This Data Processing Addendum ("DPA") forms part of the agreement between Superfime LLC, doing business as EvntIQ ("EvntIQ," "Processor," "we," or "us"), and the business customer identified in the applicable agreement ("Customer").
This DPA governs EvntIQ's processing of Customer Personal Data on behalf of Customer in connection with the EvntIQ Services.
Processor
Superfime LLC, doing business as EvntIQ
778 Washington Rd, #284
Parlin, NJ 08859
United States
Email: support@evntiq.app
Customer
The business or legal entity identified in the applicable subscription agreement, Order, enterprise agreement, or approved Founding Partner Program acceptance.
This DPA forms part of the EvntIQ Terms of Service, an applicable Order, enterprise agreement, or Founding Partner Program agreement (collectively, the "Agreement").
It takes effect when an authorized representative accepts the Agreement incorporating this DPA, including through an affirmative electronic acceptance mechanism.
A separate handwritten signature is not required unless applicable law or a separately negotiated agreement requires one.
This DPA remains effective for as long as EvntIQ processes Customer Personal Data under the Agreement.
Customer Data: Information submitted, uploaded, captured, generated from, or synchronized through the Services on behalf of Customer.
Customer Personal Data: Personal information contained in Customer Data that EvntIQ processes on Customer's behalf.
Data Protection Laws: Privacy and data protection laws applicable to the relevant processing, including, where applicable, the EU GDPR, UK GDPR, California Consumer Privacy Act as amended, New Jersey Data Privacy Act, and other applicable U.S. state privacy laws.
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, and Processing: Have the meanings provided by applicable Data Protection Laws.
Subprocessor: A third party engaged by EvntIQ to process Customer Personal Data on EvntIQ's behalf in delivering the Services.
Security Incident: An event affecting the confidentiality, integrity, or availability of systems or information.
Personal Data Breach: A security incident meeting the definition of a personal data breach under applicable Data Protection Laws.
This DPA applies only where EvntIQ processes Customer Personal Data on behalf of Customer.
It does not govern personal information for which EvntIQ independently determines the purposes and means of processing, such as its own business account administration, direct marketing, or certain billing and legal records. Such processing is addressed in the EvntIQ Privacy Policy.
If a conflict concerns processing obligations under this DPA, this DPA controls over the general Agreement.
Applicable mandatory law takes precedence.
Where the EU Standard Contractual Clauses ("EU SCCs"), UK International Data Transfer Addendum, or another mandatory transfer instrument applies, its non-waivable provisions prevail over inconsistent terms in this DPA or the Agreement.
Customer acts as Controller or the equivalent under applicable Data Protection Laws when it determines the purposes and means of processing Customer Personal Data.
EvntIQ acts as Processor or Service Provider for that processing.
Where Customer acts as a processor on behalf of another controller, EvntIQ acts as a subprocessor, and Customer represents that it has obtained the authorization necessary to engage EvntIQ.
EvntIQ will process Customer Personal Data only on Customer's documented instructions, unless applicable law requires otherwise.
Documented instructions include:
If applicable law requires processing outside those instructions, EvntIQ will notify Customer before processing unless prohibited by law.
EvntIQ will promptly inform Customer if, in its opinion, an instruction infringes applicable Data Protection Laws.
EvntIQ may suspend the affected processing while the parties clarify or correct the instruction, consistent with applicable law.
Customer is responsible for:
EvntIQ may use authorized AI service providers to deliver features such as:
EvntIQ will not use Customer Personal Data to train generalized AI models without Customer's separate written authorization and any other authorization required by applicable law.
EvntIQ will impose appropriate contractual restrictions on AI subprocessors consistent with this DPA.
Customer Personal Data processed through AI functionality remains subject to this DPA regardless of the technology used.
AI outputs are processed as Customer Data to the extent they contain or derive from Customer Personal Data.
EvntIQ may create and use aggregated or de-identified information as permitted by the Agreement and applicable law.
EvntIQ will apply reasonable measures designed to prevent re-identification, will not attempt to re-identify such information except where lawfully necessary to test de-identification safeguards, and will not disclose it in a manner that defeats those safeguards.
Information remains subject to applicable Data Protection Laws where it can reasonably identify an individual.
