Data processing agreement
Auftragsverarbeitungsvertrag (AVV) under Art. 28 GDPR
Version 1.0, 9 November 2026. For organizers who use Schmingo at their events. You don't need to sign anything: this agreement is part of our terms and applies whenever you create an event. If your company needs a signed copy, write to hello@schmingo.com and we'll send one.
1. Parties and roles
Controller: the organizer who creates an event on Schmingo (company, institution or person), called "you".
Processor: Brooke Gazdag, trading as Schmingo, [business address], Germany, hello@schmingo.com, called "we".
You decide to use Schmingo at your event and for which purpose. We process personal data only on your behalf and on your documented instructions. Your instructions are the settings you choose on the host screen and these terms.
2. Subject, purpose and duration
- Subject and purpose: running the networking game at your event: storing the event and its settings, keeping the game in step on all phones, finding the winners, collecting the feedback you ask for, and showing you results.
- Duration: as long as you use Schmingo for the event. Data is then deleted on the schedule in section 9.
3. What data, about whom
| Data subjects | Data we process on your behalf |
|---|---|
| You and your team (hosts) | Event name, date, hashtag, settings, logos; host name(s) and contact email if you add them; a hashed host key; if you sign in, your email address, hashed sign-in links and sessions, and the list of events you host; for passes, the buyer's email address and transaction number (via Paddle). |
| Your guests (players) | Anonymous game counts per card: a random card number, number of ticked squares and lines, time of the first line; the answers to "What describes you?" if you ask it and they answer, without a name; feedback they choose to send (ratings, answers, comment), without a name. |
Players' cards and their lists of people met stay on their own phones and are never sent to us. Players' names stay on their phones too, unless you turn on names on the leaderboard: then each player's own name is sent to us, shown on your host screen, and deleted when you end the event, after 12 hours at the latest. We process no special categories of data (Art. 9 GDPR). Your own squares must not ask for them (see our terms, section 6).
4. Our obligations
- We process the data only on your instructions, including for transfers to third countries, unless EU or German law requires otherwise. We tell you if we think an instruction breaks data protection law.
- Everyone who can access the data is bound to confidentiality.
- We take the technical and organizational measures in section 10.
- We help you, as far as we can, to answer requests from data subjects (Art. 15–22 GDPR), and with security, breach notifications, impact assessments and consultations (Art. 32–36 GDPR).
- We tell you without undue delay, and within 48 hours at the latest, once we become aware of a personal data breach affecting your event.
- We give you the information you need to show compliance with Art. 28 GDPR and allow audits, normally by written information. On-site audits with reasonable notice, at your cost.
5. Your obligations
- You have a legal basis for using Schmingo at your event and tell your guests about it, for example with a line in your invitation or on the screen that links to our privacy page.
- You don't enter special categories of data, and you check AI suggestions before using them.
6. Subprocessors
You authorize these subprocessors. We tell you by email or on this page at least 14 days before adding or replacing one; you may object for good reason.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting the website and app (functions run in Frankfurt) | USA / EU |
| Upstash, Inc. | Database for events, game counts and feedback | EU region |
| Sendinblue SAS (Brevo) | Sending emails: sign-in links and pass codes | EU (France) |
| Anthropic PBC | AI suggestions for squares, only when you ask for them; no player data | USA |
| Paddle.com Market Ltd | Payments, as merchant of record (independent controller for payment data) | UK |
7. Transfers outside the EU
Where a subprocessor processes data in the USA or the UK, the transfer rests on an adequacy decision (EU-US Data Privacy Framework for certified providers; UK adequacy) or on the EU Commission's standard contractual clauses (Art. 45 and 46(2)(c) GDPR).
8. Requests from guests
If a guest asks us directly about their data, we pass the request to you. Because we keep no names after an event, we usually can't link data to a person.
9. Deletion
- Game counts and feedback: automatically 30 days after the last update.
- Event settings, host names, logos, and the list of events on a sign-in: at the latest 400 days after the last change, or sooner on request. Sign-in links: 30 minutes (7 days in the purchase email). Sessions: 90 days, or when you sign out.
- Pass records: up to 400 days, so a lost code can be found; invoices are kept by Paddle as the law requires.
- When this agreement ends, we delete your event's data on request, unless the law requires us to keep it.
10. Technical and organizational measures (Art. 32 GDPR)
- Data minimization by design: no player accounts; players' names and contacts stay on their phones.
- Encryption in transit: all connections use HTTPS (TLS).
- Access control: only Brooke Gazdag has administrator access, protected by a secret key; host keys are stored only as hashes.
- Separation: each event's data is stored under its own key; test and live payment data are kept apart.
- Retention limits: automatic deletion as in section 9.
- Abuse protection: limits on new events per day, using a hashed network address deleted after one day.
- Providers: subprocessors under data processing agreements with their own certified security programs.
11. Liability and law
Liability follows Art. 82 GDPR and our terms. German law applies. If this agreement and the terms conflict on data protection, this agreement prevails.