This Data Processing Addendum ("DPA") forms part of the Terms of Service between Gather Shot LLC ("Gather Shot") and the business or organization accepting those Terms ("Customer"). It applies upon that acceptance whenever Gather Shot processes personal data on Customer's behalf, without a separate signature. It prevails over conflicting Terms or order-form provisions concerning data protection. Applicable data protection law includes the GDPR and UK GDPR where they apply.
1. Roles and processing details
Customer is the controller, or a processor authorized by its controller to appoint Gather Shot as subprocessor. Gather Shot is the processor or subprocessor for "Customer Personal Data": personal data submitted to, or generated in, business events and associated team administration on Customer's instructions. This DPA does not cover Gather Shot's independent controller processing for its own billing, account relationship, security, or marketing described in the Privacy Policy.
- Subject matter and purpose: hosting and managing Customer's events, collecting guest submissions, providing galleries, moderation, team access, usage accounting, storage, recovery, and download archives.
- Nature of processing: collection, recording, organization, storage, transformation of media, retrieval, authorized disclosure, archive generation, and deletion.
- Data subjects: Customer personnel and team members, hosts, guests, invitees, collaborators, moderators, and people depicted or identified in submissions.
- Data types: names, contact details, guest identifiers, team permissions, photos, videos, captions, event and file metadata, custom-field responses, scavenger-hunt submissions and progress, moderation records, upload usage records, relevant device/access information, and archives.
- Duration: service provision plus the applicable retention and recovery period, until return or deletion under section 8. Processing is ongoing as Customer uses the Service. Customer must not deliberately submit sensitive regulated data prohibited by the Terms; media may nevertheless incidentally reveal sensitive characteristics.
2. Documented instructions and Customer responsibilities
Gather Shot will process Customer Personal Data only on Customer's documented instructions, including for transfers, unless applicable law requires otherwise. The Terms, this DPA, event settings, authorized team actions, and written instructions consistent with the Service are those instructions. If law requires other processing, Gather Shot will inform Customer before processing unless that law prohibits notice on important public-interest grounds. Gather Shot will immediately inform Customer if, in its opinion, an instruction infringes applicable data protection law and may pause that instruction while the parties resolve it.
Customer determines lawful purposes and bases, provides notices, obtains required permissions, controls team authorization, and ensures its instructions are lawful. Where Customer is a processor, it must secure the controller's authorization and pass through relevant instructions. Gather Shot will not use Customer Personal Data for independent advertising or sell or share it for cross-context behavioral advertising. Where applicable service-provider laws apply, Gather Shot will not retain, use, disclose, or combine it outside the permitted business purposes and direct business relationship except as allowed by law, and will notify Customer if it can no longer comply. Customer may take reasonable steps to verify and remediate compliance.
3. Confidentiality and security
Gather Shot will ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations or appropriate statutory duties and have access only as necessary for their responsibilities. Gather Shot will implement and maintain appropriate technical and organizational measures under Article 32, taking account of the state of the art, costs, processing context, and risks to individuals.
These measures shall include access authorization and least-privilege controls, encryption in transit, protection of credentials, safeguards against unauthorized access and abuse, and procedures for maintaining confidentiality, integrity, availability, and resilience; restoring access after incidents; and regularly assessing effectiveness. Measures may evolve without materially reducing protection. This is a contractual security obligation, not a claim of any certification, guaranteed uptime, or particular hosting region. Customer remains responsible for its own access settings and authorized users.
4. Personal data breaches
Gather Shot will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notice will go to Customer's registered contact and will describe, to the extent known, the nature of the breach, affected data and individuals, likely consequences, mitigation measures, and a contact for further information. Information may be supplied in phases without undue further delay. Gather Shot will investigate, contain, and remediate the breach and reasonably assist Customer's notification obligations. Customer decides on notices to individuals and authorities unless law requires Gather Shot to notify directly.
5. Subprocessors
Customer gives general written authorization for subprocessors engaged to deliver the Service, subject to this section. Relevant provider functions include Cloudflare R2 storage, DigitalOcean legacy storage, Postmark transactional email, and application/database infrastructure. The Privacy Policy provides a recipient overview, not an exhaustive business-data register. Gather Shot will provide the current applicable subprocessor list, including legal entities, functions, and processing locations, on request to [email protected]. Advertising recipients are not authorized by this DPA to process Customer event content for advertising.
