GETIN Data Processing Addendum

Last updated 17 October 2026

Version 2026.1 · Effective 17 October 2026 · Operator Get In Inc., 452 NE 31st Street, Miami, FL 33137, United States

1 Parties, scope and precedence

1.1 This Addendum is between Get In Inc., a Florida corporation, 452 NE 31st Street, Miami, FL 33137, United States (GETIN), and the Organizer identified in the Organizer Platform Agreement, and supplements that agreement. It forms part of the Organizer Platform Agreement and takes effect when the Organizer accepts it. It applies only to processing listed in Schedule A as performed by GETIN on the Organizer’s documented instructions. For that processing, Organizer is Controller and GETIN is Processor, unless a different lawful chain is expressly identified in Schedule A. If Organizer acts as a processor for another controller, it warrants that it has the authority needed to appoint GETIN as a subprocessor and to communicate the controller’s instructions.

1.2 Applicable Data Protection Law means the privacy and data-protection law applicable to the relevant processing, including the EU GDPR, UK GDPR and applicable UK law where in scope. Controller, Processor, Personal Data, Processing and Personal Data Breach have their statutory meanings. Organizer Personal Data is personal data processed under the documented instructions in Schedule A.

1.3 For its subject matter this Addendum prevails over inconsistent business terms. Mandatory law and an applicable executed transfer instrument prevail over this Addendum. It does not reduce data-subject or regulator rights. A commercial liability cap does not bind a regulator or data subject or override an applicable SCC remedy.

1.4 Independent-controller activities must be specifically identified in Schedule F and supported by their own lawful basis, notices and controls. This Addendum grants no general right to combine identifiable attendee data across Organizers, reuse it for GETIN advertising or train external models. Jointly determined processing requires the applicable joint-controller assessment and arrangement before that processing begins.

2 Instructions and lawful processing

2.1 GETIN shall process Organizer Personal Data only to provide the services and documented lawful instructions in Schedule A, including instructions concerning international transfers, unless Union or Member State law requires otherwise for EU GDPR processing, or applicable UK law requires otherwise for UK GDPR processing. Other legal demands must be assessed under applicable disclosure and transfer rules and do not independently override those requirements. In that event GETIN shall inform Organizer of the legal requirement before processing unless prohibited on important grounds of public interest.

2.2 Instructions may be recorded in the executed agreement, completed schedules, authorized feature settings and verified written requests from the contacts listed in Schedule A. A broad account permission or unsupported request is not an instruction to disclose data for an unrelated purpose. Material changes to purposes, data categories or recipients require a recorded assessment and updated instructions before activation.

2.3 GETIN shall immediately inform Organizer if, in its opinion, an instruction infringes Applicable Data Protection Law. GETIN may suspend only the affected instruction while the parties promptly resolve the issue, without impairing required protective action or nonwaivable rights. Organizer shall supply lawful instructions, required transparency and lawful grounds for the data it provides. Each party remains responsible for obligations law places on it.

3 Personnel and confidentiality

3.1 GETIN shall ensure that persons authorized to process Organizer Personal Data are bound by confidentiality obligations or an appropriate statutory duty, receive training appropriate to their access, and access only information needed for their role. Access shall be reviewed and removed when no longer required. These duties extend to support access, exports, remote administration, on-site devices and connected tools within GETIN’s control.

3.2 Organizer shall maintain equivalent appropriate controls for the users and devices it controls, including verified account ownership and timely revocation. Neither party shall send live ticket credentials, full identity documents or unnecessary sensitive data in routine support or incident communications. Secure evidence-sharing procedures shall be documented in Schedule B.

4 Security measures

4.1 Taking account of the state of the art, implementation costs, nature, scope, context and purposes of processing and the risk to individuals, GETIN shall implement appropriate technical and organizational measures under applicable law, including measures addressing confidentiality, integrity, availability, resilience, restoration and regular evaluation. The actual agreed measures are set out in versioned Schedule B.

4.2 GETIN may update measures without materially reducing the overall protection of the processing. Material changes affecting agreed risks or responsibilities shall be communicated and recorded. This clause does not represent a certification, absolute security, data residency or a 24-hour support service.

