Data Processing Annex
1. Parties, scope and precedence
1.1 This Annex is between the Organizer and the Vibez Company that is the Organizer's Contracting Company under the Organizer Agreement (in this Annex, "Vibez"). The Vibez Companies are:
| Vibez Company | Registration | Registered address |
|---|---|---|
| Nuvo Innovative Solutions, Ltd (Israel) | Company no. 514334515 | 4 Ariel Sharon St, HaShachar Tower, Floor 25, Givatayim, Israel |
| Vibez Tech, Inc. (Delaware, USA) | Delaware file no. 7157668 | 228 Park Ave S, PMB 68367, New York, NY 10003, USA |
| Vibez Technologies (Cyprus) Ltd | HE 468445 | 4 Onisilou Street, Office 101, Strovolos, 2015 Nicosia, Cyprus |
1.2 This Annex forms part of the Organizer Agreement and governs Attendee Data. Where it conflicts with the body of the Agreement on data protection, this Annex governs.
1.3 It applies to the extent either party is subject to the Israeli Protection of Privacy Law 5741-1981 (as amended, including Amendment 13) and its regulations, the GDPR, the UK GDPR and Data Protection Act 2018, US state privacy laws, or any other applicable data protection law (together, "Data Protection Law").
1.4 Terms such as controller, processor, personal data, data subject and personal data breach have the meanings given in the applicable Data Protection Law. Under Israeli law, controller means the database controller (בעל מאגר) and processor means the holder (מחזיק).
1.5 "Attendee Data" means personal data of Buyers, ticket holders, members and attendees relating to the Organizer's Events and Project, as described in Annex 1.
2. Our roles: the map
2.1 Our roles differ by activity:
| Processing activity | Vibez | Organizer |
|---|---|---|
| Buyer account, sign-in, identity verification | Controller | Not involved |
| Payments (Vibez Payments), refunds, chargebacks, financial records | Controller | Not involved |
| Fraud prevention, platform security, abuse handling | Controller | Not involved |
| Explore, listings, recommendations, platform analytics and product improvement | Controller | Not involved |
| Vibez's own marketing to Buyers | Controller | Not involved |
| The Organizer's attendee list, member list and order data for its Events | Processor | Controller |
| Check-in, scanning, access control, guestlists | Processor | Controller |
| Custom checkout questions and the answers | Processor | Controller |
| Member lists and data the Organizer uploads or imports | Processor | Controller |
| Messages the Organizer sends to attendees and members through the Platform | Processor | Controller |
| Attendee Data the Organizer exports and uses outside the Platform | Not involved | Controller |
2.2 Where Vibez is a controller, it processes the data for its own purposes under its Privacy Policy, independently of the Organizer. Where Vibez is a processor, clause 9 applies.
2.3 Neither party is the other's processor except where this map says so, and the parties are not joint controllers.
3. Each party's own compliance
3.1 Each party will comply with Data Protection Law in respect of the processing for which it is controller.
3.2 Vibez will: give Buyers the privacy notice required for the processing it controls; maintain a lawful basis for it; and handle requests and complaints relating to that processing.
3.3 The Organizer will: maintain a lawful basis for its own processing; give its attendees and members any notice its processing requires beyond Vibez's Privacy Policy; ensure its instructions to Vibez are lawful; and handle requests and complaints relating to its own processing.
3.4 Neither party will put the other in breach of Data Protection Law by anything it does or asks for.
4. What the Organizer may do with Attendee Data, and what it may not
4.1 Permitted purposes. The Organizer may use Attendee Data only to:
a. operate and administer the Event the data relates to, including entry, access control, seating, accessibility, age verification and on-site service;
b. communicate with attendees about that Event, including changes, cancellation and practical information;
c. handle refunds, complaints, and safety or security incidents for that Event;
d. manage its membership relationship with members of its Project;
e. comply with a legal obligation;
f. market its own events and memberships, only under clause 4.5.
4.2 Prohibited. The Organizer will not:
a. sell, rent, license or trade Attendee Data;
b. disclose Attendee Data to any third party except a processor engaged under clause 4.3, or where legally required;
c. share Attendee Data with another organizer, promoter, venue or project, or combine it with another organizer's data;
d. enrich, append, match or profile Attendee Data against external sources, or upload it to build advertising audiences on third-party platforms, without a lawful basis and the attendee's consent where required;
e. use Attendee Data for any purpose unrelated to the Event or its membership relationship with that person;
f. retain Attendee Data after the period in clause 7.