EvntIQ will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.
Access will be limited to personnel with a legitimate operational need.
EvntIQ will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and accidental loss, destruction, damage, or disclosure.
These measures are described in Annex 2.
EvntIQ may modify security measures as technology and risks evolve, provided changes do not materially reduce the overall protection required under this DPA.
EvntIQ will restrict staff access to Customer Personal Data to authorized service, maintenance, support, security, or legal purposes.
Privileged access will be controlled and subject to appropriate logging and review procedures.
Customer is responsible for protecting its:
Customer's responsibilities do not relieve EvntIQ of its own obligations under this DPA.
Customer grants EvntIQ general authorization to engage subprocessors for the limited purposes necessary to deliver the Services.
EvntIQ's subprocessors are identified in Annex 3 and the applicable subprocessor register.
EvntIQ will provide Customer at least thirty (30) days' advance notice of an intended addition or replacement of a subprocessor.
Notice may be delivered by email to a designated Workspace administrator or through another documented notification mechanism made available to Customer.
Where urgent replacement is necessary to address an immediate security, compliance, or service continuity risk, EvntIQ may give shorter notice, explaining the circumstances and providing notice as soon as reasonably practicable.
Customer may object to a new or replacement subprocessor on reasonable, documented data protection grounds within thirty (30) days after notice.
The parties will cooperate in good faith to address the objection.
Potential resolutions may include additional safeguards, a configuration change, an alternative provider, or discontinuation of the affected functionality where technically and commercially reasonable.
If the parties cannot resolve a valid objection, Customer may terminate the affected Services by written notice.
Where Customer has prepaid for affected Services that cannot reasonably continue, EvntIQ will refund the unused prepaid fees attributable to those terminated Services.
No refund is due for complimentary access or periods for which no fees were paid.
EvntIQ will impose contractual data protection obligations on subprocessors that provide the level of protection required by applicable Data Protection Laws and are no less protective in substance than EvntIQ's applicable obligations under this DPA.
EvntIQ remains responsible for its subprocessors' performance of those obligations as required by applicable law.
Third-party services independently selected and connected by Customer, such as its own CRM, calendar, email, or communication accounts, are generally governed by Customer's agreement with those services.
However, whether a particular provider is EvntIQ's subprocessor depends on the actual processing arrangement, not merely the fact that the provider is called an integration.
Where EvntIQ engages a provider to process Customer Personal Data on EvntIQ's behalf, applicable subprocessor obligations remain in effect.
Taking into account the nature of processing, EvntIQ will provide reasonable assistance to Customer in responding to requests to access, correct, delete, restrict, or export Customer Personal Data or to exercise other rights under applicable Data Protection Laws.
Where EvntIQ receives a request relating to identifiable Customer-controlled data, it will direct the requester to the relevant Customer or notify Customer as appropriate, unless prohibited by law.
EvntIQ will not independently make decisions regarding Customer-controlled privacy requests except as legally required or authorized.
EvntIQ will provide reasonable information and assistance necessary for Customer to perform applicable data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and information available to EvntIQ.
EvntIQ will notify Customer without undue delay and in any event no later than seventy-two (72) hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.
Notification will be sent to Customer's designated security or privacy contact or, where none is designated, an appropriate Workspace administrator.
Initial notice may be provided before a complete investigation is available.
EvntIQ will provide information as reasonably available concerning:
EvntIQ may provide updates in stages as further information becomes available.
EvntIQ will reasonably cooperate with Customer's efforts to meet applicable notification obligations.
A notification or investigation under this section does not constitute an admission of fault, negligence, or legal liability.
Where legally permitted, EvntIQ will notify Customer of a governmental request for Customer Personal Data and will seek to direct the requesting authority to Customer where appropriate.
EvntIQ will evaluate applicable legal obligations before disclosing Customer Personal Data and will limit disclosure to what is legally required.
EvntIQ operates from the United States and may engage authorized subprocessors operating in other jurisdictions.
Applicable processing locations and material transfer arrangements are described in the subprocessor register and relevant contractual schedules.
Where Customer Personal Data is subject to international transfer restrictions, the parties will use an appropriate transfer mechanism recognized under applicable Data Protection Laws.