4.3 Organizer shall supply information reasonably needed to assess processing risk and use the Services consistently with the security instructions. New special-category data, children’s data, high-risk profiling or a materially different use requires prior assessment and an updated schedule.

5 Subprocessors

5.1 Organizer grants general written authorization only for the subprocessors listed in completed Schedule C. GETIN shall give advance written notice of a proposed addition or replacement, identifying the legal entity, service, processing location and relevant transfer mechanism. The notice period is 30 days, given by email to the Organizer’s notice contact or by update to the subprocessor list referred to in Schedule C.

5.2 Organizer may object on reasonable, documented data-protection grounds within the stated period. The parties shall seek a practical resolution, such as additional safeguards or an alternative affected service. GETIN shall not implement the contested processing while the objection is unresolved unless a lawful protective measure is immediately necessary and the required authorization is obtained. If no lawful solution is available, either party may terminate the affected processing with an orderly return or deletion arrangement and commercially agreed adjustment; other services need not end.

5.3 GETIN shall impose data-protection obligations on each subprocessor that provide at least the protection required for its processing by this Addendum and Applicable Data Protection Law. For EU and UK GDPR processing, GETIN remains fully liable to Organizer for the performance of each subprocessor’s data-protection obligations as required by Article 28 paragraph 4. Applicable equivalent statutory responsibility is preserved for other processing. Vendor branding or a hosting region is not identification of the legal recipient.

6 Personal data breaches

6.1 GETIN shall notify Organizer without undue delay after becoming aware of a Personal Data Breach affecting Organizer Personal Data. It shall not wait for the investigation to finish before initial notice, and its operational target is initial notice within 48 hours of becoming aware. Any separately agreed operational target supplements and does not postpone that duty. The controller’s potential 72-hour authority-notification period is not a processor grace period.

6.2 To the extent available, the notice shall describe the nature of the breach, affected processing and data, approximate numbers and categories of individuals and records, likely consequences, containment and remediation, and a contact for further information. Missing information may be supplied in phases without undue further delay. GETIN shall preserve relevant evidence, investigate, mitigate and reasonably assist Organizer’s risk assessment and lawful notifications.

6.3 Organizer controls notifications for processing for which it is controller, subject to GETIN’s independent legal duties. Neither party may delay a legally required notification while waiting for the other’s approval. Public statements naming the other party should be coordinated where lawful and practicable, without withholding information required by law. Notification is not an admission of liability.

7 Rights requests and compliance assistance

7.1 Taking account of the nature of processing, GETIN shall assist Organizer by appropriate technical and organizational measures, insofar as possible, to respond to rights requests. GETIN shall promptly route a request it receives concerning instructed processing to the verified Organizer contact and shall not respond substantively except on instructions or where legally required. Requests concerning GETIN’s independent processing remain GETIN’s responsibility.

7.2 Assistance includes locating, exporting, correcting, restricting, deleting and documenting data within the Services and coordinating required downstream action. The parties shall use proportionate identity verification and protect other people’s information. Incomplete account tools do not remove statutory rights. Schedule D records the request channels, owners and operational timing necessary to meet legal deadlines.

7.3 Taking account of the processing and information available to it, GETIN shall assist Organizer with security, breach notification, data-protection impact assessments and prior consultation where required. The parties shall identify high-risk new features before launch. Routine cooperation is part of the agreed service; exceptional assistance fees, if any, must be transparent and agreed and must not obstruct mandatory assistance or remedy GETIN’s own breach.

8 Assurance and audit

8.1 GETIN shall make available information necessary to demonstrate compliance with the processor obligations and allow and contribute to audits, including inspections, by Organizer or its mandated independent auditor. Proportionate documentary assurance may be used first where it adequately addresses the purpose. It is not an unconditional substitute for a necessary inspection.

8.2 Audits should use reasonable notice, confidentiality and measures to protect other customers and system security. Restrictions on timing, frequency, auditor or method must not frustrate statutory rights, regulator access, an urgent incident investigation or a reasonably substantiated compliance concern. The parties shall agree a risk-appropriate remediation plan and verify material corrective action. No obligation to disclose another customer’s personal data or credentials is created.

