EventPro Data Terms (PDPA)
These Data Terms form part of the EventPro Terms of Service between Oris Production (registration no. 201203061285 / PG0297102-T), contactable on WhatsApp at +60 12-476 0491 or by email at support@eventproonline.com ("we", "the processor") and the customer named in the booking ("you", "the data user").
1. Roles
You are the data user: the guest list is yours, you decide who is on it and why. We are your data processor: we hold and process that data only to provide the service, and only on your instructions (your use of the software is your instruction).
2. What data is processed
- Guests: the identifier you use (employee ID, badge number or similar), name, and any optional fields you choose to import (for example email, phone, table or department).
- Event activity: check-in time and which station, whether the guest is in the lucky draw, prizes won, and prize collection time and counter.
- Your staff: the login email of your account, and the names you give stations ("Door 1").
- Technical: a device identifier for each phone, tablet or laptop used as a station, and ordinary server logs. We do not ask for and you should not upload identity card numbers, financial details, health data or other sensitive personal data. Guest photographs are not part of the service.
3. Purpose
We process the data only to: run check-in, the lucky draw and prize collection for your event; produce your exports and reports; make the automatic backups described below; keep the service secure; and provide support when you ask for it. We do not use your guest data for our own purposes, we do not sell it, and we do not use it to train any machine-learning model.
4. Where the data is kept
Data is stored with Supabase in the Singapore region, and the apps are delivered by Netlify. Both are sub-processors (section 8). Malaysian law allows transfer outside Malaysia where the data is adequately protected; our contracts with these providers include the standard data protection terms. (Storage inside Malaysia only is not available on the current setup; if a customer asks for it, say so before they book.)
5. How long it is kept, and deletion
5.1 The data is kept for your event and the read-only period after it, then the event is archived.
5.2 On the deletion date in your booking, all personal data for that event — guests, check-ins, collections, station records — and all backups of it are permanently deleted. We keep only anonymous counts (how many guests, how many checked in), which do not identify anyone.
5.3 We send a reminder 10 days before the deletion date. You may ask in writing, before that date, for more time.
5.4 You may ask us in writing to delete an event's data earlier, and we will do so, except where the law requires us to keep it.
6. Backups
Copies of your event are made automatically while it is live (about every 5 minutes, and at each draw), stored in the same Singapore region, private to your account and to us, and deleted with everything else on the deletion date. You can download a copy at any time; a copy you download is then in your own hands and your responsibility.
7. Security
- Every customer's data is separated in the database, and one customer can never read another's (this is enforced by the database itself, and tested automatically before each release).
- A station device gets its own restricted login: it can read its event's guest list and write check-ins, nothing else.
- Our administrator access requires a second factor (an authenticator app).
- Actions that can change or remove event data require the manager PIN you set, and a restore is recorded.
- Data is encrypted in transit (HTTPS) and at rest by the provider.
- Anyone working for us who can see customer data is bound to confidentiality.
8. Sub-processors
| Sub-processor | What for | Where |
|---|---|---|
| Supabase | database, file storage, logins | Singapore |
| Netlify | delivering the apps to browsers | global network |
| Resend | the reminder emails we send ourselves (customer name, event name, counts — no guest data) | Tokyo |
We will tell you before adding a sub-processor that handles guest data.
9. Your guests' rights
Guests may ask you to see, correct or delete their data. You handle those requests as the data user; we help you on your written request — for example by correcting a record or deleting a guest. If a guest contacts us directly, we will refer them to you.
10. Telling your guests
You must tell your guests, before the event, that their name and identifier are used for check-in and (where it applies) a lucky draw, and that software provided by Oris Production processes this on your behalf. A line in the invitation or registration form is usually enough. A wording you may use:
"Your name and [employee ID] will be used to check you in at this event and, where applicable, for the lucky draw. Event software provided by Oris Production processes this on our behalf; the data is deleted after the event."
11. If something goes wrong
If we become aware of a breach of security affecting your data, we will tell you without undue delay, with what we know, what we are doing, and what we suggest you do. You are responsible for any notification the PDPA requires you, as the data user, to make — including any deadline the law sets for telling the Commissioner or the affected guests.
12. When the agreement ends
At the end of the licence the data follows section 5: read-only, archived, then deleted on the deletion date, backups included. Nothing is kept beyond that except the anonymous counts.
13. Website chat
The chat assistant on our website is powered by Google Gemini. What you type is sent to Google to produce an answer and may be used by Google to improve its services. Please don't enter personal details in the chat. We don't use chats for anything else, and they are not linked to your event data. For bookings or personal questions, contact us on WhatsApp or at support@eventproonline.com.