Depending on the transfer, this may include:
No single transfer mechanism is represented as applying to every provider or transfer.
Where required and applicable, the parties incorporate the European Commission's Standard Contractual Clauses for international transfers under Commission Implementing Decision (EU) 2021/914.
Module Two applies to a controller-to-processor transfer, and Module Three applies to a processor-to-processor transfer, according to the parties' actual roles.
The applicable parties, processing details, transfer categories, technical and organizational measures, competent supervisory authority, and subprocessor information are set out in Annex 4, which forms part of this DPA.
For applicable transfers, the parties select general subprocessor authorization under Clause 9(a), Option 2, with the notice period stated in Section 4.2.
The parties select Irish law under Clause 17, Option 1, and the courts of Ireland under Clause 18.
The SCCs prevail over conflicting terms where required by the SCCs themselves.
Where UK restricted transfer requirements apply, the parties will use the applicable UK International Data Transfer Addendum to the EU SCCs or another lawful UK transfer mechanism.
Where the UK Addendum is used, its required tables and selections are set out in Annex 4.
Where Swiss law applies, the parties will adopt the applicable SCCs with adjustments necessary to reflect Swiss data protection law, the competent Swiss authority, and relevant rights of individuals.
Where required, the parties will assess risks associated with international transfers and implement supplementary technical, organizational, or contractual safeguards.
If a transfer mechanism becomes invalid or unavailable, the parties will cooperate to adopt an appropriate lawful alternative.
EvntIQ may suspend an affected transfer where necessary to comply with applicable law.
Upon reasonable written request, EvntIQ will provide information necessary to demonstrate compliance with its obligations under this DPA.
Such information may include available security documentation, written questionnaire responses, relevant policies, and independent assessment reports, subject to appropriate confidentiality and security restrictions.
Where required by applicable Data Protection Laws, EvntIQ will allow and contribute to reasonable audits and inspections concerning its processing of Customer Personal Data.
The parties will ordinarily attempt to satisfy information requests using available documentation before conducting a further inspection.
For routine audits, Customer should provide at least thirty (30) days' advance written notice and ordinarily conduct no more than one audit during any twelve-month period.
These procedural limits do not restrict additional audits where applicable law, a competent supervisory authority, a material incident, or other legally justified circumstances require them.
Audits will be conducted:
An independent auditor must be appropriately qualified and bound by confidentiality obligations and must not present an unreasonable competitive conflict.
Customer ordinarily bears its own audit costs and reasonable third-party auditor expenses.
Any charges for extraordinary assistance will be agreed in advance, except where charging would improperly restrict legally required audit rights.
Customer may access, export, correct, and delete Customer Personal Data through available platform functionality, subject to authorization, applicable legal holds, and documented technical limitations.
EvntIQ will provide reasonable assistance where legally required and self-service functionality is insufficient.
Upon termination of the applicable processing Services, EvntIQ will, at Customer's choice, return or delete Customer Personal Data, and delete existing copies, unless applicable law requires retention.
Customer may communicate its choice through available controls or an authorized written request.
EvntIQ will complete deletion from active systems within ninety (90) days after receiving Customer's authorized request, subject to Sections 8.4 and 8.5.
Where Customer does not provide an instruction, Customer Personal Data remains subject to Customer's Workspace retention settings and this DPA until it is deleted under those settings or Customer requests deletion.
EvntIQ will provide a commercially reasonable method for Customer to retrieve Customer Personal Data where required by the Agreement or applicable law.
An expired Founding Partner Workspace may enter a restricted billing-only state, but that status does not eliminate return or deletion rights under this DPA.
Where ordinary exports are restricted, Customer may request assistance through the established support process.
Customer Personal Data deleted from active systems may remain temporarily in protected backups until their scheduled expiration or replacement.
During that period, backup data will remain subject to applicable confidentiality and security protections and will not be restored for ordinary business use except where necessary for recovery or legal compliance.
If data is restored, applicable deletion requirements will be reapplied.
EvntIQ may retain information where required by law, court order, or a valid legal hold.
Such retention will be limited to the necessary purposes and period, with continued appropriate protection.
Upon reasonable request, EvntIQ will provide confirmation of completed return or deletion actions, subject to limitations relating to protected backups and lawful retention.