9 End of service, retention and deletion

9.1 At Organizer’s choice, GETIN shall return or delete Organizer Personal Data after the instructed services end and delete existing copies unless Union or Member State law requires retention for EU GDPR processing, or applicable UK law requires retention for UK GDPR processing. Other legal demands must be assessed under applicable disclosure and transfer rules and do not independently override those requirements. Schedule D shall record the export format, return/deletion process and completion period before activation. Organizer must not instruct deletion that would unlawfully prevent fulfillment of existing tickets or erase mandatory records without a lawful alternative.

9.2 Legally retained data shall be identified by category, reason, applicable period and authorized access and used only for the permitted retention purpose. Backups shall be isolated from ordinary use and disposed of under the documented cycle; restoration must reapply relevant deletions. Device caches, exports and subprocessor copies must be addressed. A general reference to backups is not permission for indefinite retention.

9.3 On request, GETIN shall provide reasonable written confirmation of completion and any limited retention exception. The confidentiality, security and purpose restrictions continue for retained data. Organizer’s own copies and independent-controller records remain subject to their separate legal duties.

10 International transfers

10.1 GETIN shall not make a restricted transfer, including relevant remote access, without documented instructions and the safeguards required by applicable law. Schedule E shall identify the exporter, importer, recipient countries, roles, purpose, onward recipients and actual mechanism. Adequacy, certification or contractual safeguards must be verified for the exact recipient and transfer, not assumed from group affiliation.

10.2 Where the parties rely on the European Commission standard contractual clauses under Decision 2021/914, those clauses are incorporated by reference with the elections and annexes set out in Schedule E. The official clauses are not modified by this Addendum and prevail to the extent of any conflict.

10.3 For UK restricted transfers, the parties shall use a valid UK mechanism, such as applicable adequacy, the approved IDTA or the UK Addendum to eligible EU SCCs, with required information and assessment. Other territories require their own assessment and instruments. The parties shall assess transfer risk and supplementary measures where required, reassess material changes, and suspend or remediate transfers if safeguards cannot be maintained.

10.4 No statement here represents that GETIN is certified under the EU-US Data Privacy Framework.

11 US service provider and contractor supplement

11.1 This section applies only where an applicable US law and the completed role schedule require service-provider, contractor or equivalent processing restrictions. GETIN shall process the listed personal information solely for the limited and specified business purposes in Schedule A and the legally permitted instructed relationship. It shall not sell or share that information, retain, use or disclose it outside those purposes or the direct business relationship, or combine it with personal information from other sources except as the applicable law specifically permits.

11.2 GETIN shall comply with applicable obligations, provide the legally required level of privacy protection and notify Organizer if it can no longer do so. Organizer may take reasonable and appropriate steps to verify compliant use and, on notice, stop and remediate unauthorized use. GETIN shall support required rights handling and downstream contractual restrictions. Where applicable, GETIN certifies that it understands and will comply with these restrictions.

11.3 This section does not relabel independently determined advertising or cross-context behavioral sharing as service-provider processing. Such activity must be separately assessed, disclosed and controlled and may require opt-out or consent. Additional state-specific terms must be completed where the actual processing requires them.

12 Execution and change control

12.1 The parties shall keep the processing schedules accurate. New services, countries, data types or purposes require assessment and an agreed update before materially changing the processing. No business instruction authorizes unlawful processing or removes a data-subject right.

12.2 This Addendum is accepted electronically together with the Organizer Platform Agreement, or by signature where the parties sign a separate copy. Its effective date is the effective date of the related Organizer Platform Agreement. Notices under this Addendum go to the contacts recorded in the Order Form.

Schedule A Processing instructions and roles

Services and purposes. Event registration and attendee administration; Organizer customer-relationship management and support workflows; admission and check-in processing on the Organizer’s behalf; communications the Organizer sends through GETIN tools; and data exports requested by the Organizer.

Roles. Organizer as controller and GETIN as processor. Where the Organizer acts for another controller, GETIN is a subprocessor.

Data subjects. Ticket purchasers, attendees and guests, waiting-list registrants, and customers and contacts whose data the Organizer loads into GETIN tools.

