Data Processing Agreement (DPA)
Date: 28th March 2026
This Data Processing Agreement (“Agreement”) is entered into between the parties under and subject to the Terms & Conditions of the relevant platform where it is incorporated (including BookYourWebinar) and applies whenever the Processor processes Personal Data on behalf of the Controller.
- Definitions
For the purposes of this Agreement:
- Personal Data: Any information relating to an identified or identifiable natural person.
- Processing: Any operation or set of operations performed on Personal Data (e.g., collection, storage, consultation, transmission).
- Controller: The legal entity that determines the purposes and means of processing Personal Data.
- Processor: The legal entity that processes Personal Data on behalf of the Controller.
- Sub-processor: Any third party appointed by the Processor to process Personal Data on behalf of the Controller.
These definitions are consistent with GDPR and UK GDPR.
- Controller Details
- Controller: Book Your Webinar (Tamir Spiegel Ltd T/A Book Your Webinar)
- Address: The Quadrant, 99 Parkway Avenue, Sheffield, South Yorkshire, England, S9 4WG
- Contact: bookyourwebinar@gmail.com
- DPO/Privacy Contact: bookyourwebinar@gmail.com
- Subject Matter
This Agreement governs the Processing of Personal Data by the Processor on behalf of the Controller in connection with the Controller’s use of the Processor’s services via BookYourWebinar (the “Services”).
- Duration
Processing shall continue for the duration of the Controller’s use of the Services and shall automatically terminate upon termination of the relevant Terms & Conditions, unless otherwise required by law.
- Obligations of the Processor
- Instructions: Processor shall only Process Personal Data on documented instructions from the Controller. If Processor believes any instruction violates applicable law, it shall promptly inform the Controller.
- Confidentiality: Processor ensures that personnel with access to Personal Data are bound by confidentiality obligations.
- Security: Processor shall implement appropriate technical and organisational measures, including but not limited to:
- Encryption of Personal Data in transit
- Access control and authentication
- Regular backups and disaster recovery procedures
- Monitoring, logging and intrusion detection
- Security incident response procedures
Full details are available in the Security Annex at https://bookyourwebinar.com/security-annex/. - Sub-processing:
- Processor may only engage Sub-processors with general written authorisation from the Controller.
- Controller will be notified of any material changes to Sub-processors and may object in writing within 10 business days. If no objection is received, consent is deemed given.
- Sub-processors must be bound by obligations at least equivalent to this Agreement, and Processor remains fully responsible for their acts and omissions.
- Data Subject Rights: Processor shall assist Controller in responding to requests from data subjects exercising their rights under applicable law.
- Breach Notification: Processor shall notify Controller without undue delay upon becoming aware of any Personal Data Breach affecting Controller’s data.
- Audit and Compliance: Processor shall provide information and cooperate with audits, inspections, or independent assessments, as reasonably requested by Controller, to demonstrate compliance with this Agreement and applicable law. Reasonable notice shall be provided, and audit frequency shall not be excessive.
- Obligations of the Controller
Controller warrants that:
- It has a lawful basis to provide Personal Data to Processor.
- Instructions comply with applicable data protection laws.
- International Transfers
Personal Data may be transferred outside the UK/EEA to sub-processors, including the United States, only under appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or other GDPR/UK GDPR-compliant mechanisms to ensure an adequate level of protection. Copies of the relevant transfer agreements will be provided to the Controller upon request.
- Data Return or Deletion
Upon termination of Services, Processor shall, at Controller’s option:
- Return all Personal Data securely, or
- Permanently delete all Personal Data, except where retention is required by law (e.g., tax, accounting, or legal obligations).
- Liability
Liability related to Processing under this DPA is governed by the underlying Terms & Conditions, except to the extent prohibited by applicable data protection law. Nothing in this DPA excludes the Processor’s liability for breaches of its obligations under GDPR/UK GDPR or for intentional or negligent acts causing Personal Data loss or unauthorized access.
- Governing Law
This Agreement is governed by the laws specified in the Terms & Conditions (e.g., England & Wales).
- Incorporation
By accepting the Terms & Conditions, the user also accepts this DPA, which is incorporated by reference and forms part of the Terms & Conditions.
Annex A — Processing Details
| Subject Matter | Provision of Services via BookYourWebinar.com |
| Purpose | Hosting webinars/courses, account management, notifications, billing, analytics, support |
| Duration | As long as Controller uses Services |
| Categories of Personal Data | Contact data, identifiers, user input data, usage logs, payment data (if applicable) |
| Data Subjects | Users of the Services, instructors, and related parties |
| Legal Basis | Controller warrants lawful basis for Processing |
| Sub-processors | Listed at https://bookyourwebinar.com/subprocessors/; includes processing locations and purposes |
| Retention | Until Services termination, or longer if required by law (e.g., tax/accounting obligations) |