On this page
In Summary
This Data Processing Agreement ("DPA") forms part of the agreement between Aurelo Technologies ("Anchor") and organizations using the Anchor platform. It explains how personal data is processed when providing the Services.
Table of Contents
- Purpose
- Definitions
- Scope
- Roles of the Parties
- Processing Instructions
- Categories of Personal Data
- Categories of Data Subjects
- Security Measures
- Confidentiality
- Subprocessors
- International Data Transfers
- Security Incidents
- Data Subject Rights
- Retention & Deletion
- Audit Requests
- Limitation of Liability
- Contact
- Annex A
- Annex B
- Annex C
1. Purpose
This DPA governs the processing of Personal Data by Anchor when providing the Services to organizations.
2. Definitions
- Controller – Determines the purposes and means of processing.
- Processor – Processes Personal Data on behalf of a Controller.
- Personal Data – Information relating to an identified or identifiable individual.
- Services – The Anchor platform and related services.
3. Scope
This DPA applies whenever Anchor processes Personal Data on behalf of a customer using the Services.
4. Roles of the Parties
- The Customer is generally the Controller of attendee and organizational data.
- Anchor acts as the Processor for that data while delivering the Services.
Event organizers are responsible for the attendee information they collect through events hosted on Anchor. Anchor processes and stores this information to provide the Services, maintain platform security, comply with legal obligations, and improve our Services.
5. Processing Instructions
Anchor processes Personal Data only:
- To provide the Services.
- On documented customer instructions.
- To comply with applicable legal obligations.
- To maintain platform security and reliability.
6. Categories of Personal Data
Examples include:
- Names
- Email addresses
- Phone numbers
- Organization information
- Ticketing information
- Donation records
- Authentication information
Anchor does not store payment card details.
7. Categories of Data Subjects
- Event attendees
- Organization administrators
- Team members
- Donors
- Platform users
8. Security Measures
Security measures include:
- HTTPS/TLS
- bcrypt password hashing
- JWT authentication
- Multi-Factor Authentication (MFA)
- Role-Based Access Control
- Monitoring and logging
- Backup procedures
9. Confidentiality
Authorized personnel with access to Personal Data are subject to confidentiality obligations.
10. Subprocessors
Anchor uses approved subprocessors where necessary to deliver the Services.
Current subprocessors are documented separately in the Subprocessors document.
11. International Data Transfers
Personal Data may be processed in:
- Ghana
- United States
- Germany
- United Kingdom
Appropriate safeguards are applied where required.
12. Security Incidents
Anchor maintains documented incident response procedures and will notify customers of qualifying security incidents where required by applicable law.
13. Data Subject Rights
Anchor assists customers, where appropriate, in responding to requests involving access, correction, deletion, or other applicable privacy rights.
14. Retention & Deletion
- Active account data is retained until deletion.
- Soft-deleted accounts are retained for 30 days.
- Transaction records may be retained for 7 years.
- Security logs may be retained for up to 12 months.
15. Audit Requests
Reasonable audit requests may be considered subject to confidentiality, security, and operational limitations.
16. Limitation of Liability
Liability under this DPA is governed by the applicable Terms & Conditions unless otherwise agreed in writing.
17. Contact
Legal: legal@technologies.aurelo.cc
Support: support@technologies.aurelo.cc
18. Annex A
Processing Activities
- Event management
- Ticketing
- Donations
- Authentication
- Analytics
- Customer support
19. Annex B
Technical and Organizational Measures
- Encryption in transit
- Access controls
- Logging
- Monitoring
- Backup procedures
- Incident response
20. Annex C
Approved Subprocessors are maintained in the standalone Subprocessors document.