Data Processing Addendum

Section 1: Scope, definitions & regulatory framework

1.1. Applicable Data Protection Law. “Data Protection Law” means privacy and data-protection laws applicable to the processing, including the EU General Data Protection Regulation (“EU GDPR”), UK GDPR and Data Protection Act 2018, Swiss Federal Act on Data Protection (“FADP”), California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”), other applicable U.S. state privacy laws, Canada’s PIPEDA and substantially similar provincial laws including Quebec Law 25, Brazil’s LGPD, India’s Digital Personal Data Protection Act, and any binding replacement or implementing legislation.

1.2. Key terms. “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “Process/Processing,” “Supervisory Authority,” and “Special Category Data” have the meanings assigned by applicable Data Protection Law. “Customer Personal Data” means Personal Data processed by WebinarGent on Customer’s behalf. “Subprocessor” means a third party appointed by WebinarGent to process Customer Personal Data.

1.3. Scope. This DPA applies only to Customer Personal Data processed by WebinarGent as a Processor or service provider/contractor. It does not govern Personal Data for which WebinarGent independently determines the purposes and means of processing, which is addressed in the Privacy Policy.

Section 2: Roles, authority & compliance

2.1. Customer is the Controller or Business and WebinarGent is the Processor or Service Provider/Contractor for Customer Personal Data. Each party will comply with the obligations that apply to it under Data Protection Law.

2.2. Customer determines the lawful purpose and means of processing, provides all required notices, obtains valid consents or other lawful bases, and ensures that its instructions and use of the Services comply with law. Customer is responsible for the accuracy, quality, and legality of Customer Personal Data and how it was obtained.

2.3. Agency Hosts. An Agency Host represents that it has authority from each Agency Client to instruct WebinarGent and enter into this DPA for the relevant processing. The Agency Host remains responsible for its Agency Clients’ instructions, configuration, and compliance and is jointly and severally liable as provided in the Agreement.

2.4. U.S. restricted processing. To the extent applicable, WebinarGent will not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship or for a commercial purpose other than providing the Services, or combine it with personal data received from another person except as permitted by applicable law and the Agreement.

Section 3: Documented processing instructions

3.1. WebinarGent will process Customer Personal Data only on Customer’s documented instructions, including the Agreement, this DPA, Order Forms, Customer’s use and configuration of the Services, and other written instructions consistent with the Agreement.

3.2. Instructions include processing needed to provide, secure, support, and improve the contracted Services: webinar registration and attendance; live, automated, hybrid, and replay delivery; media hosting, transcription, chat, Q&A, polls, offers, and engagement; email and SMS communications; AI-assisted content and campaign functions; analytics and reporting; integrations; troubleshooting; fraud prevention; and legal compliance.

3.3. WebinarGent will promptly inform Customer if, in its reasonable opinion, an instruction infringes Data Protection Law and may suspend the affected processing until the parties resolve the issue. WebinarGent may process Customer Personal Data where required by law, in which case it will notify Customer before processing unless law prohibits notice.

3.4. WebinarGent will not use Customer Personal Data for unrelated commercial purposes or train generally available AI models on Customer Personal Data unless Customer has expressly opted in through a separate written agreement.

Section 4: Sensitive data, health data & prohibited uploads

Customer must not submit Special Category Data, sensitive personal information, government identification numbers, payment-card data outside approved payment fields, or other highly regulated data unless the Agreement expressly permits it and appropriate safeguards are configured.

Protected Health Information (“PHI”) is prohibited unless WebinarGent and Customer have executed a Business Associate Agreement before processing begins. Customer is solely responsible for identifying regulated data and securing all required consents and authorizations.

Section 5: Subprocessors

5.1. General authorization. Customer authorizes WebinarGent to appoint the Subprocessors listed in Annex III and at webinargent.com/trust/subprocessors. WebinarGent will impose written data-protection obligations that are no less protective in material respects than those in this DPA and remains responsible for each Subprocessor’s performance to the extent required by law.

5.2. Changes. WebinarGent will provide at least thirty (30) days’ advance notice of a new Subprocessor where practicable. Customer may object on reasonable data-protection grounds by emailing compliance@webinargent.com within fourteen (14) days after notice.

5.3. Objections. The parties will work in good faith on a commercially reasonable alternative. If none is available, WebinarGent may choose not to appoint the Subprocessor or Customer may terminate only the affected Service and receive a pro-rata refund of prepaid unused fees for that affected Service. Customer may not withhold payment or terminate unaffected Services.

Section 6: Confidentiality, security & breach response

6.1. WebinarGent will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations, receive appropriate privacy and security training, and access data only as necessary for their roles.

6.2. WebinarGent will maintain the technical and organizational measures described in Annex II, taking into account the state of the art, implementation cost, and the nature, scope, context, purposes, and risks of processing.

6.3. Security incidents. WebinarGent will notify Customer without undue delay and, where feasible, within forty-eight (48) hours after confirming a Personal Data Breach affecting Customer Personal Data. Notice will include available information about the nature of the incident, affected data and people, likely consequences, mitigation taken or proposed, and an incident contact. Information may be supplied in phases as it becomes available.

6.4. WebinarGent will take reasonable steps to contain, investigate, mitigate, and remediate a Personal Data Breach and will reasonably assist Customer with legally required notifications. Notice does not constitute an admission of fault or liability. Customer remains responsible for determining its own notification obligations.

