Data Processing Addendum
Version 1.0 · Effective 31 August 2026 · Incorporated into the Terms of Service · Previous versions
This DPA is incorporated into the Terms of Service by clause 9.1 and applies automatically to every organiser. A countersignable PDF is available on request from dpo@yourtessera.com.
1. This addendum and how it applies
This Data Processing Addendum ("DPA") forms part of the agreement between Tessera Pte. Ltd. (UEN 202344374N), 68 Circular Road, #02-01, Singapore 049422 ("Tessera") and the customer identified in that agreement ("Customer", "you") for use of the Tessera platform (the "Agreement").
This DPA applies whenever Tessera processes Personal Data on the Customer's behalf in connection with the Services. Where this DPA conflicts with the Agreement, this DPA prevails on data protection matters.
By entering into the Agreement or continuing to use the Services, the Customer agrees to this DPA. A countersigned copy is available on request from dpo@yourtessera.com.
2. Definitions
"Data Protection Laws" means all laws applicable to the processing under this DPA, including the PDPA, the GDPR, the UK GDPR, the ePrivacy Directive as implemented, and the PDPO.
"PDPA" means the Personal Data Protection Act 2012 of Singapore.
"GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as incorporated into UK law by the Data Protection Act 2018 and the European Union (Withdrawal) Act 2018.
"PDPO" means the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.
"Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Personal Data Breach" have the meanings given in the GDPR. "Data Intermediary" and "Individual" have the meanings given in the PDPA. Where this DPA refers to a Controller, it includes an organisation acting as a data intermediary's principal under the PDPA; where it refers to a Processor, it includes a Data Intermediary.
"Customer Personal Data" means Personal Data that Tessera processes on the Customer's behalf under the Agreement.
"Sub-processor" means a third party engaged by Tessera to process Customer Personal Data.
"SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.
"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).
"Services" has the meaning given in the Agreement.
3. Roles of the parties
3.1 In respect of Customer Personal Data, the Customer is the Controller (and a data intermediary's principal under the PDPA) and Tessera is the Processor (and a Data Intermediary under the PDPA).
3.2 The Customer is responsible for determining what Personal Data it collects through the Services, the questions it asks Data Subjects, the lawful basis for its processing, and the notices it provides.
3.3 Tessera acts as an independent Controller in respect of the purposes set out in section 3.2 of the Tessera Privacy Policy — including account administration, payment and financial records, fraud prevention and platform security, platform analytics and product development, aggregate benchmarking, Tessera's own marketing, and legal compliance. This DPA does not apply to that processing, which is governed by the Tessera Privacy Policy.
3.4 Joint controllership for Customer-configured tracking technologies. Where the Customer configures a third-party advertising or analytics pixel on a Tessera-hosted event or checkout page, the parties act as joint controllers under Article 26 GDPR in respect of the collection of Personal Data by that pixel and its transmission to the third party. The essential arrangement is set out at Annex 4, and its essence is made available to Data Subjects in the Tessera Cookies Policy.
3.5 Each party will comply with its own obligations under Data Protection Laws. Neither party will cause the other to breach those laws.
4. Processing instructions
4.1 Tessera will process Customer Personal Data only:
(a) on the Customer's documented instructions, which are constituted by the Agreement, this DPA, the Customer's configuration and use of the Services, and any further written instruction the Customer gives;
(b) as required by law applicable to Tessera, in which case Tessera will inform the Customer of that requirement before processing unless the law prohibits it on important grounds of public interest.
4.2 Tessera will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws. Tessera may suspend the affected processing until the instruction is amended or confirmed.
4.3 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subject are set out at Annex 1.
5. Confidentiality
Tessera will ensure that every person authorised to process Customer Personal Data is bound by an appropriate obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement. Tessera limits access to Customer Personal Data to personnel who need it to deliver the Services.
6. Security
6.1 Tessera will implement and maintain the technical and organisational measures set out at Annex 2, being appropriate to the risk in accordance with Article 32 GDPR and the PDPA's Protection Obligation.
