U.S.-Focused Draft
Status: Draft for business and legal review
Date: March 20, 2026
Related agreement: ConfDay Portal Terms of Service, applicable Order, checkout flow, or other written agreement for organizer/customer use of ConfDay
This addendum is structured for a U.S.-focused service-provider / contractor model. It is not drafted as a standalone GDPR or international transfer addendum, but it can be adapted later if ConfDay expands internationally.
This Data Processing and Service Provider Addendum ("Addendum") forms part of the agreement between ConfDay, LLC ("ConfDay") and the organizer, company, or other customer entity that uses the ConfDay service ("Customer"). This Addendum applies when ConfDay processes Customer Data that includes Personal Information on behalf of Customer in connection with the ConfDay portal, related public event pages, related mobile application functionality, and associated organizer-facing services (collectively, the "Services").
This Addendum is intended to support a U.S.-focused service-provider / contractor framework for organizer-customer data handling. It is not drafted as a GDPR-only or international transfer addendum, although it may be adapted later if ConfDay expands internationally.
If there is a conflict between this Addendum and the ConfDay Portal Terms of Service or another applicable service agreement between the parties (the "Agreement"), this Addendum controls solely with respect to the processing of Personal Information subject to this Addendum. In all other respects, the Agreement remains in effect.
ConfDay certifies that it understands the restrictions in this Addendum and will comply with them.
ConfDay shall ensure that persons authorized to process Personal Information are subject to appropriate confidentiality obligations and receive appropriate training or guidance regarding secure and lawful handling.
ConfDay shall implement and maintain reasonable and appropriate administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized or illegal access, acquisition, use, disclosure, alteration, destruction, or loss. Baseline commitments are summarized in Exhibit B.
ConfDay shall notify Customer without unreasonable delay after confirming a Security Incident involving Personal Information subject to this Addendum and provide reasonably available information needed to support Customer's response obligations.
To the extent required by Applicable Privacy Law, ConfDay shall provide reasonable assistance to enable Customer to respond to valid requests from individuals concerning Personal Information processed by ConfDay on Customer's behalf.
To the extent required by Applicable Privacy Law and reasonably requested by Customer, ConfDay shall provide information reasonably necessary for Customer to assess ConfDay's processing of Personal Information under this Addendum. Audit and assessment rights are limited to reasonable and appropriate steps and generally no more than once in any twelve-month period absent a material issue.
ConfDay shall notify Customer if ConfDay determines that it can no longer meet its obligations under Applicable Privacy Law or this Addendum with respect to Personal Information processed on Customer's behalf.
Customer authorizes ConfDay to engage Subprocessors as reasonably necessary to provide the Services. ConfDay shall ensure each relevant Subprocessor is bound by a written agreement imposing materially consistent confidentiality, security, and restricted-use obligations.
ConfDay's intended default model is:
Nothing in this Addendum prohibits ConfDay from creating or using deidentified or aggregated information to the extent permitted by Applicable Privacy Law, provided that such information does not identify Customer or any individual.
If ConfDay receives a compulsory legal demand seeking Personal Information processed on Customer's behalf, ConfDay shall, to the extent legally permitted and reasonably practicable, provide prompt notice to Customer.
For Personal Information processed by ConfDay on Customer's behalf under this Addendum, ConfDay shall not treat that Personal Information as sold or shared for cross-context behavioral advertising purposes.
This Addendum is subject to the liability allocation, disclaimers, exclusions, and limitations of liability set forth in the Agreement.
This Addendum remains in effect for as long as ConfDay processes Personal Information on Customer's behalf under the Agreement.
ConfDay, LLC
PO Box 612
Hatboro, PA 19040
privacy@confday.com
legal@confday.com
Organizer-facing conference and event management processing, including organizer account administration, event management and publishing, customer-directed operational notifications, support and maintenance, security and abuse prevention, billing administration, and internal service quality improvement for the services provided to Customer.
Access controls, authentication and credential protection, encryption and secure transmission, logging and monitoring, vulnerability and patch management, backup and recovery, incident response, subprocessor management, confidentiality, and data minimization by design direction.