Where the CCPA or comparable U.S. state privacy laws apply, EvntIQ will process Customer Personal Data only for the specified business purposes described in Annex 1 and otherwise permitted under applicable law.
EvntIQ will not, except as permitted by applicable law:
EvntIQ will provide the privacy protections required of a processor, service provider, or contractor under applicable Data Protection Laws.
EvntIQ will notify Customer if it determines it can no longer meet those obligations.
Customer may take reasonable and appropriate steps to ensure that EvntIQ processes Customer Personal Data consistently with applicable legal and contractual restrictions.
EvntIQ will reasonably cooperate with Customer to stop and remediate unauthorized processing.
EvntIQ will provide reasonable assistance and available technical mechanisms to support Customer's fulfillment of applicable consumer privacy requests.
Except where applicable Data Protection Laws or mandatory international transfer provisions require otherwise, each party's liability arising under this DPA is subject to the applicable limitations and exclusions set out in the Agreement.
A separately negotiated enterprise agreement may provide different liability limits or allocations.
Nothing in this DPA limits rights or liabilities that cannot lawfully be limited, including applicable rights under mandatory Standard Contractual Clauses.
This DPA remains effective while EvntIQ processes Customer Personal Data on behalf of Customer.
Obligations concerning confidentiality, security, legally required retention, data return, deletion, and applicable international transfers survive to the extent required for remaining processing.
EvntIQ may update this DPA to reflect changes in laws, applicable requirements, subprocessors, security measures, or Services.
EvntIQ will provide notice of material changes.
Changes will not materially reduce contractual data protection safeguards during an existing committed subscription or Program period without Customer's agreement, except where necessary to comply with mandatory law.
The governing law and dispute resolution terms in the Agreement apply to this DPA except where mandatory Data Protection Laws or applicable international transfer instruments require otherwise.
Superfime LLC d/b/a EvntIQ
778 Washington Rd, #284
Parlin, NJ 08859
United States
Email: support@evntiq.app
Website: https://evntiq.app
| Category | Description |
|---|---|
| Data exporter | Customer identified in the applicable Agreement |
| Data importer | Superfime LLC d/b/a EvntIQ |
| Subject matter | Provision of EvntIQ event intelligence, sales management, AI, and related Services |
| Duration | The applicable service period plus authorized return, deletion, or legally required retention |
| Frequency | Ongoing during authorized use |
| Nature of processing | Collection, recording, organization, extraction, transcription, analysis, enrichment, storage, retrieval, transmission, export, and deletion |
| Purpose | Event lead capture, event administration, lead management, AI features, customer-authorized outreach, CRM integration, team collaboration, security, and support |
| Categories of data subjects | Customer users, event attendees, leads, business contacts, meeting participants, and recipients of authorized communications |
| Categories of personal data | Names, company details, email addresses, phone numbers, job titles, professional profiles, event records, badge information, business card images, CRM details, meeting notes, recordings, transcripts, AI summaries, documents, receipts, and associated metadata |
| Sensitive data | Not intentionally requested as a standard requirement; may occur incidentally in recordings, notes, attachments, or other Customer content |
| Retention | Customer-configured settings where supported, and otherwise as set out in Section 8 |
| Processing instructions | Agreement, DPA, approved service configurations, authorized integrations, and documented Customer instructions |
| Technical safeguards | Annex 2 |
| Subprocessors | Annex 3 and the maintained subprocessor register |
Customer determines the purposes of its processing of Customer Personal Data and is responsible for the appropriate lawful basis and notices.
EvntIQ processes Customer Personal Data to deliver authorized Services, subject to Customer instructions and applicable legal obligations.
Information for which EvntIQ independently acts as controller is outside this DPA and is addressed by its Privacy Policy.
For any transfer relying on the EU SCCs or UK Addendum, the required transfer information is set out in this Annex 1, Annex 2, Annex 3, and Annex 4.
EvntIQ maintains technical and organizational measures appropriate to the risks associated with Customer Personal Data.
The following measures apply to the Services.
Security measures will be periodically reviewed and updated to address relevant risks, vulnerabilities, technology changes, and applicable legal obligations.
Changes will not materially diminish the overall security protections required by the DPA.
