Data-processing schedule
Proposed arrangements for information processed for organisers.
Version: perka-legal-draft-2026-10-28/data-processing
Scope and roles
This draft schedule is intended to apply where Perka processes event personal information on an organiser's documented instructions. It does not make Perka an operator for its separate platform-account purposes. The completed agreement must identify any independent or shared responsibilities.
The particulars must name the parties and contacts, events, duration, purposes, categories of people and information, authorised users, and permitted operations. The organiser must have a lawful basis for its instructions and provide the required event information to visitors.
Instructions and permitted processing
The proposed instructions cover event registration, account-linked access, storage of preferences and saved makers, authorised reporting/exports, and support needed for the agreed service. Processing outside that scope needs an appropriate instruction or separate lawful responsibility.
The schedule should require escalation of instructions that appear unlawful, limit access to authorised people, and bind personnel handling information to appropriate confidentiality duties.
Security arrangements
The current implementation verifies account identity, scopes workspace access, applies database row-level controls, and records administrative/export activity. These controls do not constitute a promise of absolute security or independent certification.
The completed security schedule must address access reviews, credential management, provider configuration, backups, incident handling, export security, and removal of access. Organisers remain responsible for downloaded copies under their control.
Providers and international transfers
Supabase supports authentication and the database; Cloudflare R2 stores uploaded media. Google acts as an optional sign-in provider for visitors who choose it. Browser push services deliver notifications that visitors opt into. Complete the hosting, email, and other provider inventory with locations and contractual arrangements. Agree the mechanism for provider changes and any cross-border processing before finalising the schedule.
Do not claim South Africa-only storage or an agreed transfer safeguard until the production setup and relevant agreements establish it.
Incidents and personal-data requests
The proposed schedule requires prompt escalation and cooperation on suspected compromises and data requests. Complete the operational contacts, escalation process, applicable timeframes, and allocation of regulatory/data-subject notification responsibilities.
Each party must help locate relevant records and assess the lawful response. A request affecting an organiser export cannot be completed merely by changing the live event record.
Retention, return, and deletion
Agree the retention trigger and period for each record category, handling of evidence and suppression information, return/export arrangements, and deletion from live systems and backups. Address justified legal retention separately.
The current event-removal action cascades to event favourites and consent records; other accounts and registrations remain. Neither the end of an event nor closure of business access currently triggers all the return/deletion operations proposed by this schedule. Those operations must be agreed and implemented.
Assurance and agreement status
Agree proportionate evidence of compliance, review/audit cooperation, allocation of costs, and remedies without exposing other customers' information or credentials. The organiser agreement must set document precedence and the parties' final obligations.
This is a draft, not an executed operator agreement. Send questions and proposed particulars to legal@joinperka.com.
To complete before publication
- Party particulars, purpose-by-purpose roles, documented instructions, term, and signed incorporation into the organiser agreement.
- Provider list/locations, transfer arrangements, security schedule, incident contacts, retention, return/deletion, and audit arrangements.