RestartiX Webinars

English

Română

English

Română

Appearance

Legal Documents ​

All legal documents for the [PLATFORM PROVIDER] event platform.

Status. The three organisation-facing templates listed below are in force. The privacy policy, cookie policy and terms of service derived from them are published on the customer organisations' public domains, and acceptance of the terms of service and of the processing of personal data is recorded against them on every registration. That text has not been through legal review, so the outstanding review of those templates is remedial rather than preparatory. The platform documents in the second section remain unexecuted drafts: they carry unresolved terms, including the identity of the contracting entity, its registration details and the effective date, and cannot be executed in their current form.

GAP-GOV-01 · DOCS — KNOWN GAP, REMEDIATION PENDING

This index previously described the whole corpus as version 1.0 drafts requiring legal review before use. The organisation-facing privacy, cookie and terms templates are already published on the customer organisations' public domains and are the documents against which consent is recorded at registration, so text that has never been reviewed is already being relied upon. This divergence is recorded on the compliance remediation register and is under review.

Known gaps. This corpus is under remediation. Where a document previously asserted a safeguard, a retention period, an integration status or a consent gate that the platform does not implement, the text has been corrected to describe current behaviour and the divergence is marked in place with a KNOWN GAP — REMEDIATION PENDING callout. Divergences are recorded across, among other areas, acquisition funnels and landing-page measurement, automated contact journeys, AI-assisted content generation, SMS notifications, segment broadcasts, live-session retention, and tenant isolation in the Realtime Database and in Cloud Storage. The documents must be read together with those callouts; on their own they are not an unqualified description of the platform.

Three-Level GDPR Model ​

Contact / Attendee (Data Subject)
    |
    | accepts org's terms of service + privacy policy (single bundled checkbox,
    |   recorded as tos_acceptance + data_processing); cookie preferences stored
    |   browser-side only, not in the consent ledger
    v
Customer Organization (Data Controller)
    |  - Determines purposes and means of processing
    |  - Publishes privacy policy, cookie policy, terms of service
    |  - Handles GDPR data subject requests
    |  - Signs DPA with [PLATFORM PROVIDER]
    |
    | delegates processing via DPA
    v
[PLATFORM PROVIDER] (Data Processor; also Data Controller — see below)
    |  - Processes data on behalf of orgs
    |  - Implements security measures
    |  - Maintains ROPA, breach response plan
    |  - Signs sub-processor DPAs
    |  - Determines AI generation and server-side ad measurement itself
    |
    | engages via sub-processor DPAs
    v
Sub-Processors (eleven, listed in Annex III)

How consent is actually captured. On the public funnel form a single checkbox records acceptance of both the terms of service and the processing of personal data, and a telephone number entered in the form grants consent to SMS notifications without a separate checkbox; where the marketing checkbox is also ticked, that marketing consent is extended to SMS marketing. The attendee application applies the same bundling for the terms and processing consents. The cookie banner's outcome is stored only in a first-party cookie on the visitor's device (rx_cookie_consent, a JSON value recording the necessary, analytics and advertising choices, a timestamp and a version, retained for twelve months). It is never written to the consent ledger, so the platform holds no server-side record of who accepted or rejected cookies, and cannot evidence a cookie-consent decision after the fact.

GAP-CONSENT-04 · CODE — KNOWN GAP, REMEDIATION PENDING

This model previously showed the data subject consenting to the organisation's privacy policy, cookie policy and terms of service as three separate acts. Only two of those consents are recorded, they are granted together behind a single checkbox, and the cookie-banner decision is never transmitted to the platform at all. This divergence is recorded on the compliance remediation register and is under review.

Where the provider is not a processor. Two production processing operations are determined by [PLATFORM PROVIDER] rather than by the customer organisation. AI-assisted content generation runs on a single platform-level credential: the provider selects the model vendor and the models, and every prompt and output is retained indefinitely; there is no per-organisation credential and no per-organisation switch, so a customer organisation cannot instruct, restrict or terminate that processing. Server-side advertising conversion measurement is operated under a legitimate-interest assessment recorded in the provider's own Data Protection Impact Assessment, and the events are sent without an advertising-consent gate. For both operations the provider determines the purposes and the means, and therefore acts as a controller in its own right.

GAP-GOV-02 · GOVERNANCE — KNOWN GAP, REMEDIATION PENDING

This corpus models [PLATFORM PROVIDER] exclusively as a processor: the Record of Processing Activities is maintained under Article 30(2) alone, and the Data Processing Agreement places sole responsibility for obtaining consent to ad conversion tracking on the customer organisation. For AI-assisted content generation and for server-side advertising conversion measurement the provider selects the means and asserts its own legal basis, and no Article 30(1) record and no Article 13/14 notice exists for the processing the provider determines for itself. This divergence is recorded on the compliance remediation register and is under review.

You are...You need...
[PLATFORM PROVIDER] teamDPA to sign with customers, ROPA for supervisory authority, breach plan
Customer org adminPrivacy policy, cookie policy, terms of service to publish on your domains
Lawyer / DPOEverything — review all docs in both sections, together with the KNOWN GAP — REMEDIATION PENDING callouts recorded throughout them

For Organizations (Customer-Facing Templates) ​

Templates that each customer organization customizes and publishes for their event attendees. The policies derived from all three are already published and in force on the customer organisations' public domains.

Platform Documents (B2B / Internal) ​

Documents governing the relationship between [PLATFORM PROVIDER] and its customers. Four of them are operational records rather than customer-facing terms — the ROPA, the Data Retention Policy, the Data Breach Response Plan and the DSAR Procedure. The Data Retention Policy and the DSAR Procedure are internal operational documents, and the ROPA is maintained internally and made available to supervisory authorities on request; all four are nevertheless served from this documentation site.

GAP-GOV-03 · GOVERNANCE — KNOWN GAP, REMEDIATION PENDING

This section is labelled internal, and the operational documents it lists were drafted on the footing that they are not published to customers or attendees. All of them are in fact served from this documentation site, which requires no authentication, carries no exclusion from search-engine indexing and makes the whole corpus retrievable through its site search; omitting this section from the main navigation is obscurity rather than access control. The operational detail those documents contain, including the security and retention gaps recorded in them, is therefore public. This divergence is recorded on the compliance remediation register and is under review.