4.3 The Organizer's own processors. The Organizer may engage processors (for example a mailing tool or a production company) provided each is engaged under a written contract on terms no less protective than this Annex, and the Organizer remains responsible for them.
4.4 Scanner and on-site access. The Organizer will issue scanner and on-site access only to individuals who need it to work the Event, will withdraw access when they no longer do, and is responsible for what those individuals do with Attendee Data.
4.5 Marketing. The Organizer warrants that, before it sends any marketing message to an attendee or member (through the Platform or otherwise), it holds that person's consent as required by applicable law, including section 30A of the Israeli Communications (Telecommunications and Broadcasting) Law 5742-1982 (prior explicit consent, the "פרסומת" label and a working opt-out), the ePrivacy rules in the EU and PECR in the UK. Consent given to Vibez is not consent given to the Organizer. Vibez may refuse, delay or block any message sent through the Platform that it reasonably believes lacks the required consent or labelling, or that has drawn complaints, and is not liable to the Organizer for doing so.
5. Data minimisation and custom fields
5.1 Vibez shares with the Organizer only the Attendee Data described in Annex 1.
5.2 Where the Organizer configures additional required fields or custom checkout questions, it instructs Vibez to collect that data as its processor and warrants that each field is necessary and proportionate for the Event, that it has a lawful basis for it, and that it will not require special-category data or a national identification number unless it has a specific legal requirement to do so and has told Vibez.
6. Security and payment data
6.1 Each party will implement appropriate technical and organisational measures to protect Attendee Data against unauthorised access, loss, alteration or disclosure, appropriate to the risk and, under Israeli law, to the security level that applies to the database under the Data Security Regulations 5777-2017.
6.2 Vibez's measures are described in Annex 2.
6.3 The Organizer will, at minimum: restrict access to those who need it; use unique credentials; not export Attendee Data to unsecured locations or personal devices beyond what the Event requires; and delete local copies under clause 7.
6.4 Own Provider Events. For Events where the Organizer uses its own payment provider, card data is collected by and sent to the Organizer's provider. Vibez does not receive, store or process card data for those Events; card details are tokenised by the payment gateway (BridgerPay) and routed to the Organizer's provider. Vibez keeps the gateway token, the card's first six digits and the gateway's transaction record; it never stores the full card number or security code. The Organizer is responsible for its own provider agreement and for its provider's compliance with PCI DSS and Data Protection Law.
7. Retention and deletion
7.1 The Organizer will retain Attendee Data it holds outside the Platform only as long as necessary for the permitted purposes, and in any event will delete or anonymise it within 24 months of the Event, except:
a. data relating to a person who is an ongoing member of the Organizer's Project, for as long as that membership continues;
b. what the Organizer must keep by law (tax, accounting, a legal claim).
7.2 On termination of the Organizer Agreement, or on Vibez's reasonable written request where there is a compliance concern, the Organizer will delete Attendee Data within 30 days and confirm deletion in writing.
7.3 Attendee Data that Vibez holds as processor is returned or deleted under clause 9.2(g). Data that Vibez holds as controller is retained under its Privacy Policy (§7 of the Privacy Policy).
8. Data subject requests, breaches and regulators
8.1 Requests. Each party handles requests relating to processing it controls. If either receives a request that relates to the other's processing, it will pass it on without undue delay and within 5 business days, and the parties will give each other the reasonable cooperation needed to respond in time.
8.2 Breach notification. A party that becomes aware of a personal data breach affecting Attendee Data will notify the other without undue delay and no later than 48 hours after becoming aware, with: what happened, when, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken. Where Vibez is processor, this is also the notice required by GDPR Art. 33(2) and reg. 15 of the Israeli Data Security Regulations.
8.3 Neither party will name the other in a notification to a regulator or to data subjects without first telling the other, unless legally required to do so immediately.
8.4 Each party will cooperate with the other in any regulator investigation or data-subject complaint relating to Attendee Data.
9. Where Vibez acts as processor
9.1 This clause applies to the processing activities for which clause 2.1 makes Vibez the Organizer's processor. Subject matter, nature, purpose, duration, data and data subjects are set out in Annex 1.
