GDPR & Data Processing

Klik is the controller for host account, security and communication data. For the content guests upload to an event, the host is the controller and Klik is the processor acting on the host's documented instructions.

When you act as a host, the following processor commitments apply to the event content we handle for you:

• ·Subject-matter & purpose: storing and displaying event Content to provide the Service.
• ·Duration: for the event's storage window and until deletion.
• ·We process Content only on your instructions and only to provide the Service; we do not sell it or use it to train models or for advertising.
• ·We keep Content confidential and require the same of our sub-processors.
• ·We apply appropriate technical and organisational security measures (see Privacy Policy §8).
• ·We use the sub-processors listed in the Privacy Policy and will inform hosts of material changes.
• ·We assist you, as far as reasonably possible, with data-subject requests and with your own security and breach obligations.
• ·On expiry or on your instruction we delete the Content, save for short-lived backups.
• ·We make available the information reasonably necessary to demonstrate compliance.

Event media and account data are stored within the European Union (currently [DATA REGION], via Supabase). Where a sub-processor operates outside the EEA, we rely on Standard Contractual Clauses and other appropriate safeguards. See Privacy Policy §5–§6.

Data-subject rights and how to exercise them are set out in the Privacy Policy §9. You can reach us at hello@klikapp.co, and you have the right to complain to your data-protection authority (in Croatia, the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP — azop.hr)).

If you are a business host and need a countersigned Data Processing Agreement for your records, contact hello@klikapp.co and we will provide one.