6.2 Tessera may update those measures provided the level of protection is not materially reduced. The current measures are always published at /security.
6.3 Tessera does not receive, store, process or transmit full payment card numbers or authentication data. Card data is captured directly by Stripe, a PCI DSS Level 1 certified Service Provider.
7. Sub-processors
7.1 General authorisation. The Customer gives Tessera general written authorisation to engage Sub-processors, subject to this clause 7.
7.2 Current list. Tessera's Sub-processors as at the effective date are listed at Annex 3 and maintained current at /sub-processors.
7.3 Notice of changes. Tessera will give the Customer at least 30 days' notice before adding or replacing a Sub-processor, by email to the Customer's nominated contact and by updating the published list. The Customer may subscribe to notifications at that page.
7.4 Right to object. The Customer may object to a new Sub-processor on reasonable data protection grounds within 30 days of notice. The parties will discuss in good faith. If Tessera cannot provide a commercially reasonable alternative, the Customer may terminate the affected Services without penalty and receive a pro-rata refund of prepaid fees.
7.5 Flow-down and liability. Tessera will impose on each Sub-processor data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for each Sub-processor's performance.
8. International transfers
8.1 The Customer authorises Tessera to transfer Customer Personal Data outside the country of origin, including to Singapore, as necessary to provide the Services.
8.2 EEA transfers. Where Tessera transfers Customer Personal Data from the EEA to a country without an adequacy decision, the SCCs apply and are incorporated by reference:
- Module Two (Controller to Processor) where the Customer is a Controller;
- Module Three (Processor to Sub-processor) where the Customer is itself a Processor.
The parties agree: docking clause (17) applies; the governing law under clause 17 is the law of Ireland; the forum under clause 18(b) is the courts of Ireland; the audit frequency in clause 8.9 is as set out in clause 11 below; Annex I, II and III of the SCCs are populated by Annexes 1, 2 and 3 of this DPA.
8.3 UK transfers. The UK Addendum applies to transfers subject to the UK GDPR. Tables 1 to 3 are populated by this DPA and its Annexes; in Table 4, neither party may end the Addendum as set out in section 19.
8.4 Swiss transfers. For transfers subject to Swiss law, references in the SCCs to the GDPR are read as references to the Swiss Federal Act on Data Protection, the competent authority is the Federal Data Protection and Information Commissioner, and the term "member state" does not prevent Swiss-domiciled Data Subjects from enforcing their rights in Switzerland.
8.5 PDPA transfers. Where the PDPA's Transfer Limitation Obligation applies, Tessera ensures that recipients outside Singapore are bound by legally enforceable obligations providing a standard of protection comparable to the PDPA.
8.6 Transfer impact assessments. Tessera has carried out and documents transfer impact assessments for its transfers, and will provide a summary on request.
8.7 Government access requests. If Tessera receives a legally binding request from a public authority for Customer Personal Data, it will notify the Customer before disclosure unless legally prohibited; challenge the request where there are reasonable grounds; and disclose only the minimum permissible. Tessera will publish aggregate statistics of such requests where lawful.
9. Assisting the Customer with Data Subject requests
9.1 Taking into account the nature of the processing, Tessera will assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests to exercise Data Subject rights.
9.2 The Services provide self-service functionality allowing the Customer to access, export, correct and delete Customer Personal Data. Where the Customer can act through the Services, that is the primary route.
9.3 If Tessera receives a request directly from a Data Subject relating to Customer Personal Data, Tessera will not respond substantively except to acknowledge and redirect, and will notify the Customer within 5 business days.
10. Personal Data Breaches
10.1 Tessera will notify the Customer without undue delay and in any event within 24 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data.
10.2 The notification will describe, to the extent known: the nature of the breach; the categories and approximate number of Data Subjects and records affected; the likely consequences; the measures taken or proposed; and the contact point for further information. Where information is not available at the time, Tessera will provide it in phases without further undue delay.
10.3 Tessera will assist the Customer in meeting its own notification obligations to supervisory authorities, the PDPC and Data Subjects, and will not notify any third party of a breach affecting Customer Personal Data on the Customer's behalf without the Customer's instruction, except where Tessera is independently required to do so by law.