9.2 Vibez will, as GDPR Art. 28(3), UK GDPR Art. 28(3) and reg. 15 of the Israeli Data Security Regulations 5777-2017 require:
a. Instructions. Process Attendee Data only on the Organizer's documented instructions. The Organizer Agreement, this Annex and the Organizer's configuration and use of the Platform are its complete instructions. If Vibez is legally required to process otherwise, it will tell the Organizer first unless the law prohibits it, and will tell the Organizer if it believes an instruction infringes Data Protection Law.
b. Confidentiality. Ensure that personnel authorised to process Attendee Data are bound by confidentiality, and that access is limited to those who need it.
c. Security. Apply the measures in Annex 2, appropriate to the security level of the database.
d. Sub-processors. Engage sub-processors only under clause 10.
e. Assistance. Assist the Organizer, taking account of the nature of the processing, with data-subject requests, security, breach notification, data protection impact assessments and prior consultation with regulators.
f. Breach. Notify the Organizer of a personal data breach under clause 8.2.
g. End of processing. At the end of the Organizer Agreement, at the Organizer's choice, return the Attendee Data (by the Platform's export tools) or delete it within 90 days, save where Vibez must keep it by law or holds the same data as controller under clause 2.1.
h. No other use. Not use Attendee Data held as processor for any purpose other than providing the Platform to the Organizer, except under clause 9.3.
i. Compliance information. Make available the information reasonably needed to demonstrate compliance with this clause, report on its compliance once a year on request (Israeli reg. 15 periodic reporting), and allow audits under clause 12.
9.3 Vibez's own purposes. Clause 2.1 makes Vibez an independent controller of account, payment, fraud, Explore and marketing data. Processing for those purposes, including where the same data also sits in the Organizer's attendee list, is Vibez's own processing as controller under its Privacy Policy. It is not processing outside the Organizer's instructions and does not breach this clause.
10. Sub-processors
10.1 The Organizer gives Vibez general authorisation to engage the sub-processors listed in Annex 3, including the other Vibez Companies.
10.2 Vibez will engage each sub-processor under a written contract imposing data protection obligations no less protective than this Annex, and remains responsible to the Organizer for its sub-processors.
10.3 Vibez will give the Organizer at least 30 days' notice of any new or replacement sub-processor by updating Annex 3 and notifying the account email. The Organizer may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if it is not resolved, the Organizer may terminate the affected part of the Platform without penalty as its sole remedy.
11. International transfers
11.1 Attendee Data may be transferred to and processed in Israel, the European Economic Area, the United Kingdom and the United States, among the Vibez Companies and the sub-processors in Annex 3.
11.2 Transfer mechanisms. Where Data Protection Law restricts a transfer, the parties rely on:
a. Israel: the European Commission's adequacy decision for Israel (2011/61/EU, reconfirmed in the Commission's January 2024 review) and the UK's adequacy regulations for Israel;
b. United States: the EU-US Data Privacy Framework, UK Extension and Swiss-US DPF, where the recipient is self-certified; otherwise (including Vibez Tech, Inc., which relies on the clauses below) the 2021 EU Standard Contractual Clauses (Commission Decision 2021/914) with the UK International Data Transfer Addendum;
c. Intra-group: where the Contracting Company is outside the EEA (Nuvo or Vibez Tech, Inc.) and receives Attendee Data from the EEA or UK, the Vibez Companies' intra-group data transfer agreement applies, which incorporates the relevant SCC modules (Module 1 controller-to-controller, Module 2 controller-to-processor, Module 3 processor-to-processor) and the UK Addendum;
d. From Israel: the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations 5761-2001, including the undertakings they require of recipients, and the 2023 regulations on data originating in the EEA.
11.3 The SCCs, where used, are incorporated by reference and prevail over this Annex where they conflict.
11.4 Where the Organizer itself transfers Attendee Data out of the EEA, UK or Israel, it is responsible for its own transfer mechanism.
12. Records, evidence and audit
12.1 Each party will keep records of its processing of Attendee Data as required by Data Protection Law.
12.2 On reasonable written notice, no more than once a year unless there has been a breach or a regulator requires it, either party may request reasonable evidence of the other's compliance with this Annex. Audit rights are met first by documentation, certifications or a completed questionnaire; an on-site audit only where that is genuinely insufficient, at the requesting party's cost, under confidentiality, and without access to other customers' data.
13. Liability
13.1 Each party is responsible for its own breach of this Annex and of Data Protection Law.
13.2 Mutual indemnity. Each party indemnifies the other against third-party claims, regulatory fines and reasonable costs to the extent caused by its breach of this Annex or of Data Protection Law. For the Organizer this includes any use of Attendee Data outside clause 4, marketing without the consent required by clause 4.5, and any act of a person it gave access to under clause 4.4.
