Eventspot Transfer Impact Assessment Factsheet

Purpose

Eventspot has completed Transfer Impact Assessments (TIAs) for relevant data transfers, following GDPR requirements and the updated 2021 Standard Contractual Clauses (SCCs) for EU and non-EU transfers. Eventspot's TIAs include legal evaluations from internal and reputable external advisors. Therefore, full TIAs aren't shared publicly. This factsheet provides sufficient information to confirm Eventspot's positive TIA results, supporting customer obligations regarding supplier oversight.

‍

General Information

  • Service Provider: Eventspot LLC
  • Address: Eventspot LLC, 4000 Eagle Point Corporate Drive, Suite 575 PMB 1399, Birmingham, AL 35242, United States
  • Service Overview: Eventspot provides a cloud-based platform for event management, including real-time attendee analytics, engagement, and automation.
  • Privacy Contact: Eventspot Privacy Team (via the Contact Us page)

‍

Scope of Processing

Eventspot processes the following data types and categories as directed by the customer:

  • Processing Purpose: Eventspot's solutions monitor and improve the event experience by collecting and analyzing attendee data.
  • Personal Data Categories: Identifiers, login data, user roles, IP addresses, device usage stats, and other fields such as name and contact information.
  • Special Data Categories: None.
  • Data Subjects: Attendees and end-users of the customer.

Data Transfers

Eventspot hosts customer data with cloud service providers in the United States. Eventspot Support and Operations Teams may access customer data solely for support purposes, following stringent access control measures, including MFA and IP whitelisting. Data access is logged, justified, and time-bound.

‍

Eventspot works with selected sub-processors, each aligned with strict security and compliance standards, to enhance service delivery.

‍

Regulatory Framework

Eventspot LLC is established in the United States. Eventspot evaluated the following laws for data transfer compliance per Clause 14 of the SCCs:

  • United States: Section 702 of the Foreign Intelligence Surveillance Act (FISA), Executive Order 12333, and the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), together with the safeguards introduced by Executive Order 14086 (Enhancing Safeguards for United States Signals Intelligence Activities).

These laws may permit U.S. government authorities to request access to data held by U.S. service providers, which Eventspot addresses through robust technical measures to secure customer data and structured legal procedures to challenge access demands.

‍

Transfer Mechanisms

Eventspot adheres to the EU Commission's adequacy decisions and the updated SCCs for international transfers. Along with legal and operational safeguards, these practices ensure GDPR-aligned protection across all transfer destinations.

‍

Previous Access Requests

To date, Eventspot has not received any data access requests from government authorities.

‍

Government Access Procedure

If Eventspot receives a disclosure request, it follows a strict, independently reviewed protocol to challenge the request or redirect it to the customer, ensuring the utmost protection for customer data.

‍

Supplementary Measures

Eventspot's Information Security Addendum outlines enterprise-grade security practices. These include encryption (AES-256 for data at rest and TLS 1.2 or higher for data in transit), multi-layered access controls, and regular independent security audits. Detailed security reports are available under NDA.

‍

Summary

Eventspot's data practices and protections meet GDPR and SCC requirements. Following Schrems II, Eventspot ensures that all security measures, legal standards, and access protocols apply uniformly to all data transfers, securing customer data globally.