Data Processing Addendum

How Blend processes personal data on behalf of Organizers who use the platform, and how we support Organizers in meeting their own data-subject request obligations.

1. Who we are

Blend FZC LLC (“Blend”, “we”, “us” or “our”) is a Free Zone Company registered with the Sharjah Publishing City Free Zone Authority, United Arab Emirates, Licence No. 4417899.01, of Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE. This Data Processing Addendum (“DPA”) describes how Blend processes personal data on behalf of Organizers who use the Blend ticketing, registration, access-control and cashless-payment platform (the “Platform”).

2. Purpose and scope

This DPA forms part of, and is incorporated into, the agreement between an Organizer and Blend governing the Organizer’s use of the Platform (the “Terms”). It applies whenever Blend processes personal data as a processor on the Organizer’s behalf, and reflects the intent of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), applicable Lebanese data-protection provisions, and, where applicable, the EU/UK General Data Protection Regulation (“GDPR”). Capitalized terms not defined here have the meaning given in the Terms of Service or Privacy Policy. If there is a conflict between this DPA and the Terms concerning the processing of personal data, this DPA prevails.

3. Definitions

• Attendee Data: personal data of an Organizer’s attendees, ticket purchasers and other individuals that Blend processes to deliver the Platform to that Organizer, including names, contact details, order and ticketing records, and check-in and access data.
• Controller, Processor, Data Subject, Processing and Personal Data Breach have the meanings given under Applicable Data Protection Law, including, where relevant, GDPR Article 4.
• Sub-processor: any third party engaged by Blend to process Attendee Data in order to provide the Platform.
• Applicable Data Protection Law: the UAE Personal Data Protection Law, applicable Lebanese data-protection provisions, the EU/UK GDPR, and any other data-protection law that applies to the processing described in this DPA.

4. Roles of the parties

• For Attendee Data generated through an Organizer’s Events, the Organizer is the controller and Blend is the processor, processing Attendee Data only on the Organizer’s documented instructions, as set out in this DPA, the Terms, and the Organizer’s configuration of the Platform.
• Blend independently determines the purposes and means of processing account, device and platform-usage data that Blend collects directly for its own purposes, such as fraud prevention, security and improving the Platform, and acts as an independent controller for that processing, as described in the Privacy Policy.
• Where an Organizer engages Blend as a sub-processor of the Organizer’s own controller (for example, a brand, venue or agency the Organizer represents), the parties will document that relationship separately where needed, and this DPA applies to that processing to the extent relevant.

5. Processing instructions and scope

• Subject matter. Provision of the Blend ticketing, registration, access-control, cashless-payment and related event-technology services to the Organizer.
• Duration. For the term of the Terms between the Organizer and Blend, and thereafter as described in Section 12 (Return and deletion of data).
• Nature and purpose of processing. Collection, storage, organization, retrieval, use, disclosure and deletion of Attendee Data as needed to sell and issue Credentials, process payments, run check-in and access control, operate cashless features, provide support, prevent fraud, and generate the Organizer’s own reporting and analytics.
• Categories of data subjects. The Organizer’s attendees, ticket purchasers, and other individuals who interact with the Organizer’s Events through the Platform.
• Categories of personal data. Identity and contact details, order and transaction data, attendance and check-in records, device and usage data, and any other personal data the Organizer collects through the Platform’s forms, integrations or custom fields.

Blend will process Attendee Data only on the Organizer’s documented instructions, including instructions given through the Platform’s configuration and features, unless Blend is required to do otherwise by law, in which case Blend will inform the Organizer before processing on that basis, unless the law prohibits Blend from doing so. Blend will promptly inform the Organizer if, in Blend’s reasonable opinion, an instruction infringes Applicable Data Protection Law.

6. Personnel

Blend ensures that personnel authorized to process Attendee Data are subject to appropriate confidentiality obligations, receive data-protection training relevant to their role, and access Attendee Data only to the extent necessary to perform that role.