13.3 Cap. Liability under this Annex, including the indemnity in 13.2, falls under the general cap in clause 17.4 of the Organizer Agreement (the greater of the Platform Fees paid in the prior 12 months and ₪2,000 / US$500 / €500). There is no cap for wilful misconduct or fraud.
14. Israeli law: specific points
14.1 Each party will comply with the Protection of Privacy Law and its regulations, including the Data Security Regulations, and will classify its database at the correct security level.
Annex 1: Details of processing
Subject matter and nature: hosting, storing, displaying, organising and transmitting Attendee Data to provide the Platform's event, membership, check-in and messaging features to the Organizer. Duration: the term of the Organizer Agreement plus the return/deletion period in clause 9.2(g).
Data subjects: Buyers; people assigned a ticket by a Buyer; members of the Organizer's Project; attendees who top up a cashless balance.
Categories of Attendee Data:
| Category | Fields |
|---|---|
| Identity | first/last/nick name, avatar |
| Contact | phone number, email |
| Demographic | gender, date of birth, country |
| Identification | national ID number, only where the Organizer has required it |
| Social | Facebook, Instagram, TikTok handles |
| Ticketing | order number and status, ticket type, price paid, promo code, assignment and claim status, scan status and time, dynamic QR state |
| Membership | membership, tier, group, blacklist flag |
| Commercial history within the Organizer's Project | total purchases, number of orders, events participated |
| Custom | free-form data field and answers to any custom checkout questions the Organizer configured |
| Cashless | top-ups, balance, spend at the Organizer's Event |
| Messages | content, recipients and delivery status of messages the Organizer sends through the Platform |
Special categories: none intended. National ID numbers only where clause 5.2 allows.
Additionally exposed to scanner operators: name, avatar, ticket and scan status, date of birth, gender, national ID number.
Purposes: as in clause 4.1.
Annex 2: Security measures
Vibez maintains the following measures, reviewed at least yearly:
- Encryption: all traffic over TLS with HSTS; payment card data handled only by PCI DSS-certified providers; Vibez never stores full card numbers or security codes.
- Authentication and access: passwords stored as bcrypt hashes; signed, expiring tokens for organizer sessions; one-time codes for buyer sign-in, rate-limited per person and per IP; organizer access by role (owner, admin, ambassador, cash ambassador); staff access limited to those who need it.
- Logging and monitoring: a change record for orders, payments, items, memberships and events; real-time error monitoring.
- Hosting and backup: managed cloud hosting and databases with provider-managed backups and recovery.
- Vendor management: sub-processors bound by written data-protection terms (Annex 3).
- Incident response: breach notification under clause 8.
- Israeli Data Security Regulations 5777-2017: measures appropriate to the database's security level.
Annex 3: Sub-processors
The list is kept current: 30 days' notice of changes (clause 10.3).
| Sub-processor | Role | Data | Location |
|---|---|---|---|
| Nuvo Innovative Solutions, Ltd (Vibez Company) | R&D, hosting operations, customer support | All Attendee Data | Israel |
| Vibez Tech, Inc. (Vibez Company) | Operations for US projects | Attendee Data for US projects | USA |
| Vibez Technologies (Cyprus) Ltd (Vibez Company) | Operations for EUR projects | Attendee Data for EUR projects | Cyprus |
| BridgerPay | Payment gateway | Payment and order data | Israel / EU |
| Shva | Card processing (ILS) | Payment data | Israel |
| Stripe (EU and US accounts) | Card processing (EUR / USD) | Payment and order data | EU / USA |
| Twilio | SMS and WhatsApp messages | Phone number, message content | USA |
| SendGrid (Twilio) | Email address, message content | USA | |
| OpenAI | Help assistant (Vee) | Questions typed into the assistant | USA |
| Heroku (Salesforce) | Hosting and databases | All Attendee Data | USA |
| Cloudinary | File and image storage | Profile photos, uploaded answers | USA |
| Mogo | SMS to Israeli numbers | Phone number, message content | Israel |
| Expo | App push notifications | Push token, message content | USA |
| Sentry | Error monitoring | Technical data, may include person and order IDs | USA |
| Zoho (Desk / CRM) | Customer support | Support correspondence, contact details | USA |
| Google (Workspace, Analytics) | Email, analytics | Correspondence; usage data | USA / EU |
| Meta | Advertising pixels | Device and event data | USA |
| Microsoft Clarity | Session analytics on marketing pages | Device and usage data | USA |