Data Processing Agreement

Last updated: 2026-04-28

This DPA forms part of the Terms of Service between you (the “Controller”) and Tilmeldr ApS (the “Processor”).

1. Subject matter

Processing personal data of your event guests (“data subjects”) submitted through forms hosted on the Tilmeldr platform.

2. Categories of data subjects

Anyone registering for events you publish.

3. Categories of personal data

Whatever fields you configure on your forms — typically name, email, phone, dietary preferences. Tilmeldr stores this verbatim.

4. Sub-processors

See the Privacy Policy for the current list. We notify you 30 days in advance of new sub-processors.

5. Security measures

• TLS 1.2+ for all data in transit.
• At-rest encryption for the database (provider-managed).
• Per-tenant data isolation enforced at the application layer.
• Rate limiting and bot protection on public submission endpoints.
• Backups encrypted and retained ≤ 90 days.

6. Data subject requests

We forward access/erasure requests we receive directly to you within 5 working days. Submitters can also self-serve via the unsubscribe / delete-my-record link in the confirmation email.

7. Data location & transfers

EU/EEA only by default (Frankfurt or Stockholm regions). Custom region available on Enterprise plans.

8. Audit rights

Annual SOC 2 Type II reports (when available) and pen-test summaries on request. On-site audits available on Enterprise plans with reasonable notice.

9. Termination

On termination, data is purged within 30 days. A final export is available before purge via /admin/privacy.