10.4 Tessera maintains a documented incident response plan covering detection, triage, containment, notification and post-incident review, and tests it at least annually.
11. Audit and information rights
11.1 Information rights. Tessera will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA, including the technical and organisational measures at Annex 2, the sub-processor register, and any current third-party audit report, certification or penetration test summary Tessera holds.
11.2 Documentation first. Where Tessera holds a current third-party audit report or certification covering the relevant controls, providing that report — together with the information in clause 11.1 and a written response to the Customer's reasonable follow-up questions — satisfies the Customer's audit right, unless the Customer has reasonable grounds, stated in writing, to require more.
11.3 On-site and remote audits. Where clause 11.2 is not satisfied, the Customer may audit Tessera's compliance with this DPA no more than once in any 12-month period, and additionally following a Personal Data Breach affecting Customer Personal Data. Any such audit will be:
(a) on at least 30 days' written notice;
(b) during business hours, and conducted so as not to unreasonably disrupt Tessera's operations;
(c) limited in scope to Tessera's processing of that Customer's Personal Data and the controls relevant to it;
(d) subject to the confidentiality obligations in the Agreement, and to Tessera's reasonable security and access requirements at any premises or system;
(e) conducted by the Customer or by an independent auditor appointed by the Customer, provided that auditor is not a competitor of Tessera and is bound by equivalent confidentiality obligations.
11.4 Costs. The Customer bears its own costs and those of any auditor it appoints. Tessera bears its own costs for one audit in any 12-month period, and may charge its reasonable costs for any further audit and for a post-breach audit where the breach was not caused by Tessera.
11.5 Findings. The Customer will share audit findings with Tessera. Tessera will remediate any confirmed material non-compliance within a reasonable period agreed between the parties.
11.6 Regulators. Nothing in this clause limits the rights of a competent supervisory authority.
12. Assistance with DPIAs and prior consultation
Taking into account the nature of the processing and the information available to it, Tessera will provide reasonable assistance to the Customer with data protection impact assessments and prior consultation with supervisory authorities under Articles 35 and 36 GDPR.
Tessera will make available documentation to support the Customer's assessment of the tracking technology features described in clause 3.4, which the Customer acknowledges may require a DPIA.
13. Liability
13.1 Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Agreement.
13.2 Liability arising under this DPA counts towards, and does not exceed, the aggregate liability cap in the Agreement. There is a single aggregate cap across the Agreement and this DPA, not a separate cap for each.
13.3 Clause 13.2 does not apply to, and the cap does not limit:
(a) either party's liability to a Data Subject under clause 12 of the SCCs, which cannot be limited by contract;
(b) any fine, penalty or compensation order imposed on one party by a supervisory authority or court to the extent it results directly from the other party's breach of this DPA;
(c) either party's liability for fraud, fraudulent misrepresentation, or wilful misconduct;
(d) any liability that cannot be limited or excluded under applicable law.
13.4 Where both parties have contributed to a liability under this DPA, each bears it in proportion to its responsibility.
13.5 Nothing in this DPA limits liability that cannot be limited under applicable law.
14. Deletion and return
14.1 On termination or expiry of the Agreement, Tessera will, at the Customer's election, delete or return all Customer Personal Data.
14.2 The Customer may export its data through the Services for 30 days after termination. After that period Tessera will delete Customer Personal Data within 60 days, and from backups within a further 90 days in the ordinary course of backup rotation.
14.3 Tessera may retain Customer Personal Data where required by law, including transaction records retained for statutory accounting and tax purposes, and will continue to protect it under this DPA for as long as it is retained.
14.4 Tessera will certify deletion in writing on request.
15. Term
This DPA takes effect on the effective date of the Agreement and continues until Tessera has ceased all processing of Customer Personal Data. Clauses 5, 8, 13 and 14 survive termination.
16. General
16.1 Amendments. Tessera may amend this DPA where necessary to comply with Data Protection Laws or to reflect a change in the Services, on 30 days' notice, provided the amendment does not materially reduce the protections available to the Customer.