Register date: November 1, 2026
This annex lists EvntIQ's subprocessors as of the register date. EvntIQ updates its maintained subprocessor register in accordance with Section 4.
| Provider | Processing purpose | Information involved | Location |
|---|---|---|---|
| Supabase | Database, authentication, storage, Edge Functions | Organization, user, lead, event, recording, compliance data | United States |
| Netlify | Web hosting and content delivery | Application delivery and potentially request metadata | Global CDN |
| OpenAI | Authorized AI transcription, summaries, enrichment, suggestions | Audio, transcripts, lead or form context submitted to AI features | United States |
| Resend | Transactional communications | Recipient information, email content and delivery metadata | United States |
| Stripe | Billing and payment processing | Billing contacts, payment metadata, subscription identifiers | United States |
| Sentry | Error and performance monitoring | Diagnostic information potentially containing personal data | United States |
| RevenueCat | Mobile subscription administration | Purchase receipts and subscription identifiers | United States |
| PandaDoc | Enterprise contracts and signatures | Business contacts, contract documents, signature records | United States |
| Cloudmersive | Malware scanning | Uploaded file content and scan metadata | Vendor-hosted service, as recorded in the maintained subprocessor register |
| Microsoft Azure / Azure AI Speech | Meeting audio transcription | Audio and transcript information | United States (configurable Azure region) |
| Microsoft 365 / Microsoft Graph | Authorized Teams meeting access | Meeting metadata and audio-related information | Applicable tenant/service regions |
For each provider that qualifies as a subprocessor, EvntIQ will maintain appropriate records covering:
The maintained register will be updated in accordance with Section 4.
Customer-directed integrations are evaluated based on the actual contractual and processing arrangements.
A customer-provided CRM, email account, calendar, or communications connection does not automatically become an EvntIQ subprocessor merely because it is accessed through an integration.
Where EvntIQ itself engages an external provider to process Customer Personal Data on its behalf, the applicable obligations in Section 4 apply.
This annex records the information and selections that apply where a restricted international transfer relies on the EU SCCs, UK Addendum, or Swiss adaptations. Acceptance of the Agreement is treated as signature of the EU SCCs, the UK Addendum, and their appendices.
| SCC item | Selection |
|---|---|
| Annex I.A data exporter | Customer, using the details in the Agreement and its Workspace administrator contacts |
| Annex I.A data importer | Superfime LLC, doing business as EvntIQ, 778 Washington Rd, #284, Parlin, NJ 08859, United States; support@evntiq.app |
| Modules | Module Two for controller-to-processor transfers; Module Three for processor-to-processor transfers |
| Annex I.B description of transfer | Annex 1 of this DPA |
| Annex I.C competent supervisory authority | The authority determined under Clause 13 for the data exporter |
| Annex II security measures | Annex 2 of this DPA |
| Annex III subprocessors | Annex 3 of this DPA |
| Clause 7 docking clause | Not used |
| Clause 9(a) | Option 2, general authorization, with thirty (30) days' notice |
| Clause 11(a) optional language | Not used |
| Clause 17 governing law | Option 1, the law of Ireland |
| Clause 18(b) forum | The courts of Ireland |
Where the UK Addendum applies, the parties incorporate the version issued by the UK Information Commissioner, with its Part 1 tables completed as follows.
| UK Addendum table | Selection |
|---|---|
| Table 1 parties | The parties identified in Section 1 of this Annex 4 |
| Table 2 selected SCCs | The EU SCCs with the modules and selections in Section 1 of this Annex 4 |
| Table 3 appendix information | Annex 1, Annex 2, and Annex 3 of this DPA |
| Table 4 ending the Addendum | Neither party |
Where required, the applicable SCCs will be interpreted and adjusted for Swiss data protection legislation and competent supervisory authority requirements.
Where required by law, EvntIQ and Customer will cooperate in evaluating relevant international transfer risks and appropriate supplementary safeguards.
Mandatory international transfer instruments prevail over conflicting provisions of this DPA to the extent required by those instruments.
End of EvntIQ Data Processing Addendum — Version v2
Superfime LLC, doing business as EvntIQ
778 Washington Rd, #284
Parlin, NJ 08859, United States
support@evntiq.app