Last Updated: April 14, 2025

This Data Processing Agreement (“Agreement”) explains how personal data of Clients is handled when processed by Ego Events Media Group (“The Ego”) and Vendors.

This Agreement is incorporated into and forms part of the platform’s Privacy Policy and Vendor Service Agreement.

---

1. Definitions

“Controller” — the entity that determines the purpose and means of processing personal data.

“Processor” — the entity that processes data on behalf of the Controller.

“The Ego” — platform operator and initial data collector.

“Vendor” — independent service provider who receives client data.

“Client” — user whose personal data is processed for booking or inquiry.

“Personal Data” — any data relating to an identified or identifiable person.

---

2. Data Controller Relationships

The Ego acts as:

• Data Controller for user accounts and platform-level data.
• Data Processor when transmitting client data to Vendors for fulfillment of bookings.

Vendors act as:

• Independent Data Controllers for client data received from bookings.
• Responsible for compliance with GDPR.

Vendors are NOT data processors of The Ego — they are separate controllers.

---

3. Purpose of Data Processing

Client data is shared with the Vendor solely for:

• communication regarding bookings
• service delivery
• identity confirmation
• scheduling and logistics
• post-service communication where relevant

Vendors may NOT use client data for:

• spam
• mass marketing
• third-party sale or distribution
• unrelated promotional activity
• data harvesting
• data profiling

---

4. Data Categories

Vendors may receive access to:

• name
• email address
• phone number
• event-related details
• booking information
• notes added by the client

Vendors may NOT request:

• passport or CNP data
• ID documents
• financial data
• sensitive personal data
  unless legally required and explicitly consented.

---

5. Legal Basis of Processing

Personal data is processed under GDPR legal grounds:

• performance of a contract (booking)
• consent given by Client
• legitimate interest

---

6. Vendor Responsibilities (CRITICAL)

Vendor must:

• store data securely
• prevent unauthorized access
• not share data with external parties
• delete client data upon request
• comply with deletion and access rights under GDPR
• notify The Ego of any data breach involving client data

---

7. Client Rights Under GDPR

Clients may request:

• access to their data
• correction of data
• deletion of data
• restriction of processing
• objection to processing
• data portability

Requests may be made to:

📧 egoeventsmediagroup@yahoo.es

or directly to Vendor if they hold the data.

---

8. Data Retention

Client data must be retained only:

• for the duration of the booking process
• during service execution
• maximum for a reasonable post-service period
  (unless legal obligations require longer retention)

Vendor must NOT retain data permanently without explicit legal basis.

---

9. Data Breach Notifications

In case of a data breach involving Client information:

Vendor must notify The Ego immediately.

The Ego may notify:

• affected clients
• EU data protection authorities

if legally required under GDPR.

---

10. Processor Subcontracting

Vendor may NOT:

• outsource client data
• transfer client data to subcontractors
• share with external collaborators

unless:

• Client is informed
• and Client gives explicit consent
• and confidentiality is guaranteed

---

11. International Data Transfer

Vendor may not transfer EU citizen data outside the EU/EEA unless:

• adequate safeguards are in place
• Standard Contractual Clauses (SCC) apply
• compliance with GDPR international transfer rules

---

12. Termination of Data Access

When:

• booking is cancelled
• service is completed
• vendor is removed from platform

Vendor must:

• delete all client data
• cease processing
• retain only data required by tax or legal obligations

---

13. Liability

Vendor accepts full liability for:

• misuse of Client data
• unauthorized disclosure
• GDPR breaches
• improper storage or transfer

The Ego is not liable for GDPR violations committed by Vendor.

---

14. Governing Law

This Agreement is governed by EU GDPR regulations and Romanian privacy law.

---

15. Acceptance

By operating as a Vendor or processing booking data, the Vendor acknowledges and agrees to this Data Processing Agreement.