Article 28 UK GDPR
Event Organiser Data Processing Addendum
Effective date: 2 October 2026
SNOVA is a brand of Paahun Global Ltd, registered in England & Wales, company number 16884211, with registered office at Office 385, Unit 5, 399-405 Oxford Street, Mayfair, London, United Kingdom, W1C 2BU. Privacy enquiries: privacy@snova.uk. Support: hello@snova.uk.
1. Parties and precedence
This DPA forms part of the agreement between Paahun Global Ltd (SNOVA) and the Event Organiser where SNOVA processes personal data on behalf of the Organiser. If there is a conflict about processor obligations, this DPA prevails for that processing.
2. Roles
For organiser-directed Event Content processing, the Organiser is controller (or processor acting for another controller) and SNOVA is processor, to the extent those roles apply. SNOVA remains a separate controller for its own account, billing, security, legal and operational data.
3. Processing details
| Item | Description |
|---|---|
| Subject matter | Hosting and operating QR event camera, event gallery, event media storage, moderation tools, export and social post preparation |
| Duration | For the service term plus deletion/backup period |
| Nature | Collection, recording, hosting, organisation, retrieval, display, transmission, deletion, prepared-post export and, where the organiser connects a social account, authorised publishing to it |
| Social post generation | AI analysis of organiser-selected gallery images, drafting of captions and hashtags, and an independent AI quality score, carried out by SNOVA's AI provider on the organiser's instruction |
| Social publishing and measurement | Transmission of organiser-approved images and captions to Meta for publication on the organiser's connected Facebook Page or Instagram business account, and reading back post performance figures from Meta |
| Purpose | Provide the organiser's selected SNOVA features |
| Data subjects | Organisers, guests, attendees and individuals depicted in Event Content |
| Personal data | Names where supplied, contact details, IP/device data, photos/videos, captions, event metadata and related identifiers |
| Special category data | Not intentionally required; may incidentally be inferable from imagery. Organiser should avoid unnecessary sensitive content. |
4. Processor obligations
- Process personal data only on documented organiser instructions, unless required by law.
- Ensure authorised personnel are subject to confidentiality obligations.
- Implement appropriate technical and organisational security measures.
- Use subprocessors under written terms providing equivalent protection.
- Assist with data-subject rights requests where reasonably required.
- Assist with security, breach, DPIA and regulator obligations appropriate to the processing.
- Delete or return organiser personal data at end of service, subject to lawful retention and backups.
- Make information reasonably necessary to demonstrate compliance available to the organiser.
5. Subprocessors
SNOVA maintains a current subprocessor list. It includes the cloud hosting, database, storage and authentication platform; the transactional email provider; the payment provider used for plans and subscriptions; the AI provider that performs image analysis, caption drafting and quality scoring; and Meta, where an organiser connects a Facebook Page or Instagram business account for publishing and performance measurement. The contract should provide a mechanism for notice of material subprocessor changes and appropriate objection rights for business customers.
6. International transfers
SNOVA will not transfer organiser personal data outside the UK unless a lawful transfer mechanism applies. Where required, SNOVA will implement an IDTA, UK Addendum or other approved safeguard and conduct transfer-risk assessments.
7. Security incidents
SNOVA will notify the organiser without undue delay after becoming aware of a personal data breach affecting organiser-controlled data and provide available information reasonably required for the organiser's assessment and notification obligations.
8. Organiser instructions and responsibility
The Organiser warrants that its instructions are lawful and that it has provided required notices and established an appropriate lawful basis for Event Content. SNOVA will inform the Organiser if, in SNOVA's reasonable opinion, an instruction infringes applicable data protection law.