Data Processing Addendum

Scope & Roles

This Data Processing Addendum (DPA) supplements your agreement with Akangbou when you (an event organizer, club owner, or professional business) use the Services to process attendee, member, or client personal data for your own purposes. For that data you are the controller (or “business”) and Akangbou processes it on your behalf as a processor (or “service provider”). Akangbou remains an independent controller of account, payment, and platform data it needs to operate the Services, as described in the Privacy Policy.

Data Subject Types

• Event attendees and ticket holders.
• Marketplace perk participants and partner contacts.
• Contractor company administrators, staff, and invited collaborators.

Processing Instructions

• We process personal data only to deliver contracted services: reservations, messaging, analytics, payouts, and support.
• We follow your instructions as provided via dashboard settings, API calls, or documented support requests.
• We will not sell or share personal data, use it for cross-context behavioral advertising, or combine it with other data except as permitted for service providers under the CCPA.

Subprocessors

We rely on vetted subprocessors to operate the platform. Current list:

• Vercel – hosting and CDN.
• Supabase – database, authentication, file storage.
• Stripe – payment processing and payouts.
• Resend – transactional email.
• Sentry – error monitoring and (with consent) masked session replay.
• Upstash – rate limiting and abuse prevention.
• Expo, Apple Push Notification service, Firebase Cloud Messaging – mobile push delivery.

Data Subject Requests

• Submit DSARs to privacy@akangbou.com with the requester’s email, reservation ID, or supporter ID.
• We assist with access, export, correction, and deletion within 30 days (or faster where required).
• You are responsible for verifying the identity of the requester and documenting consent.

Security Measures

See the Security Policy for technical and organizational safeguards. We will notify you without undue delay (no later than 72 hours) after becoming aware of a personal data breach affecting your users.

International Transfers

Data is primarily stored in the United States. When exporting to other regions, we rely on Standard Contractual Clauses (2021/914) or equivalent lawful mechanisms.

Term & Termination

• This DPA remains in effect for as long as we process data on your behalf.
• Upon termination, you may request deletion or export of all data within 30 days.
• We may retain minimal data required for legal, tax, or auditing obligations.