Data categories. Contact details, order and ticket details, attendance and scan records, event-question answers, communication history and preferences, tags and segments, and limited payment status information (not full card numbers).

Special categories and children. None by default. Special-category data, identity documents or children’s data may be processed only where the Organizer has documented the necessity, lawful condition and safeguards before collection.

Nature and duration. Collection, storage, organization, retrieval, use, transmission, export and deletion, for the term of the Organizer Platform Agreement and the return or deletion period in Schedule D.

Instructions. This Addendum, the Organizer Platform Agreement, the Organizer’s settings in GETIN tools and written instructions from the Organizer’s notice contact.

Schedule B Verified security measures

GETIN maintains the following measures and may update them without materially reducing overall protection.

Access control. Role-based access, least privilege, multi-factor authentication for administrative access and periodic access reviews.

Encryption. Encryption in transit using TLS and encryption at rest for production databases and backups.

Infrastructure. Hosting with established cloud providers, separation of production and development environments and network access restrictions.

Vulnerability management. Timely patching, dependency monitoring and remediation of identified vulnerabilities according to severity.

Logging and monitoring. Security logging and alerting, with credentials, payment data and live ticket codes excluded or redacted from logs.

Resilience. Regular backups and tested restoration procedures.

Incident response. A documented incident response process. GETIN incident contact: privacy@getin.xyz, subject line “Security incident”. Organizer incident contact: the notice contact in the Order Form.

People and vendors. Confidentiality obligations and security training for personnel, and security and privacy review of subprocessors.

Devices. Access controls on scanning devices, limited local caching of attendee data and revocation of lost devices.

Schedule C Authorized subprocessor register

GETIN uses subprocessors in the following categories: cloud hosting and storage; email, SMS and push messaging; customer support tooling; analytics and error monitoring; and AI service providers for enabled features. The current list, with each subprocessor’s location and transfer mechanism, is available on request from privacy@getin.xyz, and changes are notified under section 5. The Organizer authorizes the subprocessors on that list as of the date it accepts this Addendum.

Schedule D Retention, rights and exit

Retention and exit. GETIN retains Organizer Personal Data for the term of the Organizer Platform Agreement. After termination, the Organizer may export its data through GETIN tools or on request in a commonly used machine-readable format, such as CSV, for 30 days. GETIN then deletes it within a further 60 days, except records GETIN must keep by law, such as transaction and tax records, which are kept only for the required period. Backups are overwritten on a rolling cycle and deleted data is not restored to live systems.

Rights requests. GETIN routes rights requests it receives about instructed processing to the Organizer’s notice contact within 5 Business Days and provides the assistance described in section 7.

Schedule E Transfer assessment and instruments

EU transfers. Where Organizer Personal Data is transferred from the European Economic Area to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Commission Decision 2021/914) by reference: Module 2 where the Organizer is a controller and Module 3 where it is a processor.

Elections. The optional docking clause applies; Clause 9 option 2 (general authorization) applies with the notice period in section 5; the optional wording in Clause 11 does not apply; under Clauses 17 and 18 the law and courts of Ireland apply; the competent supervisory authority is determined under Clause 13; Annex I is completed by Schedule A and the parties’ details in this Addendum, Annex II by Schedule B and Annex III by Schedule C.

UK and Switzerland. For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies, with its tables completed by this Addendum. Transfers from Switzerland use the same clauses, with references adapted as Swiss law requires.

Review. Each party will reassess these safeguards when the law or the processing changes, and will suspend a transfer if the safeguards cannot be maintained.

Schedule F Controller allocation and joint processing

Independent controller. GETIN acts as an independent controller, outside this Addendum, for its own customer accounts and marketplace; payment processing, fraud prevention and security; legal, tax and accounting records; and its own marketing where it has a lawful basis. These activities are described in the GETIN Privacy and Cookie Policy.

Joint control. Where GETIN and the Organizer jointly determine the purposes and means of processing, such as advertising tags the Organizer configures on GETIN Event pages, they are joint controllers. The Organizer is responsible for the lawful basis and notice for its own tags, and GETIN for the consent mechanism on its pages. Each party handles rights requests it receives and informs the other where needed. The essence of this arrangement is available to individuals on request.