Data Processing Addendum

Effective October 14, 2026

This addendum covers the attendee data organizers collect through Momenial for Events. It is part of our terms and prevails over them for that data.

Roles

The organizer is the controller of the attendee data it collects. PT Momenial Open Media (“Momenial”) processes that data on the organizer's behalf as its processor, also called a data intermediary. For organizer accounts and their team members, Momenial is the controller under its privacy policy.

Data we process

Names, email addresses and mobile numbers of registrants and attendees; answers to registration questions; orders, tickets and payment status; check-in records; payment proofs that buyers upload; and records of the emails and WhatsApp messages sent to them.

How we use it

Only to provide the service as the organizer configures it: registration, payments, tickets, check-in, messages and support. We do not sell attendee data, use it for our own marketing, or disclose it except as this addendum describes or the law requires.

Where it is stored

Each organizer account is hosted in the region chosen at sign-up: the Americas, Europe or Asia-Pacific. Its events, registrations and uploaded files stay in that region, and files of European accounts are stored under EU jurisdiction. Sign-in records sit in a replicated global database whose primary copy is in Asia-Pacific.

Sub-processors

We use the providers below. A payment provider the organizer connects itself — its own PayPal, Stripe or Midtrans account — acts under the organizer's agreement with that provider.

We update this list at least 14 days before a new sub-processor starts handling attendee data. An organizer who objects may stop using the service and delete its account.

Security

Data is encrypted in transit and at rest. Payment and messaging credentials are additionally encrypted with AES-GCM. Each organizer's data is isolated from every other's, console access is role-based with passkey support, sign-in attempts are rate-limited, and console actions are logged.

Retention and deletion

Registrations are kept until the organizer deletes them or its account. Failed registrations are deleted after 30 days, message records 30 days after the event, check-in records 12 months after the event, and email delivery records after 12 months. Deleted data can remain in backups for up to 30 days. Audit records of account actions are retained for security and legal purposes.

Personal data breaches

If we become aware of a breach affecting an organizer's attendee data, we will notify the account owner without undue delay and within 48 hours, share the facts known and the steps taken, and help the organizer meet its own notification obligations.

Requests from individuals

Organizers can view, export and delete attendee data in the console, and attendees can update their own details where the organizer allows it. If an attendee contacts us directly, we refer them to the organizer and help it respond.

The organizer's responsibilities

The organizer must have a lawful basis for collecting and using attendee data, tell attendees how it is used, collect only what the event needs, and follow consent and do-not-call rules when sending invitations and broadcasts.

Information and audits

On request, we provide the information reasonably needed to show that we meet this addendum, including for a data protection impact assessment.

Changes and contact

We may update this addendum when the law or the service changes; the date above shows the current version. Questions go to support@momenial.com.

PT Momenial Open Media · O2 EK05/1, Grand Wisata, Bekasi 17510, Indonesia