Data processing agreement
Français · English
Le présent accord de traitement des données (« DPA ») fait partie des Conditions d'utilisation des organisateurs. Il est conclu entre l'Organisateur (responsable du traitement) et Bohdan SHOSTAK EI, SIREN 109 485 573, 11 rue du Grand Wad, 57000 Metz (IMIN, sous-traitant). Les parties adoptent sans modification les clauses contractuelles types de la décision d'exécution (UE) 2021/915 de la Commission, dont le texte officiel est publié sur EUR-Lex : https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj. Choix : clause 7.7 option 2 (autorisation générale des sous-traitants ultérieurs, avec préavis d'au moins 10 jours, ou immédiat lorsqu'un prestataire donne moins de préavis à IMIN) ; clause 9 : notification des violations sans délai injustifié et au plus tard 48 heures après en avoir pris connaissance ; droit applicable : droit français ; juridiction : tribunaux de Metz ; autorité de contrôle compétente : la CNIL.
Annexes
Annex I · List of parties
| Controller | Processor | |
|---|---|---|
| Name | The Organizer named in its account (legal name from Settings → Legal identity) | Bohdan SHOSTAK, entrepreneur individuel (EI), trading as IMIN |
| Address | Organizer's legal contact in its account (a postal address where given) | 11 rue du Grand Wad, 57000 Metz, France |
| Contact | Organizer's legal contact in its account | hello@imin.wtf · data requests: privacy@imin.wtf |
| Role | Controller | Processor |
| Signature | As part of the Organizer Terms | Electronic, by publication of this DPA |
Annex II · Description of the processing
| Item | Description |
|---|---|
| Data subjects | Buyers, ticket holders, free RSVP guests, attendees scanned at the door, people imported by the Organizer, contacts of the Organizer's audience |
| Categories of personal data | First name or name, email, order and ticket data (event, ticket type, price, date), attendance (QR scan time), consent and opposition records, music-genre tags derived only from this Organizer's events, support messages. No special categories, no payment card numbers (held by Stripe), no identification numbers, no free-text sensitive data |
| Sensitive data | None processed. The Organizer must not upload sensitive data |
| Nature and purposes of processing | Hosting and operating the Organizer's ticketing account: (1) ticket sale support, delivery, check-in, refunds and customer support for the Organizer's events; (2) transactional emails for these events; (3) the Audience tool: purchase and attendance history; segments and taste only from this Organizer's events and whitelisted music genres; consent, soft opt-in and opposition records; marketing emails only when the Organizer launches a campaign; random holdout groups; campaign statistics; (4) imports only with per-row source and proof; (5) AI copywriting and suggestions without attendee personal data in prompts |
| Excluded | IMIN's own marketing from this data, cross-organizer targeting, sale of data, training AI models on personal data |
| Duration | The term of the Organizer's account, plus the periods below |
| Retention | Marketing data: 3 years from the last purchase or last contact from the person; opposition list: 3 years; order and accounting records: as the law requires; on termination, export then deletion within 60 days unless the law requires keeping |
| Location | EU for the database (Railway, Netherlands, europe-west4). Transfers to US providers: see Annex IV |
| Instructions | The Organizer's documented instructions are its use of the dashboard and API settings and these terms. IMIN tells the Organizer if an instruction seems to breach the GDPR |
Annex III · Technical and organisational measures (concrete)
- Access control: role-based access (owner, admin, member), per-organizer data separation (an organizer cannot read another's data), sign-in with email and password (address verified by a one-time code) or with Google or Apple; sessions expire; production access limited to named people and logged.
- Encryption: HTTPS/TLS for all traffic; provider-managed encryption at rest for the database.
- Minimisation: the Audience tool uses only the data needed; no sensitive tags; consent records store the text shown, version, source and time; no IP or user agent unless required.
- Logging: application logs are structured without needless personal data; access to logs restricted; logs kept up to 12 months.
- Backups and recovery: the database backup policy (frequency, retention, restore test) is being defined and will be stated in the next version of this annex.
- Sending: email from a dedicated sending subdomain with SPF, DKIM and DMARC; one-click unsubscribe; no open or click tracking on French marketing emails; complaint breaker.