16.2 Governing law. This DPA is governed by the law stated in the Agreement, save that the SCCs are governed as set out in clause 8.2.
16.3 Contact. dpo@yourtessera.com
Annex 1 — Details of processing
(This annex populates Annex I of the SCCs.)
Data exporter: the Customer, as identified in the Agreement. Role: Controller (or Processor, where Module Three applies). Data importer: Tessera Pte. Ltd. Role: Processor.
Subject matter of the processing Provision of the Tessera event ticketing and management platform.
Duration The term of the Agreement, plus the retention periods in clause 14.
Nature and purpose of the processing Collecting, recording, organising, storing, retrieving, using, transmitting and erasing Personal Data as necessary to: list and publish events; sell, issue, transfer and validate tickets; process payments, refunds and payouts; manage guest lists and RSVPs; operate check-in; provide reporting and analytics to the Customer; deliver transactional communications; and provide support.
Categories of Data Subject
- Attendees and ticket holders
- Guest list invitees and RSVP recipients
- The Customer's staff, collaborators and authorised users
- Individuals who contact the Customer through the Services
Categories of Personal Data
- Identity and contact: name, email address, phone number
- Ticket and order data: ticket type, order reference, purchase history, transfers, check-in status
- Payment metadata: card brand, last four digits, billing country, transaction outcome (no full card numbers or authentication data)
- Registration responses: answers to questions configured by the Customer
- Guest list and RSVP data
- Technical and usage data: IP address, device and browser information, timestamps, pages viewed
- Communications with the Customer through the Services
Special categories of data None. The Customer must not collect special category data through the Services without Tessera's prior written agreement and appropriate additional safeguards.
Frequency of transfer Continuous, for the duration of the Agreement.
Competent supervisory authority (SCCs Annex I.C) The supervisory authority of the EU member state in which the Customer is established or, where the Customer is not established in the EU, in which its Article 27 representative is appointed.
Annex 2 — Technical and organisational measures
The technical and organisational measures required by clause 6.1 are published and maintained at Security Overview, which forms Annex 2 of this DPA and populates Annex II of the SCCs.
Annex 3 — Sub-processors
The list of sub-processors authorised under clause 7 is published and maintained at Sub-processors, which forms Annex 3 of this DPA and populates Annex III of the SCCs.
Annex 4 — Joint controller arrangement for Customer-configured tracking technologies
(Article 26 GDPR. The essence of this arrangement is made available to Data Subjects in the Tessera Cookies Policy.)
Scope. This annex applies where the Customer configures a third-party advertising or analytics pixel, tag or SDK on a Tessera-hosted event or checkout page.
Joint determination. The parties jointly determine the purposes and means of the collection of Personal Data by that technology and its transmission to the third-party provider. The parties are joint controllers for that operation only. Each party is a separate and independent controller for what it does with the data thereafter.
Allocation of responsibilities
| Responsibility | Party |
|---|---|
| Obtaining and recording valid consent before the technology loads | Tessera |
| Providing the layered privacy and cookie notice to Data Subjects | Tessera |
| Ensuring the technology is only loaded where consent is present, and ceasing on withdrawal | Tessera |
| Determining a lawful basis for the Customer's own advertising purposes | Customer |
| Providing the Customer's own privacy notice covering its advertising | Customer |
| Contractual relationship with, and instructions to, the third-party provider | Customer |
| Any onward transfer or combination of the data by the Customer | Customer |
| First point of contact for Data Subject requests | Tessera (will handle or route, and inform the Data Subject) |
| Responding to requests relating to the Customer's own downstream processing | Customer, with Tessera's reasonable assistance |
| Notifying the other party of a breach affecting the jointly controlled operation | Both, without undue delay and within 24 hours |
Data Subject rights. Irrespective of this allocation, a Data Subject may exercise their rights against either party. Each party will inform the other within 5 business days of a request it receives.
Point of contact. Tessera: dpo@yourtessera.com. Customer: the data protection contact nominated in the Agreement.