Usetix

Data Processing Agreement

Last updated: 8 October 2026

This agreement on processing personal data on behalf of a controller under Art. 28 GDPR applies between the organizer using a Usetix account (“Controller”) and Screen Island GmbH as the operator of Usetix (“Usetix”). It is part of the Terms of Service and is concluded when they are accepted at registration or when an organizer account is set up. No separate signature is required; the electronic form is sufficient (Art. 28(9) GDPR).

How Usetix processes data as a controller in its own right, such as organizers' accounts and billing data, is described in the Privacy Policy.

1. Subject matter and duration

Usetix provides the Controller with a ticketing platform: shop, ticket sales and delivery, admission, guest lists, gift vouchers, lounge bookings, emails to buyers including newsletters, reports, integrations, AI features and support. In doing so, Usetix processes personal data on behalf of the Controller.

This agreement applies for as long as the Controller uses a Usetix account and ends when the account is deleted (section 10).

2. Nature and purpose of processing, types of data and data subjects

Nature of processing: collecting, storing, organizing, displaying, transmitting (for example sending tickets by email), analyzing and erasing.

Purpose: providing the agreed services to the Controller.

Data subjects: ticket buyers and guests, people on guest lists and with lounge bookings, buyers and holders of gift vouchers, promoters and applicants, people who sign up through the Controller's forms, and the Controller's team members.

Types of data:

  • Contact data: name, email address, phone number where collected
  • Billing data: company, address, VAT identification number
  • Order, ticket and payment status data; card and account data are processed exclusively by the payment providers
  • Admission and check-in data
  • Answers to questions the Controller asks
  • Voucher and booking data
  • Communication data: emails to buyers and their delivery status
  • Consents, for example to marketing emails
  • Newsletters: recipients, delivery status, unsubscribes, opens and clicks
  • Shop statistics, only with visitors' consent
  • Team members' names, email addresses and roles, and the account's activity log
  • Promoter programs: applications with answers and picture, promoters' guest lists with channel and check-in, daily streaks, visit counts of guest list links, rankings and messages to the crew

Processing special categories of personal data (Art. 9 GDPR) is not intended. If the Controller collects such data through its own questions, it does so under its own responsibility.

Usetix keeps the suppression list of permanently undeliverable addresses and spam complaints from newsletters across all accounts under its own responsibility (Privacy Policy, section 3.8): an address on it receives no newsletters from any organizer.

Usetix keeps promoters' Usetix logins with their profile picture, social media handles and devices for push notifications under its own responsibility, because promoters use them with several organizers (Privacy Policy, section 3.9).

3. Instructions

Usetix processes personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless Usetix is required to do so by law. In that case, Usetix informs the Controller of that requirement before processing, unless the law prohibits this.

Instructions are this agreement, the Terms of Service and the Controller's settings and actions in Usetix, whether in the dashboard, through the API, through integrations or through the AI assistant. The Controller gives individual instructions in text form, for example by email to support@usetix.io. If Usetix considers an instruction unlawful, it informs the Controller without delay.

4. Confidentiality

Usetix only engages persons who are bound to confidentiality. Usetix support opens an organizer account only to help, and with restricted rights: billing, payouts, refunds, the team and integrations stay with the Controller. Every visit is recorded and shown to the Controller under Settings → Usetix support; changes made by support appear in the activity log.

5. Technical and organizational measures

Usetix takes the measures required by Art. 32 GDPR, in particular:

  • Hosting in data centers in Germany (Hetzner, Falkenstein); databases, files and backups are stored there
  • Encrypted transmission (TLS); credentials for payment providers and integrations are encrypted, access tokens are stored only as hashes
  • Passwordless sign-in with time-limited sign-in links or passkeys; sign-ins end after 90 days without use
  • Logical separation of each organizer account's data; roles and permissions for owners, managers, co-organizers, scanners and promoters; API tokens and integrations with restricted permissions
  • An activity log of changes in the account and recorded support access
  • Hourly backups with seven days of rotating retention, and a backup before every update
  • Regular security updates and automated security checks of the code and its dependencies
  • Fixed deletion and retention periods (section 10 and Privacy Policy)

Usetix may develop these measures further as long as the level of protection does not decrease.

6. Sub-processors

The Controller consents to the engagement of the following sub-processors:

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers, database, file and backup storage, and email delivery, data center in Falkenstein, Germany
  • Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: network and security services (attack protection, TLS, shops' custom domains); all requests to the shop and dashboard pass through Cloudflare
  • xAI, USA: language model for the AI features in the dashboard (assistant, events from flyers, seat map import, advertising suggestions, image descriptions); only the content the Controller's users provide there and the data retrieved for the task at hand are transmitted, and only when these features are used
  • Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg: sending newsletters (Amazon Simple Email Service), data center in Stockholm, Sweden; the recipient's address and name and the content of the email are transmitted, and only if the Controller uses email marketing. Announced on 5 October 2026, in use from 4 November 2026

Transfers to the USA are covered by appropriate safeguards under Chapter V GDPR, in particular the EU-U.S. Data Privacy Framework where the provider is certified, or the European Commission's standard contractual clauses.

Usetix contractually binds sub-processors to data protection obligations that correspond to this agreement. Usetix announces new or replaced sub-processors at least 30 days in advance on this page and by email to account owners. The Controller may object for an important data protection reason. If the parties cannot find a solution, the Controller may delete its account.

Services that the Controller chooses itself and that process data under their own responsibility are not sub-processors under this agreement: the payment providers Stripe and PayPal, advertising and analytics services the Controller activates in its shop, and AI apps and automations it connects through MCP, the API or integrations such as Zapier, n8n or Make. Push notifications are delivered encrypted through the push services of browser and device makers, which receive no readable content.

7. Assistance to the Controller

Usetix assists the Controller with requests from data subjects, in particular through exports and editing features in the dashboard and, where these are not sufficient, on request to support@usetix.io. If data subjects contact Usetix directly, Usetix forwards the request to the Controller. Usetix also assists the Controller with its obligations under Art. 32 to 36 GDPR, to the extent Usetix has the information needed.

8. Personal data breaches

Usetix notifies the Controller of a personal data breach without undue delay after becoming aware of it, by email to the account owners. The notification contains the information under Art. 33(3) GDPR as far as available; Usetix provides missing information as it becomes available.

9. Evidence and audits

Usetix makes available to the Controller the information needed to demonstrate compliance with this agreement. The Controller, or an auditor it appoints who is bound to confidentiality, may carry out audits: after notice within a reasonable period, during normal business hours, without disrupting operations and while protecting the confidentiality of other customers' data, as a rule no more than once a year unless there is a specific reason.

10. Deletion and return

The Controller can secure its data before the agreement ends using the exports in Usetix. When an owner schedules the account's deletion, access ends immediately. After a 30-day recovery period, Usetix deletes the account and its data from active systems; backups expire within a further seven days. This does not apply to data Usetix is legally required to retain.

During the term, the deletion periods in the Privacy Policy apply, for example twelve months for the activity log.

11. Final provisions

Liability is governed by Art. 82 GDPR and otherwise by the liability provisions of the Terms of Service. In the event of conflict, this agreement takes precedence over the Terms of Service in matters of data protection. Usetix may amend this agreement where necessary, for example for new sub-processors or a change in the law, and informs account owners by email. German law applies. The German version is authoritative; translations are provided for information.

Screen Island GmbH
Contact details in the Imprint · support@usetix.io