Gather Shot will notify Customer by email at least 30 days before adding or replacing a subprocessor processing Customer Personal Data, allowing Customer to object on reasonable data-protection grounds during that period. The parties will work in good faith to resolve an objection, including by using an alternative or avoiding the affected processing. If unresolved, Customer may terminate the affected service before the change takes effect; applicable remedies under the Terms, an order form, or mandatory law remain available. Gather Shot will not implement the disputed processing for Customer while the timely objection remains unresolved.
Gather Shot will impose written data-protection obligations on subprocessors that provide at least the same protection as this DPA for relevant processing, including sufficient security guarantees, and remains fully liable to Customer for performance of those obligations.
6. Assistance and audit rights
Taking account of the nature of processing, Gather Shot will assist Customer through appropriate technical and organizational measures, insofar as possible, with requests to exercise data-subject rights. It will promptly forward requests concerning Customer Personal Data to Customer and not respond substantively except on instructions or as required by law. Taking account of information available to it, Gather Shot will assist Customer with security obligations, breach notifications, data protection impact assessments, and prior consultation with supervisory authorities under Articles 32 to 36.
Gather Shot will make available information necessary to demonstrate compliance with Article 28 and this DPA and allow and contribute to audits, including inspections, by Customer or an independent auditor mandated by Customer. The parties will arrange reasonable notice, confidentiality, scope, and safeguards for other customers' data. Existing documentation may be used first where sufficient, but it does not remove inspection rights. Urgent incidents, regulator requests, or evidence of noncompliance will not be subject to delays that frustrate legal obligations. Reasonable assistance costs may be agreed in advance, but must not prevent legally required assistance or audits.
7. International transfers
Gather Shot will make restricted international transfers of Customer Personal Data only with a valid mechanism required by applicable law. Depending on the transfer, this may be an applicable adequacy decision or separately executed EU Standard Contractual Clauses and a required UK Addendum or International Data Transfer Agreement, with completed particulars and supplementary safeguards where necessary. Gather Shot will provide relevant transfer information and cooperate with required assessments.
Acceptance of this DPA does not execute SCCs or any nonexistent annexes and does not establish a provider's adequacy eligibility. Where a separate transfer instrument is needed, the parties must complete it before the restricted processing or transfer begins. Mandatory provisions of a valid transfer instrument prevail over conflicting contractual provisions.
8. Return, deletion, recovery, and legal holds
At Customer's choice, Gather Shot will return or delete Customer Personal Data after the end of processing services and delete existing copies unless applicable law requires retention. Customer may download eligible content during the term or request return through support; the parties will arrange a secure return method where ordinary downloads are unavailable. Ordinary archive-download eligibility remains subject to the Terms, but does not defeat a legally required return under this DPA.
Unless Customer instructs earlier return or deletion, Customer instructs Gather Shot to apply the Terms' retention and recovery schedule, including Enterprise recovery for one year from the later of event retention expiration or paid subscription expiration. Customer can override that recovery instruction by requesting earlier deletion. Explicit erasure is independent of recovery; a recovery window is not a basis to deny a valid deletion instruction. Gather Shot will remove originals, generated media, and archives through its deletion processes; residual backups will be isolated from ordinary use and deleted on their applicable rotation, not restored for unrelated processing. Gather Shot will provide the applicable deletion schedule and confirmation on request.
Any legally required retention will be limited to the required data and period, protected, and used only for that legal purpose. Gather Shot will inform Customer of such retention unless legally prohibited. This DPA continues to govern retained Customer Personal Data until deleted.
9. Contact and contractual operation
Send instructions, subprocessor-list requests, objections, audit requests, and return or deletion requests to [email protected]. Customer must keep its notice contact current. The Terms govern other matters, subject to this DPA's precedence and rights and liabilities that cannot be excluded by law. An agreed order form may specify processing details but may not reduce legally required data protection.
Gather Shot LLC
502 W 7th ST STE 100 Erie, PA, 16502, USA