- 1. Definitions
- 2. Scope and roles
- 3. Customer’s obligations
- 4. OPERO’s obligations
- 5. Sub-processors
- 6. International transfers
- 7. Personal data breaches
- 8. Deletion and return
- 9. Audits
- 10. Liability and precedence
- 11. Duration
- Annex I — Details of processing
- Annex II — Technical and organisational measures
- Annex III — Sub-processors
This Data Processing Agreement (“DPA”) forms part of the OPERO Terms of Service (“Terms”) between:
- the Customer, the controller; and
- Ofski, MB, company code 304215619, Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania, the processor (“OPERO”, “we”).
It applies whenever we process personal data on the Customer’s behalf in the Service, as required by Article 28 of the GDPR. It takes effect when the Customer accepts the Terms, with no separate signature needed. A countersigned copy is available on request at support@opero.events.
1. Definitions
Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR (Regulation (EU) 2016/679). “Customer Personal Data” means personal data within Customer Data that we process for the Customer.
2. Scope and roles
2.1. The Customer is the controller of Customer Personal Data, and OPERO is its processor.
2.2. The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are set out in Annex I.
2.3. This DPA does not cover the data we process as a controller (Account, billing and security data). That is covered by our Privacy Policy.
3. Customer’s obligations
The Customer is responsible for:
- having a lawful basis for the processing it instructs;
- giving data subjects the required information;
- the accuracy of Customer Personal Data;
- not entering special categories of data unless lawful and necessary.
4. OPERO’s obligations
4.1. Instructions. We process Customer Personal Data only on the Customer’s documented instructions, including for transfers to third countries, unless EU or Member State law requires otherwise. In that case we will tell the Customer first unless the law forbids it. The Terms, this DPA and the Customer’s use and configuration of the Service are the Customer’s instructions. We will tell the Customer if we believe an instruction breaks data protection law.
4.2. Confidentiality. Everyone we authorise to process Customer Personal Data is bound by confidentiality.
4.3. Security. We implement the technical and organisational measures in Annex II. We may update them as long as the overall level of protection is not reduced.
4.4. Assistance. Taking into account the nature of processing, we will help the Customer:
- respond to data subject requests, mainly through the Service’s own features (view, edit, export, delete);
- meet its obligations under Articles 32–36 GDPR (security, breach notification, impact assessments, prior consultation).
4.5. Data subject requests. If a data subject contacts us directly about Customer Personal Data, we will forward the request to the Customer and not answer it ourselves, unless the Customer authorises us to.
5. Sub-processors
5.1. The Customer gives general authorisation for us to use sub-processors. The current list is in Annex III.
5.2. We will tell the Customer about any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the Account owner or by updating Annex III with notice in the Service. The Customer may object on reasonable data protection grounds within that period. If we cannot reasonably address the objection, the Customer may terminate the affected subscription and receive a proportionate refund of prepaid fees.
5.3. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance.
5.4. Third-party services enabled by the Customer. Where the Customer connects the Service to a third-party service using the Customer’s own account or credentials (for example an advertising platform, a ticketing platform or a flight data service), that provider acts under its agreement with the Customer and is not a Sub-processor of OPERO. OPERO transmits data to it only as the Customer’s configuration requires, which forms part of the Customer’s instructions under clause 4.1. Disconnecting the service stops further transmission.
6. International transfers
Where Customer Personal Data is transferred outside the EU/EEA, we ensure an adequate safeguard is in place, such as an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or the European Commission’s Standard Contractual Clauses.
7. Personal data breaches
7.1. We will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
7.2. The notice will include, as far as available:
- the nature of the breach;
- the categories and approximate number of data subjects and records affected;
- the likely consequences;
- the measures taken or proposed;
- a contact point.
We will take reasonable steps to contain the breach and limit its effects.
8. Deletion and return
8.1. During the subscription, the Customer can export Customer Data at any time.
8.2. After the Service ends, Customer Data is deleted on the timeline in the Terms (30 days after a trial or cancellation; 60 days after a lock for non-payment), unless law requires us to keep it.
8.3. Data in encrypted backups is deleted when those backups expire. Backups of deleted Workspaces are removed within about 12 months.
9. Audits
9.1. We will make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires and a description of our measures.
9.2. If that information is not enough, the Customer, or an independent auditor bound by confidentiality, may audit us once a year with at least 30 days’ notice. The audit must take place during business hours, at the Customer’s cost, and without disrupting the Service or other customers’ data.
10. Liability and precedence
10.1. Liability under this DPA is subject to the limitations in the Terms, except where the GDPR does not allow such limits.
10.2. If this DPA conflicts with the Terms on data protection, this DPA prevails.
11. Duration
This DPA lasts as long as we process Customer Personal Data under the Terms.
Annex I — Details of processing
| Item | Details |
|---|---|
| Subject matter | Providing the OPERO back-office platform for live event companies |
| Duration | For the term of the subscription or trial, plus the deletion periods in section 8 |
| Nature of processing | Hosting, storage, backup, retrieval, display, search, transmission (including email sending), AI-assisted processing when the Customer uses AI features, deletion |
| Purpose | To provide, secure and support the Service for the Customer |
| Data subjects | The Customer’s staff and Users; artists, performers, agents and managers; crew and contractors; venue, supplier and partner contacts; the Customer’s clients; where the Customer uses ticketing integrations, ticket buyers and attendees |
| Personal data | Names; contact details (email, phone, address); company and role; contract and fee details; bank details for payments; travel and logistics details; event and schedule data; documents and files uploaded by the Customer; communications and notes; Users’ login and activity logs |
| Special categories | Not intended. The Customer must not enter them unless lawful and necessary (for example dietary or accessibility needs for crew), and is responsible for that decision. |
Annex II — Technical and organisational measures
- Isolation: each Workspace runs on its own separate database.
- Encryption in transit: HTTPS/TLS on all public connections.
- Backups: daily backups, encrypted and stored offsite in the EU (AWS, Paris). Restore procedures are tested.
- Access control: staff access only where needed, through individual accounts. Customer access is by individual user accounts, with roles and permissions set by the Customer.
- Authentication: passwords stored as hashes; single sign-on between the account service and Workspaces using OAuth 2.0 with PKCE; sign-in links that expire.
- Application security: bot protection on sign-up; rate limits; CSRF protection; credentials kept out of URLs and logs.
- Operations: monitoring and alerts; routine updates applied regularly; logs kept for a limited period.
- Hosting: servers hosted by Hetzner in the EU, in certified data centres.
- Incident response: a documented process for breach assessment and notification (section 7).
- People: confidentiality obligations for everyone with access.
Annex III — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of servers and databases | EU (Germany/Finland) |
| Amazon Web Services EMEA SARL | Encrypted offsite backups | EU (Paris) |
| Hostinger International Ltd | Sending emails from the Service | EU (Lithuania) |
| Anthropic, PBC | AI features (only the content used in AI features); not used for model training | US (SCCs / adequacy) |
| Cloudflare, Inc. | Bot protection on sign-up | Global (SCCs / adequacy) |
Services the Customer connects with its own credentials, such as flight lookup with AeroDataBox (through RapidAPI), are not Sub-processors (clause 5.4). Flight lookup receives only a flight number and date.
Stripe is not a sub-processor of Customer Personal Data. It processes billing data for us as a controller or processor under our Privacy Policy.