Data processing and DPA
How we handle your data.
When you use UdstillerGuide to run your fair's site, we process data about your exhibitors, their staff and your visitors. The roles are clear: you are the data controller — it's your data and your decisions. We are the data processor — we store, process and hand over data only on your instructions. This page is an open summary of how we live up to that role.
Who decides what — the roles
The GDPR works with two roles, and it's worth getting them straight from the start: a data controller, who decides the purposes and means, and a data processor, who carries out the processing on instructions.
You — data controller
You decide what is collected about your exhibitors and visitors, what information is shown publicly and how long data is kept, and you're responsible for your own privacy policy towards the data subjects.
Us — data processor
We carry out the processing on your instructions: hosting, storage, display, export, deletion. We don't use your data for anything other than the agreed service, and we don't pass it on to third parties without your approval.
The data processing agreement (DPA)
We have a standard data processing agreement that's signed as part of the contract package. It doesn't need to be a battle or an exercise in small print. Its content is what a reasonable DPA should contain.
Hosting region
The EU. Main infrastructure in Germany and Denmark — no transfers to countries without an adequate level of protection unless explicitly agreed.
Sub-processor list
A complete list is attached as an annex. It's updated with 30 days' notice of changes, so you can object.
Deletion procedure
A clear timeline for export, deletion and confirmation on termination. Described in detail further down.
Security measures
Technical and organisational measures — TLS, access control, monitoring, backup rotation. Described in an annex.
Breach procedure
Notification to you as soon as possible and within 48 hours at the latest when a breach is established, so you can meet your own 72-hour notification duty under GDPR Article 33.
Right to audit
You have the right to audit our compliance with the DPA, either yourselves or through an independent third party, with reasonable notice.
Want to see the DPA before signing a contract? Write to [email protected] — we'll send it without reservation. You're welcome to read it, comment on it and negotiate it before you sign.
Where your data physically lives
We like to be able to point at a server room and say "that's where it is". Here's the actual location of the different types of data.
Primary infrastructure
Hetzner in Germany — production and a separate staging environment. Both in the EU.
Media files
Hetzner Object Storage in the EU. Every customer has their own bucket — your images and video don't share storage with other customers'.
Mail / transactional
Our own mail infrastructure, run in Denmark, with an EU-based relay for sending. No US SaaS in the mail path.
Statistics (if chosen)
A per-customer stack for visitor statistics on the same EU infrastructure. No Google Analytics, no third-party trackers.
Backup
Encrypted backups in the EU. They rotate out after 90 days.
CDN & perimeter
Cloudflare as CDN and DDoS protection — it delivers content close to the visitor, but doesn't store your database.
Our sub-processors
Sub-processors are the third parties that necessarily process your data because we use their infrastructure. The list is short on purpose — we only outsource what genuinely has to be outsourced.
| Supplier | Role | Region |
|---|---|---|
| Hetzner | Hosting (servers, object storage, backup) | Germany (EU) |
| Cloudflare | CDN, DDoS protection, Turnstile (bot filter) | Global edge network; data processing agreement with EU standard contractual clauses |
| Mail relay | Outgoing transactional mail (receipts, notifications) | EU |
| AI model providers | Only with an AI package. The specific providers are listed in the sub-processor annex to the DPA. | See the DPA annex |
When things change: We give you 30 days' notice before we add or change a sub-processor, so you have time to object if the change doesn't fit your own compliance framework.
AI processing
If you've chosen a package with AI features — draft exhibitor profiles or the Concierge, for example — we send data to one or more AI model providers as part of the service. This is the area where people are most rightly sceptical, and where we're at our most explicit.
Anonymisation
Where it's technically possible, we anonymise prompts so the model provider doesn't see personal names or direct identifiers, only the content that needs processing.
No training on your data
Our model providers are contractually bound not to train on input or output from our traffic. That isn't a friendly intention — it's in our contracts with them.
Named providers
Which specific AI providers we use is set out in the sub-processor annex to the DPA. The list can change — hence the 30 days' notice.
Our principles
We've written more generally about how we think about AI: From Google to AI.
Deletion on termination
What happens when you cancel? It should be predictable, and it should be possible to document. The timeline is clear.
-
Within 14 days
Export
You get your data exported as JSON and/or CSV — exhibitors, profiles, media files, hall plan, content files. The format and delivery method are agreed with you.
-
Within 30 days
Deletion
All active data is deleted from production: database, media files, statistics, AI-generated artefacts. The deletion covers the staging environment too.
-
Written confirmation
Documentation
You receive a written certificate of deletion confirming that the data has been removed and which systems it covers. You can use it in your own compliance documentation.
-
Within 90 days
Backup rotation
Encrypted backups rotate out automatically within 90 days. We can't selectively delete individual records from backups, but they expire by themselves within that window.
Security measures
The specific technical and organisational measures we've taken. The list isn't exhaustive, but it covers what you ask about most often.
TLS everywhere
All traffic between visitors and the site, and between our internal services, is TLS-encrypted. Cloudflare origin certificates secure the chain all the way to the origin.
No public SSH
Servers aren't reachable via public SSH. Access only through a Tailscale overlay network with key-based authentication.
Bot and DDoS protection
Cloudflare's DDoS protection in front of the site. Turnstile on sensitive forms to filter out bot spam without showing visitors a puzzle.
Monitoring
Beszel for system metrics, Uptime Kuma for external uptime monitoring. Alerts go straight to the person on call.
Active on-call during your fair
While your fair is running we step up our availability — monitoring is checked more often, and the person on call responds quickly.
Access control
The principle of least privilege internally. Access to production data is limited to the people who need it for operations and support.
Breach procedure
If the unthinkable happens, the following applies. It's agreed in the DPA, and it isn't up for negotiation in the moment — we've rehearsed it.
-
As soon as possible — within 48 hours at the latest
Notification to you
We notify you as soon as possible and within 48 hours at the latest when a breach is established, so you can meet your own 72-hour notification duty under GDPR Article 33. The notification covers what we know, what we don't know yet, and what steps we're taking.
-
Ongoing
Updates
You get regular updates while we contain and fix the problem. No radio silence.
-
Within 14 days
Post-mortem
A written account of what happened, why it happened, which data was affected, and which specific changes we're making so it doesn't happen again.
Missing an answer here?
DPA questions can be specific and technical. Write to us, and you'll get a specific answer.