Data processing

This is the processor half of the arrangement. It is part of the platform terms and applies for as long as NightHall processes anything for an organizer. Published here as a draft; a qualified adviser reviews it before it is signed, and what they change is what governs.

The arrangement

The organizer is the controller of their buyers' personal data. NightHall is the processor. Both halves are stated separately on the privacy page, because a single list that mixed them would answer neither question correctly.

What NightHall processes, and why

NightHall processes what a buyer gives while buying, and what the organizer records about them afterwards. It also processes what an organizer or their staff provides about a buyer. Where NightHall processes it as a processor for the organizer: a name, an email address and an optional phone number. It is a delivery address where something ships. It is the order and its lines, the tickets and their admissions, and the messages sent about them.

NightHall processes it to provide the platform, and for nothing else. It does not use it for its own purposes, does not sell it, and does not train anything on it.

Instructions

The organizer's instructions are the platform: what they configure, what they publish, and what they do on the screens. NightHall acts on those and on nothing else. Where an instruction would breach the law, NightHall says so and does not carry it out.

Confidentiality

Everybody at NightHall with access is bound to confidence. Access is granted by a platform staff grant, every grant is recorded with who granted it, and every role but founder expires after ninety days. A support read that crosses into an organizer's data is audited with the reason, and the organizer can read that audit entry.

Security

Transport is encrypted and personal data is held in the European Union. Ticket codes are kept as keyed one-way digests, and secrets are sealed with keys held in the database. Access is authorized per action and scope, and every action that crosses a boundary is audited. A personal value is refused by a check that reads every log call through the compiler's own parser. The proxy's access log deletes the API key header, the contact header and the support reason before the line is written.

That is the published posture.

Sub-processors

The sub-processors, with what each one processes and under what agreement, are on the sub-processor page. NightHall notifies the organizer thirty days before adding one, and the organizer may object and end the agreement if they cannot accept it.

Transfers

NightHall cannot show that no personal data leaves the European Union, and this page does not say that it does. Every store is pinned to a European region, and that is a fact about NightHall's own configuration. It is not a fact about a United States parent company running a European region. Nor about a United States company with a European region selected on the account. Where a provider's own terms leave that open, the sub-processor page says so and names the provider. A clause promising no transfers is otherwise an assertion rather than a finding.

Helping the organizer answer a person

NightHall provides the organizer with the technical means to action a data subject's Article 15 right of access. It does the same for the Article 17 right of erasure across every store. Where the Article 20 portability right applies, NightHall provides that export too. An organizer answering a person does not have to ask NightHall to run a query.

NightHall tells the organizer without undue delay about any personal data breach it becomes aware of. It says what it knows at the time rather than waiting for an investigation. The record that is legally retained, such as financial evidence, is separated from the tiers that are erasable. A deletion cannot remove a record the law requires.

Deletion at the end

When the agreement ends, NightHall deletes the organizer's buyer data except what it is required to keep. What it keeps, and for how long, is in the retention policy that governs the product's erasure, legal hold and financial tiers.

Audit

The organizer may ask for the information needed to satisfy themselves that this agreement is met. NightHall answers with its own records rather than by hosting a visit, because there is no data centre to visit.