Data Processing Agreement
This agreement applies when an organiser (the Controller) uses Konecto (the Processor) to run events and in doing so Konecto processes personal data on the organiser's behalf. It forms part of the Terms of Service and is governed by UK GDPR and the Data Protection Act 2018. To receive a countersigned copy, write to hello@konec.to.
Last updated 14 October 2026.
1. Parties and roles
The organiser is the controller of personal data about its attendees, exhibitors, sponsors, speakers and team, and Konecto is its processor. The organiser's details are those given when the organisation was created in the Konecto organiser app, or in a signed order form.
Konecto is a controller, not a processor, for a small set of data it decides the purposes of itself: organiser account and billing records, security and abuse logs, its own product analytics (consent based) and any attendee Konecto card, connections and chats, which belong to the attendee (see the Privacy Policy). Those are outside this agreement.
2. Subject matter, duration and nature of processing
Konecto processes personal data to provide the event platform: ticketing and registration, event pages, check-in, attendee communications, exhibitor and sponsor tools, analytics shown to the organiser, and data export and deletion. Processing lasts for as long as the organisation has an account, plus the deletion period in section 9.
3. Types of data and data subjects
| Data subjects | Personal data |
|---|---|
| Attendees and ticket buyers | Name, email address, phone number if collected, ticket and order details, registration answers and consent records, check-in times, optional card, connection and message data an attendee chooses to share through the attendee app |
| Exhibitors, sponsors, speakers | Name, work contact details, company, booth and lead-scan records |
| Organiser team members | Name, email address, role, sign-in and audit records |
Special category data is not requested by Konecto. If the organiser adds registration questions that collect it, the organiser is responsible for having a lawful basis and an additional condition.
4. Konecto's obligations
Konecto will:
- process personal data only on the organiser's documented instructions, which are this agreement and the organiser's use of the product and API, unless the law requires otherwise (and then tell the organiser first where it may);
- make sure everyone who can access the data is bound by confidentiality;
- apply the security measures in section 5;
- help the organiser answer requests from individuals (access, correction, deletion, restriction, portability, objection) through the export and delete tools in the product, and forward any request it receives directly;
- help the organiser with security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to Konecto;
- tell the organiser without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data;
- tell the organiser if an instruction appears to infringe data protection law;
- make available the information needed to show compliance and allow reasonable audits (section 8).
5. Security
Konecto applies measures appropriate to the risk, including: encryption in transit (TLS) and at rest; row-level isolation between organisations in the database; role-based access for organiser teams, with a one-hour limit on sign-in tokens; hashed API keys; signed, expiring links for downloads and surveys; rate limiting and abuse controls; an audit log of sensitive actions; access to production data limited to named staff who need it; and regular backups. Konecto reviews these measures as the product changes.
6. Sub-processors
The organiser gives general authorisation for the following sub-processors. Konecto binds each to terms with equivalent data protection obligations and remains responsible for them.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and realtime messaging | European Union |
| Cloudflare | Hosting, network, file storage (EU jurisdiction), email sending | Global network; stored data in the European Union |
| Resend | Transactional email delivery, only while it is enabled in place of Cloudflare email | United States |
| Stripe | Payment processing. Stripe acts as an independent controller for payment data under its own terms | Stripe's regions |
Konecto will give at least 30 days' notice of a new or replacement sub-processor at hello@konec.to or in the organiser app. The organiser may object on reasonable data protection grounds within that period; if the objection cannot be resolved the organiser may end the affected service.
7. International transfers
Event data is hosted in the European Union. Where a sub-processor processes data outside the UK, Konecto relies on UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework where the recipient is certified) or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required.
8. Audits and information
On reasonable written notice, no more than once a year unless a breach has occurred, Konecto will provide its current security documentation and answer reasonable audit questionnaires. An on-site audit is available only where that information is not enough, at the organiser's cost, during business hours and under confidentiality.
9. Deletion and return
The organiser can export event data at any time and delete an event or the whole organisation in the app. Deleted data is removed from live systems within 30 days of the request and from backups as they expire. At the end of the service Konecto deletes or returns personal data at the organiser's choice, unless the law requires it to keep a copy.
10. The organiser's responsibilities
The organiser decides what personal data to collect and why, tells attendees about it, obtains valid consent where it relies on consent, and keeps its instructions to Konecto lawful.
11. Liability and term
Each party's liability under this agreement is subject to the limitations in the Terms of Service. This agreement lasts as long as Konecto processes personal data for the organiser. It is governed by the laws of England and Wales and the courts of England and Wales have jurisdiction.
Contact
Data protection questions and DPA requests: hello@konec.to.