Shoal

Data Processing Agreement

Last updated October 25, 2026

This agreement is part of our Terms of Service. It applies when KreweLink LLC handles personal data for an organizer, and it meets the processor terms that laws such as the GDPR, UK GDPR and CCPA require.

What this covers

When you run an event on Shoal, you (the organizer) are the controller of your attendees’ and speakers’ personal data, and we are your processor (a “service provider” under the CCPA). This agreement covers that data. Data about your own account is covered by our Privacy Policy instead. If this agreement and the Terms disagree about personal data, this agreement wins.

Your instructions

  • We process the data only to provide Shoal to you, as you direct through the dashboard, the API and these terms, and as the law requires. If the law requires something else, we will tell you first unless the law forbids it.
  • We will tell you if we think an instruction breaks data protection law.
  • We do not sell the data, share it for advertising, or use it for our own purposes beyond running, securing and improving Shoal.
  • You are responsible for having a lawful basis for the data you collect and for the notices you give.

Our people

Only staff who need the data to support you, keep Shoal safe, handle billing or meet legal duties can reach it, and they are bound to keep it confidential. Staff changes inside your dashboard need your support access and are logged and shown to you.

Security

We keep appropriate technical and organizational measures in place, including: encryption in transit and at rest; database rules that keep each organization’s data apart; two-step sign-in for staff; logging of staff actions; hashed passwords and API keys; and limits that slow down abuse. Our Security page describes them in more detail.

Subprocessors

You allow us to use the providers listed on our Subprocessors page. Each is bound by written terms that protect the data at least as well as this agreement. We will tell you before adding or replacing one where we reasonably can. If you have a reasonable data protection objection, email support@shoalevents.com; if we can’t resolve it, you may stop using Shoal and delete your events. We remain responsible for our subprocessors.

Helping you

  • Shoal lets you see, correct, export and delete attendee data yourself. If an attendee contacts us directly, we will pass the request to you and not answer it ourselves unless you ask us to.
  • We will give you reasonable help with data protection impact assessments and with questions from regulators about our part in the processing.

Breaches

If we become aware of a breach of security that affects your data, we will tell you without undue delay, share what we know so you can meet your own duties, and take reasonable steps to contain it and stop it happening again.

When it ends

You can export your data at any time before you delete it. When you delete an event or your account, we delete the data as our Privacy Policy describes, unless the law requires us to keep some of it.

Twelve months after an event ends, we delete that event’s personal data (attendees’ details, answers, photos, and the files uploaded for the event) automatically, and we keep only summary numbers. That is your standing instruction unless you ask us in writing to keep it longer. Owners and admins are reminded 30 days and 7 days before and can download the data themselves from the event’s Reports tab; that is how we return your personal data to you. Backup copies are deleted on our database provider’s schedule.

Information and audits

We will answer reasonable written questions about how we protect your data, and give you the information you need to show you meet the law. If that is not enough, you may audit our compliance once a year, with 30 days’ notice, at your own cost, during business hours and under a confidentiality agreement, in a way that does not put other customers’ data at risk.

International transfers

Shoal stores and processes data in the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred, the European Commission’s Standard Contractual Clauses (module two, controller to processor, or module three where you are a processor) and the UK addendum apply and are part of this agreement, with you as data exporter and us as data importer.

Details of the processing

  • Subject and purpose: providing Shoal so you can invite, register, sell tickets to, inform, seat, check in and engage the people at your events.
  • Duration: for each event, 12 months after it ends (longer if you ask us to), or until you delete it, as described above.
  • People concerned: attendees, invited guests, speakers, sponsors’ contacts and your event staff.
  • Kinds of data: names, email addresses, job titles and companies, photos, registration answers and uploaded files, ticket and order details, session picks, tracks, seats, check-in times, and activity in the attendee app. If you choose to ask about dietary or accessibility needs, those answers too.
  • What we do with it: store, organize, display, email, and delete it, as you direct.

Questions about this agreement? Email support@shoalevents.com.