Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") governs the processing of personal data that NOCTION PLATFORM, S.L. ("Scennio", the Processor) carries out on behalf of the contracting Establishment (the Controller) when providing the Scennio platform, pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR). It forms an integral part of the Commercial Terms entered into between the parties.

Controller: the contracting Establishment (restaurant, nightlife venue, event hall or promoter) that determines the purposes and means of processing its customers’ data.

Processor: NOCTION PLATFORM, S.L. (trading as "Scennio"), which processes the data solely on behalf of and following the documented instructions of the Controller.

The Processor will process personal data on behalf of the Controller for the sole purpose of providing the platform services. Processing lasts for the term of the main agreement; upon termination the deletion or return clause applies.

Processing comprises the operations necessary for ticket sales, bookings, lists, orders, access control, payment processing, communication with attendees and the analytics and support functions associated with the platform.

Data subjects: the Controller’s end customers, attendees and users. Data: identification and contact details (name, email, phone), booking/purchase and (tokenised) payment data, and technical usage data. No processing of special categories of data is envisaged.

The Controller determines the purposes and means of the processing and warrants that it has a valid legal basis for the data it makes available to the Processor. The Controller is responsible for informing data subjects and, where applicable, obtaining their consent, for handling rights requests, and for issuing the processing instructions in writing. The Controller warrants that its instructions are lawful and do not infringe data-protection law.

The Processor will process the data only on the Controller’s documented instructions, including as regards international transfers, unless required by law; will not use the data for any other purpose; and will assist the Controller in meeting its obligations.

The Processor will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR, Spanish Organic Law 3/2018 (LOPDGDD) or other Union or Member State data-protection law, and may suspend the execution of that instruction until the Controller confirms or amends it.

The Processor ensures that persons authorised to process the data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

The Processor will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate pseudonymisation and encryption, access control, event logging, backups, the confidentiality, integrity, availability and resilience of systems, and procedures for regularly testing and evaluating their effectiveness.

The Controller grants general authorisation for the engagement of sub-processors (e.g. hosting, payment, communications and analytics providers). The Processor will impose the same data-protection obligations on each sub-processor and will inform the Controller of additions or changes, allowing the Controller to object on reasonable grounds. The Processor remains fully liable to the Controller for the sub-processor’s performance of its data-protection obligations. The up-to-date list of sub-processors is available on request at info@scennio.com. Sub-processors may include providers of artificial intelligence models used by the platform's assistance features (Scennio Copilot), which are subject to the same obligations and, where applicable, the international transfer safeguards provided for in this DPA.

The Processor will assist the Controller, by appropriate technical and organisational measures, in responding to data-subject rights requests and in complying with the obligations of Articles 32 to 36 GDPR (security, breach notification and impact assessments).

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach, providing the information necessary for the Controller to meet its own notification obligations.

The Processor will maintain, in writing and on behalf of the Controller, a record of all categories of processing activities carried out, in accordance with Article 30(2) GDPR, and will make it available to the Controller and to the supervisory authority upon request.

At the Controller’s choice, the Processor will delete or return all personal data after the end of the provision of services, and will delete existing copies unless legally required to retain them. At the Controller’s request, the Processor will certify such deletion in writing.

The Processor will make available to the Controller the information necessary to demonstrate compliance with Article 28 and will allow for and contribute to audits, including inspections, conducted by the Controller or a mandated auditor, with reasonable notice.

Where processing involves transfers outside the EEA, the Processor will ensure appropriate safeguards under Chapter V GDPR (adequacy decisions, including the EU-U.S. Data Privacy Framework, or Standard Contractual Clauses).

Each party is liable for the damage it causes by infringing its obligations under Article 82 GDPR. The Processor is liable only where it has not complied with GDPR obligations specifically directed to processors or has acted outside or contrary to the Controller’s lawful instructions.

This DPA is governed by Spanish law and by the GDPR and forms part of the Commercial Terms between the parties, with the same duration. The competent supervisory authority is the Spanish Data Protection Agency (AEPD). In the event of conflict on data-protection matters, this DPA prevails.

For any question regarding this DPA, you can write to us at info@scennio.com .