DPA

Data processing agreement

Version of 25 Oct 2026

Parties and conclusion

Controller: the company that runs a waiting list or event sign-ups in tuned (name, address and tax ID from the organisation’s details).

Processor: Zdzisław Bela, operator of the tuned service, contact: host@tunedparty.com.

The agreement is concluded in the panel with the first product of the waiting list (the “I accept the data processing agreement” box) or before the first event is published (the “I accept the organizer terms and the data processing agreement” box). We record the time of acceptance, the account that gave it and the version of the agreement.

1. Subject and term

  1. The Controller entrusts the processing of data of people who sign up to its waiting list or for its events on the list and event pages in tuned.
  2. The agreement lasts as long as the Controller has a waiting list or events with sign-ups. After they are switched off or the organisation is deleted, we delete the data as set out in point 7.

2. Data, purpose, data subjects

  • Data subjects: the Controller’s customers and prospective customers who signed up to the waiting list.
  • Data: email, first name (optional), product, sign-up time, confirmations of the address, offers, purchase or leaving, number of missed offers, a token for the links in emails. No special categories of data (Art. 9 GDPR), no payment data, no purchase history from the Controller’s shop.
  • Purpose: running the waiting list (the order), sending the list’s emails (address confirmation, “Your turn” with a link and a code), leaving the list, exporting the list for the Controller.
  • Event sign-ups, data subjects: participants and people interested in the Controller’s events.
  • Sign-ups, data: full name, email, phone, the chosen slot or option, sign-up and confirmation time, the Controller’s terms the person accepted, the “Paid” mark entered by the Controller, a token for the links in emails. No payment data.
  • Sign-ups, purpose: taking the sign-up and keeping count of seats, the sign-up emails (address confirmation, “You have a place” with the Controller’s note), cancelling, the list and export for the Controller.
  • Nature: storage, ordering, sending emails, deletion. No AI and no profiling.

3. Controller’s obligations

  1. It has a legal basis for the processing. The sign-up form shows consent to the list’s emails and names the Controller.
  2. It does not use the waiting list for marketing emails beyond the list itself. Exported addresses are its data, and from the export on it alone is responsible for their use.
  3. It answers requests from data subjects (access, deletion, objection). The Processor helps (point 6).

4. Processor’s obligations

  1. It processes the data only on the Controller’s documented instructions; the instructions are this agreement and actions in the panel (a new batch, marking a purchase, an export, removing a product).
  2. Only people authorised by the Processor and bound to confidentiality have access to the data. Today: the operator of the service.
  3. It applies these security measures (Art. 32 GDPR):
    • the database in the EU (Supabase, Frankfurt), encrypted connections (HTTPS/TLS),
    • the Controller sees only its own entries; sign-ups and public links go through the server, not from the browser to the database,
    • links in emails carry a random token, no login needed,
    • address confirmation before joining the list (prevents signing up someone else’s address),
    • request limits per IP address.
  4. It notifies the Controller of a personal data breach without undue delay, no later than 48 hours after discovering it, by email to the organisation owner’s address.
  5. It keeps a record of categories of processing activities (Art. 30(2) GDPR).

5. Sub-processors

The Controller gives general authorisation for these providers:

  • Supabase: database, EU (Frankfurt); data in the EU, support from outside the EEA under standard contractual clauses (SCC).
  • Vercel: server and API hosting, EU (Frankfurt), US company; EU-US Data Privacy Framework.
  • Resend: sending the list’s and sign-ups’ emails, USA; EU-US Data Privacy Framework.

We announce a new provider by email at least 14 days in advance. The Controller may object and switch the waiting list or sign-ups off.

6. Assisting the Controller

  1. Data subject rights: one-click leaving in every email (removes from the list, the entry is gone after 30 days), CSV export in the panel, deleting an entry on request. A request that reaches us is passed on to the Controller within 3 working days.
  2. Sign-ups: cancelling with one link from the email and “Remove” in the panel delete the sign-up at once; the list and CSV export in the panel.
  3. Information for a data protection impact assessment and consultation with the supervisory authority, if the Controller needs it.

7. Deletion

  • An entry after a purchase or leaving: deleted automatically 30 days later.
  • An unconfirmed entry: deleted after 7 days.
  • Removing a product from the list, or the organisation: entries deleted at once.
  • An event sign-up: deleted automatically 30, 90 or 180 days after the event (the Controller’s choice), unconfirmed after 1 day, at once after cancelling, “Remove” or deleting the event.
  • Database backups at Supabase expire on their own cycle.
  • Before the organisation is deleted, the Controller can download a CSV export; after the agreement ends we keep no copy.

8. Audits

The Controller may ask for the information needed to show compliance with Art. 28 GDPR; we answer within 14 days. An on-site audit on an agreed date, at the Controller’s cost.

9. Final provisions

Polish law; the court competent for the Processor’s seat. Changes to the agreement: a new version in the panel to accept; without acceptance the waiting list stays read-only and export-only, and no new event can be published.

How we process the data of people on the list and in sign-ups is also described in the Privacy policy.