- AI: no attendee personal data in prompts; zero data retention and data collection denied at the AI provider; a CI scanner blocks personal data in prompt payloads.
- Development: code review before production; secrets in provider vaults; dependency updates; separation of test and live data.
- Incident response: incidents logged; the Organizer is notified without undue delay (at most 48 hours after IMIN becomes aware); affected data and measures described.
- Deletion and export: the Organizer can export its data (CSV) and request erasure; erasure and opposition requests are executed in the product (suppression list).
- Personnel: persons authorised to process data are bound by confidentiality.
Annex IV · Sub-processors (general authorisation)
| Sub-processor | Service | Location | Transfer tool |
|---|---|---|---|
| Stripe Payments Europe, Ltd. (Dublin, Ireland) | payments, payouts to organizers (also an independent controller for its own purposes: fraud, regulation) | EU; possible US transfers | SCCs and EU-US DPF |
| Railway Corporation, 548 Market St Suite 68956, San Francisco, California 94104, USA | API hosting and database | EU (Netherlands, europe-west4) | SCCs |
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | site and web app hosting | US (default execution region); static content via Vercel's global network | SCCs, DPF; plan covered by Vercel's DPA |
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | DNS, network protection, media storage (cdn.imin.wtf) | global | SCCs, DPF |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | transactional and marketing email sending | US (all stored data) | SCCs + short transfer impact assessment |
| OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, USA | AI model routing for copy and posters (no attendee personal data) | US | SCCs (module 2), zero data retention |
| Ideogram AI, Inc., 320 Bay St, Suite 700, Toronto, ON M5H 4A6, Canada | poster generation from the artist photo an Organizer uploads | US | SCCs |
| Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA | error monitoring, default PII off | EU (Germany) | SCCs |
| Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland | Conversions API with hashed email, only when the Organizer connects its Meta pixel and the buyer gave advertising consent (also an independent controller for its own purposes) | EU; possible US transfers | SCCs, DPF |
Changes: IMIN gives at least 10 days' notice of a new or replacement sub-processor (or immediate notice where a provider gives IMIN less); the Organizer may object on reasonable grounds, otherwise it may terminate without cost. The same list is published at /subprocessors with a "last changed" date.
English reference translation
In case of difference the French version prevails.
This Data Processing Agreement ("DPA") is part of the Organizer Terms. It is made between the Organizer (controller) and Bohdan SHOSTAK EI, SIREN 109 485 573, Metz (IMIN, processor). The parties adopt, unmodified, the standard contractual clauses of Commission Implementing Decision (EU) 2021/915, whose official text is published on EUR-Lex: https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj. Choices: clause 7.7 option 2 (general authorisation of sub-processors with notice of at least 10 days, or immediate where a provider gives IMIN less notice); clause 9: breach notification without undue delay and at most 48 hours after IMIN becomes aware; governing law: French law; courts: Metz; competent supervisory authority: CNIL.
Annex I · List of parties
| Controller | Processor | |
|---|---|---|
| Name | The Organizer named in its account (legal name from Settings → Legal identity) | Bohdan SHOSTAK, entrepreneur individuel (EI), trading as IMIN |
| Address | Organizer's legal contact in its account (a postal address where given) | 11 rue du Grand Wad, 57000 Metz, France |
| Contact | Organizer's legal contact in its account | hello@imin.wtf · data requests: privacy@imin.wtf |
| Role | Controller | Processor |
| Signature | As part of the Organizer Terms | Electronic, by publication of this DPA |
Annex II · Description of the processing
| Item | Description |
|---|---|
| Data subjects | Buyers, ticket holders, free RSVP guests, attendees scanned at the door, people imported by the Organizer, contacts of the Organizer's audience |
| Categories of personal data | First name or name, email, order and ticket data (event, ticket type, price, date), attendance (QR scan time), consent and opposition records, music-genre tags derived only from this Organizer's events, support messages. No special categories, no payment card numbers (held by Stripe), no identification numbers, no free-text sensitive data |
| Sensitive data | None processed. The Organizer must not upload sensitive data |