Section 7: Data-subject rights

Taking into account the nature of processing, WebinarGent will provide Customer with self-service tools and reasonable technical assistance to respond to requests for access, correction, deletion, portability, restriction, objection, or other applicable rights.

If WebinarGent receives a request relating to Customer Personal Data, it will direct the requester to Customer and will not independently respond except on Customer’s documented instruction or as required by law. Customer is responsible for verifying requests and communicating with Data Subjects and regulators.

Section 8: DPIAs & regulatory consultation

Taking into account the nature of the processing and information available to WebinarGent, WebinarGent will provide reasonable assistance with Customer’s data-protection impact assessments and prior consultations with Supervisory Authorities where Customer cannot otherwise obtain the relevant information. Additional or bespoke assistance may be subject to reasonable fees agreed in advance.

Section 9: International data transfers

9.1. Each party will ensure that transfers of Personal Data from the EEA, United Kingdom, or Switzerland to a country without an adequacy decision use a valid transfer mechanism.

9.2. EU SCCs. The European Commission Standard Contractual Clauses adopted by Decision 2021/914 are incorporated by reference. Module Two (Controller to Processor) applies; the optional docking clause applies; Option 2 general authorization applies with the notice periods in Section 5; and Annexes I–III of this DPA complete the SCC annexes. The SCCs are governed by Irish law and disputes are submitted to the courts of Dublin, Ireland.

9.3. UK transfers. For restricted transfers governed by UK law, the then-current UK International Data Transfer Addendum (including version B1.0 where applicable) modifies and supplements the SCCs.

9.4. Swiss transfers. For transfers governed by the FADP, references in the SCCs are adapted to the FADP and the competent Swiss authority and courts as required by law.

Section 10: Information & audit rights

On written request no more than once annually, WebinarGent will provide information reasonably necessary to demonstrate compliance, including available third-party audit summaries or certifications. More frequent requests are permitted following a Personal Data Breach or where required by a Supervisory Authority.

If the supplied information is insufficient, Customer may conduct an on-site or remote audit with at least thirty (30) days’ written notice, during normal business hours, under appropriate confidentiality terms, and without unreasonably disrupting operations or exposing other customers’ information. Customer bears its audit costs and WebinarGent’s reasonable costs unless the audit identifies a material breach by WebinarGent.

Section 11: Return, retention & deletion

During the Subscription Term, Customer may access, export, and delete Customer Personal Data using available controls. Customer should complete desired exports before termination.

After termination or expiry, WebinarGent will delete or anonymize Customer Personal Data in accordance with its standard lifecycle, with final purge from active systems no later than twenty-four (24) months unless law requires retention. On Customer’s written request, WebinarGent will initiate an accelerated purge and complete deletion from active systems within thirty (30) days where technically feasible. Residual encrypted backup copies may remain for up to sixty (60) days and will be isolated from ordinary use until overwritten.

WebinarGent may retain data required by law, necessary to establish or defend legal claims, or already irreversibly anonymized. The confidentiality and protection obligations in this DPA continue for retained Personal Data.

Sections 12–13: Liability, order of precedence & general terms

12.1. Each party’s liability under this DPA is subject to the exclusions and limitations in the Agreement, except to the extent prohibited by Data Protection Law or the SCCs.

12.2. Precedence. If documents conflict regarding processing, the order of precedence is: applicable SCCs or mandatory transfer terms; this DPA; the Agreement/Terms of Service; and an Order Form, unless the Order Form expressly states that it overrides a named DPA provision.

13.1. This DPA terminates automatically when WebinarGent no longer processes Customer Personal Data, except for provisions intended to survive. Amendments must be in writing, including an electronic update accepted under the Agreement. Invalid provisions will be limited to the minimum extent necessary without affecting the remainder.

13.2. Except where the SCCs or mandatory law require otherwise, this DPA is governed by Delaware law and the dispute provisions of the Agreement. Notices must be delivered using the notice process in the Agreement, with privacy notices copied to compliance@webinargent.com.

Annex I: Parties & description of processing

Annex II: Technical & organizational measures

• Access control: role-based access, least privilege, strong authentication and MFA for privileged access, joiner/mover/leaver controls, and periodic access review.
• Encryption: industry-standard encryption in transit using TLS 1.2 or later and AES-256 or comparable encryption at rest where supported.
• Network and application security: firewalls, segmentation, WAF and DDoS protections, intrusion detection, secure configuration, input validation, dependency management, and controlled production access.
• Secure development: code review, change controls, automated security checks, vulnerability scanning, risk-based patching, and at least annual penetration testing.
• Availability and recovery: monitored cloud infrastructure, multi-region or redundant services where appropriate, backups retained for up to sixty (60) days, restoration testing, incident response, and business-continuity procedures.
• Logging and monitoring: access and security event logging, alerting, audit trails, and controls designed to detect unauthorized activity.
• Personnel and governance: confidentiality commitments, privacy and security training, vendor risk review, documented policies, risk assessments, and incident exercises.
• Physical security: reliance on audited physical and environmental protections maintained by reputable cloud hosting providers, including AWS and Google Cloud.
• Data lifecycle: logical tenant separation, minimization, retention controls, secure disposal, and backup expiration.

Annex III: Authorized Subprocessors

The current list, including service-specific locations and updates, is maintained at webinargent.com/trust/subprocessors.