Effective date: August 21, 2025 • Last updated: August 21, 2025
This DPA forms part of the Terms of Use (or other written agreement) between WeVite Inc. ("WeVite", "Processor") and the customer entity identified in the Agreement ("Customer", "Controller").
This DPA governs WeVite's Processing of Personal Data on behalf of Customer in connection with the Services. Capitalized terms not defined here have the meanings in the Agreement.
Applicable Data Protection Laws means all data protection and privacy laws that apply to the Processing, including the GDPR, UK GDPR, Swiss FADP, and U.S. state privacy laws (e.g., California CPRA).
Personal Data, Processing, Controller, Processor, Sub-processor have the meanings in the GDPR.
Services means the SaaS ticketing, event, and related services provided by WeVite pursuant to the Agreement.
WeVite shall Process Personal Data only: (a) to provide and improve the Services; (b) on documented instructions from Customer, including those in the Agreement and this DPA; and (c) as required by Applicable Data Protection Laws. If WeVite is required by law to Process Personal Data contrary to Customer's instructions, WeVite will inform Customer (unless prohibited by law).
Customer authorizes WeVite to engage Subprocessors to support the Services (e.g., hosting, payments, analytics, support). WeVite will impose data protection obligations on Subprocessors no less protective than those in this DPA and remains responsible for their performance.
WeVite maintains an updated list at /legal/subprocessors and will provide advance notice of additions. Customer may reasonably object within 30 days; if unresolved, the parties will work in good faith toward a solution.
Where WeVite transfers Personal Data outside the EEA/UK/Switzerland, it shall implement appropriate safeguards such as the European Commission's Standard Contractual Clauses (2021/914/EU, Module 2: Controller→Processor) and any applicable UK/Swiss addenda. The SCCs are incorporated by reference and completed using the details in Annex 1 and Annex 2.
WeVite will promptly inform Customer if it receives a request from a data subject relating to Personal Data we process for Customer. WeVite will not respond except on documented instructions from Customer or where legally required. WeVite will assist Customer, at Customer's cost where applicable, in fulfilling data subject requests.
Upon request, WeVite will make available information necessary to demonstrate compliance with this DPA, including independent third-party audit reports (e.g., SOC 2, ISO 27001) where available. If such materials are insufficient, Customer may conduct an on-site audit no more than annually with 30 days' notice, during normal business hours, subject to confidentiality and reasonable time, scope, and cost limitations.
WeVite maintains security measures appropriate to the risk (see Annex 2). In the event of a Personal Data Breach, WeVite will notify Customer without undue delay (and, where feasible, within 72 hours of becoming aware) and provide information reasonably required for Customer to meet its obligations.
Upon termination or expiry of the Services, WeVite will, upon Customer request, return Personal Data and delete existing copies within 90 days, unless retention is required by law or for the establishment, exercise, or defense of legal claims. Backup media are overwritten on standard cycles.
For the limited Processing of Personal Information subject to U.S. state privacy laws, WeVite acts as a Service Provider/Processor and will: (a) not sell or share Personal Information; (b) not retain, use, or disclose Personal Information for any purpose other than performing the Services or as otherwise permitted by law; (c) not combine Personal Information with other data except as permitted (e.g., for security, debugging, or to improve the Services); and (d) provide assistance to honor consumer rights requests as applicable.
Each party's liability arising from or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, except where prohibited by law. In the event of conflict between this DPA and the Agreement, this DPA controls with respect to Processing of Personal Data.
This DPA remains in force for as long as WeVite processes Personal Data on behalf of Customer under the Agreement and is governed by the same law and venue as the Agreement, unless Applicable Data Protection Laws require otherwise.
WeVite may use the following categories of Subprocessors (current list and updates at /legal/subprocessors):
Note: As of the effective date of this DPA, WeVite does not currently engage any third-party subprocessors. This annex describes the categories of services for which subprocessors may be engaged in the future.
WeVite Inc.
Attn: Privacy & Security
Email: support@wevite.io • Security: security@wevite.io
Subprocessors: /legal/subprocessors • Privacy Policy: /legal/privacy-policy • Terms: /legal/terms-of-use • Cookie Policy: /legal/cookie-policy • Cookie Preferences: /privacy/cookie-preferences • Data Deletion: /legal/data-deletion • Do Not Sell: /privacy/do-not-sell • Sitemap: /sitemap
Execution: This DPA is incorporated by reference into the Agreement. If your procurement requires a countersigned copy, contact support@wevite.io.