Data Processing Agreement

1. Introduction and Scope

When organizers use the Wayfield platform to manage workshops, they collect personal data from their participants — for example, names, email addresses, and attendance records. In this context, the organizer is the Data Controller who determines the purposes and means of processing that personal data. Wayfield, Inc. is the Data Processor, processing personal data on the organizer’s behalf and only in accordance with the organizer’s documented instructions as set out in this DPA and the Wayfield Terms of Service.

This DPA applies to all personal data processed by Wayfield on behalf of organizer customers in connection with the delivery of the Wayfield workshop management service. It supplements and forms part of the Wayfield Terms of Service.

If you require a signed, countersigned copy of this DPA for your own compliance records or vendor management processes, please contact us at privacy@wayfieldapp.com.

2. Definitions

Terms used in this DPA have the meanings given in UK GDPR and EU GDPR (as applicable):

• Personal Data: any information relating to an identified or identifiable natural person (Article 4(1) GDPR).
• Processing: any operation performed on personal data, whether or not by automated means (Article 4(2) GDPR).
• Controller: the natural or legal person who determines the purposes and means of processing (Article 4(7) GDPR) — the organizer in this context.
• Processor: a natural or legal person who processes personal data on behalf of the controller (Article 4(8) GDPR) — Wayfield, Inc. in this context.
• Data Subject: the identified or identifiable natural person to whom the personal data relates — typically workshop participants and leaders.
• Sub-Processor: any processor engaged by Wayfield to carry out processing activities on the controller’s behalf.
• UK GDPR: the UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018.
• Supervisory Authority: the Information Commissioner’s Office (ICO) in the UK, or the relevant national data protection authority in the EU.

3. Processing Details

Subject Matter

The delivery of workshop management services via the Wayfield platform, including participant registration, session scheduling, attendance tracking, and organizer communications.

Duration of Processing

Processing continues for the duration of the organizer’s active subscription to Wayfield, and for any applicable data retention period following termination as described in our Privacy Policy and this DPA.

Nature and Purpose of Processing

• Collecting participant registration information submitted via Wayfield workshop pages
• Storing participant records and session selections in the Wayfield database
• Displaying participant information to authorised organizer and leader accounts
• Processing attendance records during and after workshop sessions
• Sending transactional communications to participants (booking confirmations, reminders)
• Processing payments for paid workshops and maintaining payment records

Types of Personal Data Processed

• Full name
• Email address
• Contact information (where provided)
• Workshop and session selections
• Attendance and check-in records
• Payment information (billing name; card data held by Stripe — see Section 7)
• Any additional information voluntarily provided by the participant to the organizer

Categories of Data Subjects

• Workshop participants enrolled in the organizer’s workshops
• Workshop leaders assigned by the organizer
• Organizer account holders and their team members

4. Processor Obligations

As Data Processor, Wayfield, Inc. commits to the following obligations:

• Process only on instructions: We will process personal data only in accordance with the organizer’s documented instructions, including as set out in these terms, unless required to do otherwise by applicable law (in which case we will notify the organizer unless prohibited by law).
• Confidentiality: All personnel authorised to process personal data are bound by enforceable confidentiality obligations.
• Security measures: We implement and maintain appropriate technical and organizational security measures as described in Section 7.
• Breach notification: We will notify the organizer of a personal data breach affecting their data without undue delay, and no later than 72 hours after becoming aware of it, providing sufficient detail to allow the organizer to meet their own breach reporting obligations.
• Assistance with obligations: We will provide reasonable assistance to the organizer in fulfilling their obligations under applicable data protection law, including data subject rights requests, data protection impact assessments, and prior consultation with supervisory authorities.
• Deletion or return: Upon termination of the organizer’s subscription, we will, at the organizer’s choice, delete or return all personal data unless applicable law requires continued storage.
• Audit information: We will make available all information reasonably necessary to demonstrate compliance with this DPA, and will permit and contribute to audits as described in Section 9.

5. Sub-Processors

Wayfield uses third-party sub-processors to deliver the platform. A current list of sub-processors is maintained at /legal/subprocessors.

Before engaging a new sub-processor or materially changing an existing sub-processor arrangement that involves the processing of organizer personal data, Wayfield will provide at least 30 days’ prior written notice (by email to the organizer’s registered account email or via in-app notice).

The organizer may object to a new or changed sub-processor arrangement by notifying privacy@wayfieldapp.com within 14 days of the notice. Where a legitimate objection cannot be resolved, the organizer may terminate their subscription with a prorated refund of any prepaid fees.

Wayfield imposes data protection obligations on sub-processors equivalent to those in this DPA and remains liable to the organizer for sub-processor compliance.

6. Data Subject Rights

The organizer (as Data Controller) is responsible for responding to data subject requests relating to personal data processed on the platform (e.g. access, rectification, erasure, restriction, portability). Wayfield will, upon request, provide reasonable technical assistance to help the organizer fulfil such requests within the timescales required by applicable law.

Where a participant contacts Wayfield directly with a data subject request relating to data processed by an organizer, Wayfield will forward the request to the relevant organizer without undue delay.

7. Security Measures

Wayfield implements the following technical and organizational security measures to protect personal data processed under this DPA:

• Encryption of personal data in transit using TLS 1.2 or higher
• Encryption of personal data at rest using AES-256
• Role-based access controls limiting data access to authorised personnel
• Multi-factor authentication for administrative and privileged access
• Regular vulnerability testing and dependency updates
• Audit logging of access to personal data by platform staff
• Incident response procedures including breach detection and notification

Full details of our security practices are set out in our Security Policy.

8. International Data Transfers

Wayfield is based in the United Kingdom. Where we engage sub-processors located outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are in place for any transfer of personal data, including:

• Transfers to countries covered by UK adequacy regulations or EU adequacy decisions
• Standard Contractual Clauses (SCCs) as approved by the ICO (UK) or the European Commission (EU) where no adequacy decision exists
• Other appropriate safeguards as permitted under UK GDPR Article 46

Details of transfers and applicable safeguards for each sub-processor are included in the sub-processor list at /legal/subprocessors.

9. Audit Rights

The organizer (as Data Controller) has the right to audit Wayfield’s compliance with this DPA. To exercise this right:

• The organizer must provide at least 30 days’ prior written notice to privacy@wayfieldapp.com
• Audits are limited to once per calendar year unless a confirmed personal data breach has occurred
• Audits must be conducted during business hours and must not unreasonably disrupt Wayfield’s operations
• Wayfield may satisfy audit requests by providing up-to-date third-party audit reports or certifications in lieu of a direct audit, where reasonably appropriate

Audit costs are borne by the organizer unless the audit reveals a material breach of this DPA by Wayfield, in which case Wayfield will bear reasonable audit costs.

10. Liability

Each party shall be liable for its own breaches of applicable data protection law and the obligations set out in this DPA. Where a data subject suffers damage due to a breach of applicable data protection law, each party is responsible for the damage caused by its own non-compliance.

Wayfield’s total aggregate liability under this DPA in connection with any claim is subject to the overall limitation of liability set out in the Wayfield Terms of Service.

11. Governing Law

This DPA is governed by the laws of Minnesota, United States. Any disputes arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of Minnesota, United States, without prejudice to any mandatory rights of data subjects under applicable data protection law.

12. Contact

For all data processing and privacy inquiries, or to request a signed copy of this DPA:

• Email: privacy@wayfieldapp.com
• Company: Wayfield, Inc.
• Address: 638 Bates Ave., St. Paul, MN 55106