Data Processing Addendum

Effective date: August 28, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Sasa Arsenovic (trading as ArsAxis) ("Processor", "we") and each Organizer using Aura Space Plan ("Controller", "you"), and applies whenever you use the Service to collect, store or manage personal data about your event guests ("Guest Data").

1. Roles

For Guest Data, you (the Organizer) are the data controller: you decide what Guest Data to collect, from whom, and why. We are the data processor: we process Guest Data only on your documented instructions, given by using the Service's normal features (adding, importing, editing, seating, or deleting guests).

2. Subject matter and duration

We process Guest Data for as long as your Organizer account is active and you retain the relevant Event, subject to the automatic deletion described in Section 5. Processing ends when the data is deleted (automatically or by you) or your account is closed.

3. Nature, purpose and categories

• Categories of data subjects: the individuals you invite to your events ("Guests").
• Categories of Guest Data: name, phone number, party size and accompanying guests' names (if provided), table assignment, seating notes, and food/dietary restriction notes.
• Nature and purpose of processing: storage, seating and capacity management, and presentation on the invitation and flyer surfaces you generate and share — nothing beyond operating the Service on your instructions.

4. Processor obligations

• Process Guest Data only on your instructions (given through your use of the Service), unless required otherwise by law.
• Keep Guest Data confidential; access is limited by role within your own tenant, and technically isolated from every other Organizer's data.
• Implement appropriate technical and organizational security measures (see our Privacy Policy, Section 9).
• Assist you, insofar as the Service's design allows, in responding to a Guest's request to access, correct or delete their data — most of this you can do directly (editing or deleting a guest); contact [email protected] for anything the interface doesn't cover.
• Notify you without undue delay if we become aware of a personal data breach affecting Guest Data.
• Delete or, on request, help you export Guest Data at the end of the engagement, beyond what deletes automatically under Section 5.
• Not engage a new sub-processor with access to Guest Data without giving you the opportunity to object (see Section 6).

5. Automatic deletion

Guest Data is not retained indefinitely by design. Each event's Guest Data is permanently deleted once your chosen retention window (3 or 7 days after the event date; 3 days by default) passes — this is a feature of the Service, not something you need to separately request, and it cannot be turned off, only the window length adjusted from Settings.

6. Sub-processors

You authorize us to engage the following sub-processors to provide the Service, each bound by their own data-protection terms:

• Railway Corporation — application hosting.
• Cloudflare, Inc. — object storage for uploaded images, and DNS/TLS.
• A Sentry-compatible error-tracking provider, if configured — receives error diagnostics only, never Guest Data.

We will give you reasonable notice before adding a new sub-processor with access to Guest Data, so you can object on reasonable grounds.

7. International transfers

Where a sub-processor is located outside Serbia or the EU/EEA, transfers rely on that provider's own safeguards (standard contractual clauses or an equivalent mechanism) — see our Privacy Policy, Section 7.

8. Liability

Liability under this DPA follows the limitation of liability in our Terms of Service. Each party remains responsible for its own compliance with GDPR/ZZPL in its respective role.

9. Governing law

This DPA is governed by the laws of the Republic of Serbia, consistent with the Terms of Service.