7. Security measures

Blend maintains technical and organizational measures designed to protect Attendee Data, including:

• Encryption of Attendee Data in transit and at rest.
• Role-based access control, so that personnel and systems can access only the Attendee Data needed for their function.
• Audit logging of access to, and changes within, production systems that handle Attendee Data.
• Tenant isolation, so that one Organizer’s Attendee Data is logically segregated from another’s.
• A documented incident-response process, including notice to the affected Organizer without undue delay after Blend becomes aware of a Personal Data Breach affecting that Organizer’s Attendee Data, together with information reasonably available to Blend to help the Organizer meet its own notification obligations.
• Regular review and testing of these measures, and, where applicable, participation in independent security assessments of the Platform.

8. Sub-processors

The Organizer authorizes Blend to engage Sub-processors to provide the Platform, provided Blend imposes data-protection obligations on each Sub-processor that are substantially no less protective of Attendee Data than this DPA. Blend remains responsible to the Organizer for a Sub-processor’s performance of those obligations. Blend currently engages Sub-processors in the following categories:

A current list of Sub-processor categories is available on request to privacy@blendapp.ai. Blend will give the Organizer reasonable notice of an intended addition or replacement of a Sub-processor, so the Organizer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Organizer may terminate the affected part of the service as its exclusive remedy.

9. International transfers

Attendee Data may be transferred to, and processed in, countries other than the Organizer’s or the relevant data subject’s country of residence, including the UAE and jurisdictions where Blend’s Sub-processors operate. Where such a transfer occurs, Blend will apply the safeguards required by Applicable Data Protection Law, such as standard contractual clauses, an applicable adequacy decision, or another lawful transfer mechanism, and will make information about the safeguards used available to the Organizer on request.

10. Data subject requests

• Blend provides the Organizer with tooling within the Platform to identify, export, correct and delete an individual Attendee’s data, so the Organizer can respond to access, rectification, erasure, restriction, portability and objection requests it receives as controller.
• Where Blend receives a request directly from a data subject relating to Attendee Data, Blend will inform the Organizer without undue delay and will not respond to the individual directly, other than to direct them to the Organizer, unless required by law or agreed with the Organizer.
• Taking into account the nature of the processing, Blend will provide the Organizer with reasonable assistance to help the Organizer meet its obligations to respond to data-subject requests, and its other obligations under Applicable Data Protection Law, including data-protection impact assessments and prior consultation with a supervisory authority where required.

11. Audit rights

On reasonable prior written notice, and no more than once every twelve months unless required by a supervisory authority or triggered by a Personal Data Breach, the Organizer, or an independent auditor bound by confidentiality, may request information reasonably necessary to demonstrate Blend’s compliance with this DPA. Blend will provide this in the form of relevant documentation, a completed security questionnaire, or a summary of an independent audit or certification report, where one exists. Blend may charge a reasonable fee for an audit that goes beyond this, and may restrict on-site access to its systems and facilities for security and confidentiality reasons.

12. Return and deletion of data

On termination of the Terms, and subject to Blend’s own legal retention obligations described in the Privacy Policy (for example, tax and financial records), Blend will, at the Organizer’s choice, delete or return Attendee Data within a reasonable period, and will delete existing copies unless retention is required by law.

13. Liability

Liability arising out of or in connection with this DPA is subject to the limitation of liability set out in the Terms of Service. Nothing in this DPA relieves either party of an obligation that cannot lawfully be excluded or limited under Applicable Data Protection Law.

14. Term and termination

This DPA takes effect on the date the Organizer first accepts the Terms and continues for as long as Blend processes Attendee Data on the Organizer’s behalf. It terminates automatically on termination of the Terms, subject to Section 12 (Return and deletion of data), which survives termination.

15. Governing law

This DPA is governed by the same governing law and dispute-resolution provisions as the Terms of Service, without prejudice to any right or protection that mandatory Applicable Data Protection Law gives to a data subject.

16. Contact

Data-protection enquiries: privacy@blendapp.ai
Blend FZC LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates.

Questions about this policy? Contact us.