Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between Customer (the "Controller") and Mint Link (the "Processor") together the "Parties".

1. Subject Matter

This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the provision of the Mint Link SaaS platform and related services.

2. Nature and Purpose of Processing

The Processor will process personal data solely for the purpose of:

• providing project management tools for MICE operations;
• enabling collaboration between event stakeholders;
• managing supplier and DMC interactions as instructed by the Controller;
• storing, organizing, and transmitting event-related data;
• providing AI-assisted planning and operational features (as configured by the Controller).

3. Types of Personal Data

• names and contact details;
• business contact information;
• employer/company information;
• event attendee data;
• travel and logistics data;
• communication records;
• supplier and client contact details.

4. Categories of Data Subjects

• corporate clients;
• event attendees;
• employees and contractors of the Controller;
• suppliers and vendors (including DMC contacts).

5. Obligations of the Processor

The Processor shall:

• process personal data only on documented instructions from the Controller;
• ensure confidentiality of personnel with access to data;
• implement appropriate technical and organizational security measures;
• assist the Controller in fulfilling GDPR obligations (where applicable);
• notify the Controller of any personal data breach without undue delay;
• not sell or use personal data for independent purposes;
• not retain data longer than necessary for providing the Services.

6. Subprocessors

The Controller authorizes the Processor to engage subprocessors for service delivery, including:

• cloud infrastructure providers;
• hosting and storage providers;
• analytics and monitoring services;
• communication and notification tools.

The Processor will ensure subprocessors are bound by data protection obligations equivalent to this DPA.

7. International Transfers

Where personal data is transferred outside the EEA, the Processor shall ensure appropriate safeguards such as Standard Contractual Clauses or equivalent lawful mechanisms.

8. Security Measures

The Processor shall implement appropriate technical and organizational measures, including:

• access control mechanisms;
• authentication and authorization systems;
• logging and monitoring;
• backup and recovery procedures.

9. Return or Deletion of Data

Upon termination of the Services, the Processor shall, at the Controller's choice:

• delete personal data; or
• return personal data in a commonly used format,

unless retention is required by law.

10. Liability

Each party's liability under this DPA shall be subject to the limitations and exclusions set out in the main Terms and Conditions.

11. Governing Law

This DPA is governed by the laws of Ireland.

12. Contact

Mint Link Traveltech Solutions, Ltd.
Landscape House, Baldonnell Business Park, Dublin 22 D22 P3K7
Email: go@mint.link