TRIBUNA
Data processing agreement
Last updated 28 September 2026
This data processing agreement ("DPA") forms part of the terms of service between the customer ("Controller") and Tribuna ("Processor"). It applies when Tribuna processes personal data inside a customer workspace.
1. Scope
| Item | Details |
|---|---|
| Subject matter | Hosting and processing of workspace data to provide Tribuna |
| Duration | The subscription term, plus the deletion period in §7 |
| Data subjects | Customer users, speakers, presenters, moderators and event staff |
| Personal data | Names, email addresses, roles, session assignments, uploaded files that contain personal data, activity logs |
| Special categories | Not intended. The Controller should not upload them. |
2. Processor obligations
- Process personal data only on the Controller's documented instructions, including these terms.
- Make sure everyone authorised to process the data is bound by confidentiality.
- Take appropriate technical and organisational security measures (§5).
- Help the Controller respond to data subject requests and meet its security and breach obligations.
- Make available the information needed to show compliance.
3. Sub-processors
The Controller authorises Tribuna to use sub-processors for hosting, email delivery and payment processing. We'll give notice before adding or replacing one, and the Controller may object on reasonable grounds. An up-to-date list is available on request.
4. International transfers
Where personal data moves across borders, we use appropriate safeguards, such as standard contractual clauses, where the law requires them.
5. Security measures
- Encryption in transit (TLS) for all web and API traffic
- Workspace-level isolation of records
- Role-based access control, and passwords stored as salted hashes
- Audit logging of uploads and changes
- Regular backups and restricted administrative access
6. Personal data breaches
If we become aware of a personal data breach affecting Controller data, we'll notify the Controller without undue delay and within 72 hours. The notice will include the information the Controller reasonably needs to meet its own obligations.
7. Return and deletion
When the service ends, the Controller may export its data for 30 days. After that, we delete it within a further 60 days, except where the law requires us to keep it.
To sign a countersigned copy of this DPA, contact privacy@tribuna.one.