Data processing terms

01Who's who

These terms are part of the terms of service between you, the organiser, and TUNEDGRID SAS, and you accept them when you accept the terms of service. For the personal data of your guests, applicants and contacts, you are the controller and TUNEDGRID SAS is the processor. We follow your documented instructions: your settings and the actions you and your team take on EventoLinks. If we believe an instruction breaks data protection law, we tell you.

You're responsible for having a lawful basis to collect your guests' data, for telling them how you use it, and for the questions you ask them. These terms follow Uruguayan data protection law (Ley 18.331) and, where it applies, the European Union's General Data Protection Regulation.

02What we process

Names, emails and phone numbers; answers to your questions; replies, reservations, tickets and orders; payments you confirm and the receipts buyers upload; check-ins at the door and the box office; applications and jury scores; contacts and segments; messages you send. We process them to provide EventoLinks to you, for as long as you use it, and for nothing else: never for our own marketing, and never sold. People who process them for us are bound by confidentiality.

We are controller, not processor, only for what we need for ourselves: security, fraud and abuse prevention, the moderation of reported content and the records the law requires us to keep, as the privacy policy explains.

03Sub-processors

We use providers for hosting, email, WhatsApp messages, phone verification codes, security and the AI writing assistant, under written terms that protect the data as these do. The AI provider only receives the text you ask it to work on, never your guest list, and doesn't use it to train its models. The annex names the providers that process data for us, what each does and where; we keep it up to date and tell you in advance about intended changes. Changes apply on the date given in the notice. If you don't agree with a change, you can stop using the service and close your account.

Our database, servers and email sending are in the United States (Virginia). Transfers outside the country where data was collected rely on the safeguards set out in the privacy policy, including standard contractual clauses with each sub-processor outside a country with adequate protection.

04Security and incidents

Data is encrypted in transit and at rest, access is limited to the people who need it, and every access by our team is logged. Devices used at the door and the box office keep their offline copy of the guest list encrypted. If a breach affects your data, we tell you without undue delay, with what we know and what we're doing about it, so you can meet your own duties to your guests and the authorities.

05Helping you

You can answer your guests' requests yourself: exporting and erasing a guest's data take one step from the guest list. When a guest writes to us to access, correct or erase their details, you instruct us, by accepting these terms, to answer it for you. We check it's them, act within the time limits required by applicable regulations and tell you what we did after each change. On an erasure we tell you only that a guest's details were removed, never who. If a law requires you to keep something, tell us within that time and we'll keep it and explain why to the guest. We also help, where the law requires it, with security, impact assessments and consultations with the Unidad Reguladora y de Control de Datos Personales (URCDP) or another authority. You can ask us for the information you need to show that these terms are met. We allow audits by you, or by an auditor you mandate, once a year, on 30 days' notice.

06When it ends

You can export everything at any time: the guest list as a CSV file, and your account's data as a JSON file from Settings. When you delete an event, its guests' data is deleted with it. When you close your account, we delete your guests' data within 30 days, except what the law requires us to keep. Backups are overwritten on a fixed cycle after that.

07Contact

Ask TUNEDGRID SAS for a signed copy, or anything else about these terms.

08Annex: our providers

The providers that process personal data for us, for your guests' data and for our own:

Services people use directly, under their own terms and privacy policies, as their own controllers: