Data Processing Agreement

DYNOMATIK DATA PROCESSING AGREEMENT

Effective 15th October 2026

This data processing agreement (DPA) is entered into between Dynomatik Limited, a company registered in England and Wales with company number 13602267 (Dynomatik), and the Customer. It forms part of the Agreement and governs the processing of Personal Data in connection with the Service.

1. Scope and application

1.1 This DPA is incorporated into and forms part of the Agreement. It has no effect except as part of the Agreement.

1.2 This DPA applies to all processing of Personal Data carried out in connection with the Service.

1.3 Precedence. In the event of any conflict between this DPA and any other part of the Agreement, this DPA prevails in respect of the processing of Personal Data. In the event of any conflict between this DPA and Applicable Data Protection Law, that law prevails.

1.4 Variation. This DPA may be varied by an Order Form only where that Order Form expressly identifies the numbered provision of this DPA which it varies. An Order Form does not otherwise vary this DPA.

1.5 Changes by Dynomatik. Dynomatik may amend this DPA where required to reflect a change in Applicable Data Protection Law or in the guidance or decisions of a Supervisory Authority, or to reflect a change of Sub-processor made in accordance with clause 7. Dynomatik shall not otherwise amend this DPA in a manner which materially reduces the protections afforded to the Customer without the Customer’s written agreement.

2. Definitions

In this DPA, the terms controller, processor, data subject, personal data, processing and appropriate technical and organisational measures have the meanings given to them in Applicable Data Protection Law. In addition:

Capitalised terms used but not defined in this DPA have the meanings given to them in the Agreement.

3. Roles of the parties

3.1 Categories of Personal Data. Personal Data processed in connection with the Service falls into the following categories, and the role of each party is determined by the category concerned:

3.2 The same individual may appear in more than one category. The category into which Personal Data falls is determined by the purpose for which, and the basis on which, Dynomatik holds it, and not by the identity of the data subject or by the fields of data concerned. The same individual may be an Organisation Guest of one or more Organisations and, separately and independently, a Member. A person does not cease to be an Organisation Guest by becoming a Member, and does not cease to be a Member by becoming an Organisation Guest.

3.3 Independent controllers, not joint controllers. Where Dynomatik acts as a controller under this DPA it does so as an independent controller. The parties do not jointly determine the purposes or means of any processing, and do not intend to act as joint controllers within the meaning of Article 26 of the UK GDPR or the EU GDPR. Each party is separately and independently responsible for its own compliance with Applicable Data Protection Law in respect of the Personal Data for which it is controller.

3.4 No transfer between categories. A Member Account is not created out of, and does not derive from, Customer Personal Data. The grant or acceptance of an Organisation Membership does not transfer Personal Data between the parties, and does not cause Customer Personal Data to become Member Data or Member Data to become Customer Personal Data.

3.5 Permitted Beneficiary. Where an Order Form names a Permitted Beneficiary: (a) where the Permitted Beneficiary is the controller of Customer Personal Data, the Customer acts as its processor and Dynomatik acts as the Customer’s sub-processor, and clauses 6 to 10 apply as the terms required by Article 28(4) of the UK GDPR; (b) all instructions, approvals, objections and requests under this DPA are given and received through the Customer, and Dynomatik may rely on them as given on behalf of the Permitted Beneficiary; (c) Beneficiary Personnel are treated as workers of the Customer for the purposes of clauses 4 and 5; (d) the Customer is responsible for ensuring that it has authority to give instructions on behalf of the Permitted Beneficiary; and (e) the Permitted Beneficiary is not a party to this DPA and has no right to enforce it, and clause 18.5 of the Terms of Service applies.

4. Member Accounts and Organisation Membership

4.1 Organisations. The Customer’s subscription entitles it to an Organisation. The Customer determines the purposes and means of processing within its Organisation, including which Members are admitted to it, the roles and permissions assigned to them, and the Organisation Content created within it.

4.2 Member Accounts. A Member Account is created directly by an individual, on that individual’s own behalf, under the Member Terms. An individual may create a Member Account without having been invited by any Customer. Dynomatik processes Member Data as an independent controller from the point at which the Member Account is created, and its relationship with the Member exists independently of the Agreement and of any Organisation Membership.

4.3 Lawful basis. Dynomatik’s lawful basis for processing Member Data is the performance of the Member Terms, being a contract to which the Member is party, together with its legitimate interests under clause 4.7. Creation of a Member Account is not conditioned on consent to any processing which is not necessary for that purpose. Where Member Data comprises Dietary Data, Dynomatik’s lawful basis for processing it is the Member’s explicit consent under clause 4.12 and Article 9(2)(a) of the UK GDPR.

4.4 Invitations. The Customer may invite an individual to join its Organisation. The Customer instructs Dynomatik to send that invitation on the Customer’s behalf, and the sending of an invitation is processing carried out by Dynomatik as processor for the purposes of clause 6.1. Dynomatik shall:

4.4.1 send each invitation in the name of, and identifying, the Customer, and state the Organisation to which the individual is being invited;

4.4.2 confine each invitation to information necessary to explain the invitation and how to accept or decline it, and not use an invitation to promote Dynomatik or any other product or service of Dynomatik;

4.4.3 send no more than one invitation and one reminder to any individual in respect of any Organisation, and send no further invitation to an individual who declines it or objects to receiving further invitations; and

4.4.4 provide in each invitation a clear, prominent and cost-free means of declining and of objecting to further invitations.

4.5 Customer warranties. The Customer represents and warrants that it has a lawful basis for disclosing to Dynomatik the contact details of each individual it invites, that the transparency information it provides to those individuals under Articles 13 and 14 covers the invitation, and that its instruction under clause 4.4 complies with all applicable law governing unsolicited electronic communications and direct marketing in each jurisdiction in which those individuals are located. Where an invitee is not a worker, officer or contractor of the Customer and is invited using a personal rather than a business contact detail, the Customer further warrants that it has obtained from that individual all consents required for that contact detail to be used for that purpose. These warranties are given in respect of all individuals invited by the Customer, and Dynomatik is entitled to rely on them without seeking confirmation in respect of any individual.

4.6 Acceptance. An individual accepts an invitation by creating a Member Account, or by using an existing Member Account. Acceptance creates an Organisation Membership. An Organisation Membership is a link between a Member Account and an Organisation; it does not transfer the Member Account, or any Member Data, to the Customer.

4.7 Dynomatik’s legitimate interests. The parties acknowledge that Dynomatik has a legitimate interest in processing Member Data as an independent controller for the purposes of operating, providing, securing, supporting and improving the account, profile, Connection and related functionality made available to Members, and that Members derive a benefit from that functionality which continues independently of any Organisation Membership. Dynomatik is responsible for identifying and documenting its lawful basis for that processing, for carrying out any assessment required by Applicable Data Protection Law, and for providing Members with the information required by Article 13.

4.8 Multiple Organisations. A Member may hold Organisation Memberships in more than one Organisation at the same time or successively. Each Customer is controller only in respect of its own Organisation. Dynomatik shall not disclose to a Customer the existence of a Member’s Organisation Membership of any other Organisation, or any Organisation Content of any other Organisation, and shall maintain logical separation between Organisations.

4.9 Independence of the Member Account. The termination or removal of an Organisation Membership does not terminate the Member Account and does not require the deletion of Member Data. A Member Account may be closed by the Member, or by Dynomatik in accordance with the Member Terms, and the rights of a Member in respect of Member Data are exercisable by that Member against Dynomatik.

4.10 The Vault. A Member may store Vault Data in the Vault. Use of the Vault is optional and is not a condition of holding a Member Account. Dynomatik processes Vault Data as an independent controller, as part of Member Data, under the Member Terms and the Privacy Notice.

4.11 Vault Shares. Dynomatik discloses Vault Data to an Organisation only where the Member has given a Vault Share for that Organisation, separately from accepting the Member Terms. A Vault Share is given for one Organisation and for the Vault Data specified in it, and gives no other Organisation access. A Member may withdraw a Vault Share at any time, and on withdrawal Dynomatik shall stop making the Vault Data available to that Organisation.

4.12 Dietary Data. Dynomatik processes Dietary Data held in the Vault only with the Member’s explicit consent under Article 9(2)(a) of the UK GDPR. That consent is requested in the Service when the Member adds Dietary Data, separately from acceptance of the Member Terms and from any Vault Share, is recorded by Dynomatik, and may be withdrawn by the Member at any time as easily as it was given, whereupon Dynomatik shall delete the Dietary Data from the Vault. Dynomatik uses Dietary Data held in the Vault only to store it for the Member and to disclose it under a Vault Share, and not for marketing, product analytics, product improvement or the training of any model.

4.13 Copy held in an Organisation. Vault Data disclosed to an Organisation under a Vault Share is a copy. The copy is Organisation Content and Customer Personal Data, the Customer is controller of it, and Dynomatik processes it as processor under clauses 6 to 10. The Member’s Vault Data remains Member Data. Disclosure under a Vault Share is made at the Member’s direction and is not a transfer of Personal Data between categories for the purposes of clause 3.4.

4.14 Customer’s obligations. The Customer is controller of Vault Data from the point of its disclosure to the Customer’s Organisation. It shall have its own lawful basis for processing that Vault Data and, in the case of Dietary Data, its own condition under Article 9 of the UK GDPR, and shall process it only for the purpose stated in the Vault Share. Where a Vault Share includes Dietary Data, the Member’s approval is given as explicit consent to the Customer’s processing of that Dietary Data for the purpose stated in the approval, and the Customer shall not rely on it for any other purpose. The Customer shall comply with clause 6.8 of the Terms of Service in respect of Vault Data where the Terms of Service are the Agreement.

4.15 Withdrawal. Where a Member withdraws a Vault Share, or withdraws consent to the processing of Dietary Data, Dynomatik shall notify the Customer through the Service. The Customer shall then cease processing the Vault Data concerned and delete its copy, unless it has and can demonstrate its own lawful basis (and, in the case of Dietary Data, its own condition under Article 9 of the UK GDPR) for continuing to hold it.

4.16 Verification and security. Dynomatik does not verify the authenticity, validity, currency or accuracy of Vault Data. Dynomatik protects Vault Data by the measures set out in Annex 2.

5. Organisation Guests and the Organisation CRM Tool

5.1 Roles. Guest Data is Customer Personal Data. The Customer is the controller of Guest Data and determines the purposes and means of its processing, including which individuals are included in its Organisation as Organisation Guests and what communications are sent to them. Dynomatik processes Guest Data solely as processor on the Customer’s behalf.

5.2 Permitted purposes. Dynomatik shall process Guest Data only for the following purposes, and for no other purpose:

5.2.1 providing, maintaining, securing and supporting the Service;

5.2.2 enabling the Customer to record, organise, update and manage Guest Data within its Organisation;

5.2.3 generating, issuing and validating e-tickets, and verifying and authenticating the identity of an Organisation Guest for the purposes of access, accreditation and admission; and

5.2.4 transmitting communications composed and addressed by the Customer using the Organisation CRM Tool.

5.3 No use for Dynomatik’s own purposes. Dynomatik shall not use Guest Data for its own purposes, shall not use it to create, populate or enrich any Member Account, shall not treat it as Member Data, and shall not use it to market Dynomatik’s own products or services or those of any third party.

5.4 The Customer is the sender. Dynomatik does not select the recipients of, determine the content of, or decide whether or when to send, any communication sent using the Organisation CRM Tool. Those decisions are the Customer’s alone. The Customer is the sender of, and is responsible for, every such communication.

5.5 Types of communication. The Organisation CRM Tool may be used to send both (a) communications which constitute direct marketing, and (b) transactional and service communications relating to an event or to an Organisation Guest’s attendance at it, including e-tickets, accreditation, joining instructions, itinerary and travel details, and changes to any of them. Clause 5.6 applies only to communications falling within paragraph (a). The Customer is responsible for determining into which category a communication falls, and shall not include marketing content in a communication sent as a transactional or service communication.

5.6 Customer warranties: direct marketing. In respect of every communication sent using the Organisation CRM Tool which constitutes direct marketing, the Customer represents and warrants that:

5.6.1 it has a valid lawful basis under Applicable Data Protection Law for holding the Guest Data and for sending the communication;

5.6.2 it has obtained the consent of each recipient, or the recipient is a corporate subscriber, or the Customer is otherwise entitled to rely on an exemption, in each case as required by the Privacy and Electronic Communications (EC Directive) Regulations 2003 and by any equivalent law applicable in the jurisdiction in which the recipient is located. The Customer acknowledges that the exemption commonly known as the soft opt-in is not available in respect of an Organisation Guest whose contact details were not obtained in the course of a sale or negotiations for a sale;

5.6.3 it has provided each recipient with the transparency information required by Articles 13 and 14, including notice that the Customer may send it marketing communications;

5.6.4 the Guest Data has not been purchased, rented, scraped or harvested, and where any Guest Data was provided to the Customer by a sponsor, partner or other third party, that third party was entitled to provide it for that purpose and the Customer has provided the individual with the information required by Article 14 of the UK GDPR;

5.6.5 it has honoured, and will continue to honour, every objection, opt-out and withdrawal of consent it has received, whether received through the Service or otherwise; and

5.6.6 the content of the communication complies with all applicable law, including law governing direct marketing, advertising and unsolicited communications.

5.7 Message requirements. The Customer shall ensure that every communication sent using the Organisation CRM Tool identifies the Customer as the sender, does not disguise or conceal the identity of the sender, and contains a clear, prominent and cost-free means of opting out of further communications. Dynomatik may decline to transmit, or may modify to include the required elements, any communication which does not comply with this clause.

5.8 Suppression. Dynomatik shall record opt-outs received through the Service and shall suppress further communications to the individuals concerned. The Customer shall not circumvent, disable or override any suppression record, and shall not re-add an individual who has opted out unless that individual has subsequently given a fresh consent.

5.9 Suspension. Dynomatik may suspend the Customer’s access to the Organisation CRM Tool, in whole or in part and with immediate effect, where it reasonably believes that use of it breaches this clause 5 or Applicable Data Protection Law, where complaint or bounce rates indicate that recipients have not consented, or where required by a Supervisory Authority. Dynomatik shall notify the Customer as soon as reasonably practicable and shall restore access once the position is remedied. Suspension under this clause does not give rise to any liability on the part of Dynomatik.

5.10 Guests who become Members. Where an Organisation Guest creates a Member Account, that Member Account and the Member Data relating to it are governed by clause 4 and are not Guest Data. The individual’s Guest Data remains Customer Personal Data and continues to be governed by this clause 5.

6. Dynomatik’s obligations as processor

Clauses 6 to 10 apply to Customer Personal Data only, including Guest Data. They do not apply to Member Data or Service Data.

6.1 Documented instructions. Dynomatik shall process Customer Personal Data only on the Customer’s documented instructions, including as regards transfers to a third country, unless required to do otherwise by law to which Dynomatik is subject. The Agreement, together with clause 5, the Customer’s use of the Service and any configuration made by it, constitutes the Customer’s documented instructions. Where Dynomatik is required by law to process otherwise than on those instructions, it shall inform the Customer before processing unless that law prohibits it from doing so.

6.2 Unlawful instructions. Dynomatik shall inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend performance of that instruction pending its resolution.

6.3 Confidentiality. Dynomatik shall ensure that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidence, and shall limit access to those personnel who require it for the performance of the Agreement.

6.4 Security. Dynomatik shall implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, having regard to Article 32 of the UK GDPR, the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. The measures in force as at the date of this DPA are set out in Annex 2.

6.5 Assistance with data subject rights. Taking into account the nature of the processing, Dynomatik shall assist the Customer by appropriate technical and organisational measures, insofar as reasonably possible, in fulfilling the Customer’s obligations to respond to requests by data subjects exercising their rights under Applicable Data Protection Law. Dynomatik shall notify the Customer without undue delay if it receives such a request relating to Customer Personal Data, and shall not respond to it other than to direct the data subject to the Customer, unless required by law.

6.6 Assistance with compliance. Dynomatik shall provide the Customer with reasonable assistance in relation to the Customer’s obligations under Articles 32 to 36 of the UK GDPR, taking into account the nature of the processing and the information available to Dynomatik.

6.7 Information and audit. Dynomatik shall make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. The Customer may, on not less than thirty (30) days’ written notice and not more than once in any twelve (12) month period, audit Dynomatik’s compliance, provided that the audit takes place during business hours, does not unreasonably disrupt Dynomatik’s operations, does not require disclosure of information relating to any other customer, and is carried out at the Customer’s cost. Dynomatik may satisfy this obligation by providing a current third party audit report or security certification. The Customer may audit more frequently where required to do so by a Supervisory Authority or following a Personal Data Breach affecting Customer Personal Data.

6.8 Deletion and return. On expiry or termination of the Agreement, Dynomatik shall, at the Customer’s election, delete or return all Customer Personal Data and delete existing copies, save to the extent that retention is required by law. This includes the Organisation, all Organisation Content and all Organisation Membership records. Data held in routine backup media shall be deleted in accordance with Dynomatik’s ordinary backup cycle and shall remain subject to clause 6.4 until deleted.

6.9 What is not deleted. Clause 6.8 applies to Customer Personal Data only. It does not apply to:

6.9.1 Member Accounts or Member Data, which Dynomatik processes as an independent controller under the Member Terms and the Privacy Notice, and which are retained subject to the rights of the Member concerned;

6.9.2 Connections, which subsist between two Members, were established with the agreement of both of them, and are Member Data in respect of each of them, and which accordingly survive the deletion of any Organisation; or

6.9.3 Service Data.

6.10 For the avoidance of doubt, the record of a Member’s Organisation Membership, that Member’s role and permissions within the Organisation, and all Organisation Content, are deleted in accordance with clause 6.8. A Connection is not deleted by reason only that it was first established while both Members held Organisation Memberships of the same Organisation.

7. Sub-processors

7.1 General authorisation. The Customer gives Dynomatik general written authorisation to engage Sub-processors. The Sub-processors engaged as at the date of this DPA are listed at raceprox.com.

7.2 Changes. Dynomatik shall give the Customer not less than thirty (30) days’ notice of the intended addition or replacement of a Sub-processor. The Customer may object on reasonable grounds relating to data protection within that period, in which case the parties shall discuss the objection in good faith. If the objection cannot be resolved, the Customer may terminate the Agreement in respect of the affected part of the Service on written notice, and Dynomatik shall refund a pro rata proportion of any Fees prepaid in respect of the period after termination.

7.3 Flow-down. Dynomatik shall impose on each Sub-processor, by written contract, data protection obligations no less protective than those set out in this DPA, and shall remain fully liable to the Customer for the performance of each Sub-processor’s obligations.

8. Personal Data Breach

8.1 Dynomatik shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

8.2 The notification shall describe, to the extent then known and insofar as reasonably possible: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point from whom further information may be obtained. Dynomatik may provide this information in phases as it becomes available.

8.3 Dynomatik shall provide the Customer with reasonable co-operation and assistance to enable the Customer to meet its own obligations to a Supervisory Authority or to data subjects, and shall not make any public statement identifying the Customer in connection with a Personal Data Breach without the Customer’s prior written consent, unless required by law.

8.4 Notification of a Personal Data Breach is not, and shall not be construed as, an acknowledgement by Dynomatik of fault or liability.

9. International transfers

9.1 Dynomatik shall not make a Restricted Transfer of Customer Personal Data unless an appropriate transfer mechanism is in place, including adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, together with any transfer risk assessment required by Applicable Data Protection Law.

9.2 Where the EU Standard Contractual Clauses apply, they are incorporated into this DPA, with the Customer as data exporter and Dynomatik as data importer, Module Two (controller to processor) applying, the optional docking clause not applying, and the governing law and forum being those stated in the Agreement to the extent permitted.

9.3 The Customer authorises Dynomatik to enter into transfer mechanisms with Sub-processors on the Customer’s behalf where required to give effect to clause 9.1.

10. Customer obligations

10.1 The Customer warrants that it has a valid lawful basis for the processing of Customer Personal Data, that it has provided data subjects with the transparency information required by Articles 13 and 14 of the UK GDPR, and that its instructions to Dynomatik comply with Applicable Data Protection Law.

10.2 The Customer is responsible for the accuracy, quality and legality of Customer Personal Data and for the means by which it acquired it.

10.3 Special category data. Except for Dietary Data processed in accordance with Annex 3, the Service is not designed or intended for, and Dynomatik does not process, special category personal data within the meaning of Article 9 of the UK GDPR or personal data relating to criminal convictions and offences. The Customer shall not submit any such data (other than Dietary Data submitted in accordance with Annex 3) to the Service, whether in respect of an Organisation Guest or otherwise, without Dynomatik’s prior written agreement and the implementation of any additional measures agreed between the parties.

10.4 Dynomatik is under no obligation to monitor, review, screen or filter Customer Personal Data in order to identify data submitted in breach of clause 10.3. Where the Customer submits such data in breach of that clause it does so as controller and at its own risk, Dynomatik shall have no liability arising out of or in connection with it, and Dynomatik may delete it on becoming aware of it, having first notified the Customer where reasonably practicable.

10.5 Where the Customer permits or requires individuals under the age of eighteen to use the Service, it shall be responsible for obtaining any consent or authorisation required by Applicable Data Protection Law and for any age assurance measures required in respect of them.

11. Liability

11.1 Dynomatik’s total aggregate liability arising out of or in connection with this DPA and with Applicable Data Protection Law is limited as set out in clause 16 (Limitation of liability) of the Terms of Service, or the equivalent provisions of the Master Services Agreement where that is the Agreement. The data protection limit in clause 16.3.1 of the Terms of Service forms part of, and is not additional to, the overall limit in clause 16.3.

11.2 This clause does not limit or exclude the liability of either party to a data subject or to a Supervisory Authority, or any liability which cannot lawfully be limited or excluded.

11.3 Nothing in this DPA limits or excludes the liability of the Customer.

12. Term

12.1 This DPA takes effect on the commencement of the Agreement and continues until Dynomatik has ceased all processing of Customer Personal Data.

12.2 Clauses 3, 4.9, 5.3, 6.8, 6.9, 6.10, 8, 11 and this clause 12 survive expiry or termination of the Agreement.

12.3 This DPA is governed by, and construed in accordance with, the law of England and Wales, and is subject to the jurisdiction provisions of the Agreement.

ANNEX 1 — DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATA

ANNEX 2 — TECHNICAL AND ORGANISATIONAL MEASURES

Dynomatik maintains the following measures. Dynomatik may update them provided the level of protection is not materially reduced.

1. Access control. Role-based access control, individual named accounts, multi-factor authentication for administrative access, and access granted on a least-privilege basis and reviewed periodically.

2. Encryption. Personal Data encrypted in transit using current industry standard protocols, and encrypted at rest.

3. Segregation. Logical separation of each Organisation from every other Organisation, and logical separation of Customer Personal Data from Member Data and Service Data.

4. Resilience. Regular backups, documented restoration procedures, and periodic testing of restoration.

5. Monitoring and logging. Audit logging of access to and changes affecting Personal Data, and monitoring for unauthorised access.

6. Personnel. Confidentiality undertakings for all personnel with access to Personal Data, and data protection awareness training.

7. Vulnerability management. Application of security patches, and periodic vulnerability assessment of the Service.

8. Incident response. A documented Personal Data Breach response procedure, including assessment, containment, notification and remediation.

9. Sub-processor assurance. Assessment of the technical and organisational measures of each Sub-processor before engagement.

10. Deletion. Documented procedures for the secure deletion of Personal Data on expiry of the applicable retention period or on termination.

11. Dietary Data. Dietary Data is held in dedicated fields which are visible only to the Users and roles the Customer authorises, access to it is logged, the Customer is able to delete it through the Service, and it is excluded from analytics events.

ANNEX 3 — DIETARY DATA

1. Application. This Annex applies to all Dietary Data submitted to a Customer’s Organisation by or on behalf of the Customer, and forms part of the Customer’s documented instructions under clause 6.1. Clause 10.3 continues to apply without exception to all other special category data.

2. Permitted Dietary Data. The Customer may submit Dietary Data about Organisation Guests and Users through the fields the Service provides for it, for the purpose of arranging catering, accessibility and welfare at its events. Dynomatik processes it as processor under clauses 6 to 10. The content of those fields, including any health information a data subject chooses to include, is not a breach of clause 10.3, but no other special category data and no data relating to criminal convictions and offences may be submitted.

3. Customer’s lawful basis. The Customer warrants that, for all Dietary Data it submits, it has a lawful basis under Article 6 and a condition under Article 9 of the UK GDPR; that where it relies on explicit consent it has obtained and recorded that consent from each data subject before the Dietary Data is submitted; and that it has provided the information required by Articles 13 and 14. Where the Customer relies on a condition which requires an appropriate policy document or other safeguards under the Data Protection Act 2018, it warrants that these are in place.

4. Impact assessment. The Customer is responsible for deciding whether a data protection impact assessment is required for its use of Dietary Data and for carrying it out. Dynomatik shall provide reasonable assistance under clause 6.6.

5. Access, withdrawal and deletion. The Customer shall limit access to Dietary Data to Users who need it for the purpose in paragraph 2, using the role permissions available in the Service. The Customer shall honour any withdrawal of consent, delete Dietary Data through the Service when it is no longer needed for that purpose, and not retain it for longer than necessary. Dynomatik shall provide the functionality needed to do so and shall assist under clause 6.5.

6. Dynomatik’s use. Dynomatik shall process Dietary Data only to provide the functionality described in this Annex. It shall not use Dietary Data for its own purposes, for product analytics or for the training of any model, and shall not derive anonymised or aggregated data from it.

7. Sub-processors. Before a Sub-processor processes Dietary Data, Dynomatik shall ensure that the Sub-processor’s terms permit the processing of Dietary Data and that clause 7.3 is satisfied.

8. Personal Data Breach. Where a Personal Data Breach affects Dietary Data, the notification under clause 8.1 shall say so.

9. Individuals under eighteen. Clause 10.5 applies to Dietary Data relating to individuals under the age of eighteen.

10. Suspension. Dynomatik may disable the dietary requirements functionality for an Organisation where it reasonably believes that its use breaches this Annex or Applicable Data Protection Law, and shall notify the Customer as soon as reasonably practicable.