| Nature and purposes of processing | Hosting and operating the Organizer's ticketing account: (1) ticket sale support, delivery, check-in, refunds and customer support for the Organizer's events; (2) transactional emails for these events; (3) the Audience tool: purchase and attendance history; segments and taste only from this Organizer's events and whitelisted music genres; consent, soft opt-in and opposition records; marketing emails only when the Organizer launches a campaign; random holdout groups; campaign statistics; (4) imports only with per-row source and proof; (5) AI copywriting and suggestions without attendee personal data in prompts |
| Excluded | IMIN's own marketing from this data, cross-organizer targeting, sale of data, training AI models on personal data |
| Duration | The term of the Organizer's account, plus the periods below |
| Retention | Marketing data: 3 years from the last purchase or last contact from the person; opposition list: 3 years; order and accounting records: as the law requires; on termination, export then deletion within 60 days unless the law requires keeping |
| Location | EU for the database (Railway, Netherlands, europe-west4). Transfers to US providers: see Annex IV |
| Instructions | The Organizer's documented instructions are its use of the dashboard and API settings and these terms. IMIN tells the Organizer if an instruction seems to breach the GDPR |
Annex III · Technical and organisational measures (concrete)
- Access control: role-based access (owner, admin, member), per-organizer data separation (an organizer cannot read another's data), sign-in with email and password (address verified by a one-time code) or with Google or Apple; sessions expire; production access limited to named people and logged.
- Encryption: HTTPS/TLS for all traffic; provider-managed encryption at rest for the database.
- Minimisation: the Audience tool uses only the data needed; no sensitive tags; consent records store the text shown, version, source and time; no IP or user agent unless required.
- Logging: application logs are structured without needless personal data; access to logs restricted; logs kept up to 12 months.
- Backups and recovery: the database backup policy (frequency, retention, restore test) is being defined and will be stated in the next version of this annex.
- Sending: email from a dedicated sending subdomain with SPF, DKIM and DMARC; one-click unsubscribe; no open or click tracking on French marketing emails; complaint breaker.
- AI: no attendee personal data in prompts; zero data retention and data collection denied at the AI provider; a CI scanner blocks personal data in prompt payloads.
- Development: code review before production; secrets in provider vaults; dependency updates; separation of test and live data.
- Incident response: incidents logged; the Organizer is notified without undue delay (at most 48 hours after IMIN becomes aware); affected data and measures described.
- Deletion and export: the Organizer can export its data (CSV) and request erasure; erasure and opposition requests are executed in the product (suppression list).
- Personnel: persons authorised to process data are bound by confidentiality.
Annex IV · Sub-processors (general authorisation)
| Sub-processor | Service | Location | Transfer tool |
|---|---|---|---|
| Stripe Payments Europe, Ltd. (Dublin, Ireland) | payments, payouts to organizers (also an independent controller for its own purposes: fraud, regulation) | EU; possible US transfers | SCCs and EU-US DPF |
| Railway Corporation, 548 Market St Suite 68956, San Francisco, California 94104, USA | API hosting and database | EU (Netherlands, europe-west4) | SCCs |
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | site and web app hosting | US (default execution region); static content via Vercel's global network | SCCs, DPF; plan covered by Vercel's DPA |
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | DNS, network protection, media storage (cdn.imin.wtf) | global | SCCs, DPF |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | transactional and marketing email sending | US (all stored data) | SCCs + short transfer impact assessment |
| OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, USA | AI model routing for copy and posters (no attendee personal data) | US | SCCs (module 2), zero data retention |
| Ideogram AI, Inc., 320 Bay St, Suite 700, Toronto, ON M5H 4A6, Canada | poster generation from the artist photo an Organizer uploads | US | SCCs |
| Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA | error monitoring, default PII off | EU (Germany) | SCCs |
| Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland | Conversions API with hashed email, only when the Organizer connects its Meta pixel and the buyer gave advertising consent (also an independent controller for its own purposes) | EU; possible US transfers | SCCs, DPF |
Changes: IMIN gives at least 10 days' notice of a new or replacement sub-processor (or immediate notice where a provider gives IMIN less); the Organizer may object on reasonable grounds, otherwise it may terminate without cost. The same list is published at /subprocessors with a "last changed" date.
Questions? hello@imin.wtf