automated tests on every release, role-based access with an audit log of security actions, hashed credentials, secrets held in a vault with a rotation schedule, rate limiting and quota enforcement, dependency vulnerability scanning, nightly backups with a quarterly restore drill, and monitoring with paging alerts. A security review checklist and its findings are kept and updated by the Processor.

Incident Response Procedures

The Processor notifies the Controller of a personal data breach affecting Customer Data without undue delay and within 72 hours of becoming aware, with the information available at that time (nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, measures taken), followed by updates as the investigation proceeds. The Processor keeps an incident record and follows its documented severity and escalation procedure.

Data Subject Request Process

Requests from data subjects about Customer Data are forwarded to the Controller within 5 business days without answering them directly. The Service gives the Controller the tools to respond: export of every event for a user identifier and deletion of that identifier's data through the privacy endpoints of the API, and the audit log to evidence the action. The Processor assists with data protection impact assessments and consultations with supervisory authorities where the Controller reasonably requests it.

Compliance Certifications Status

No third-party certification (SOC 2, ISO 27001) has been obtained yet. The Processor follows the controls described above and makes its security review, alert runbooks and restore drill records available to Controllers on request under confidentiality. Certification plans are announced on the release notes.

Audit and Inspection Rights

Once per year, or after a breach, the Controller may audit the Processor's compliance with this DPA by written questionnaire or, where a questionnaire is insufficient, by an on-site or remote inspection at the Controller's cost, on 30 days' notice, during business hours, under confidentiality and without disrupting other customers.

Deletion and Return

At the end of the Service the Processor deletes Customer Data within 30 days (backups within the following 30 days) unless the law requires retention; before deletion the Controller may export its data through the API.

International Transfers

Transfers outside the EU/EEA or the UK rely on the Standard Contractual Clauses (module two, controller to processor) and the UK addendum, incorporated by reference into this DPA.