Data processing agreement

Concluded under Art. 28(3) of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").

1. Parties

1. Controller: the organisation that uses Juryline to run programmes, as named in its Juryline organisation settings (the "organiser").
2. Processor: Everlong s.r.o., Zámocká 8, 811 01 Bratislava, Slovakia, company ID 55 271 987, registered in the Commercial Register of the Municipal Court Bratislava III, section Sro, insert 167806/B, e-mail hello@juryline.com ("we").
3. The person who accepts this agreement for the organiser confirms they may act for it.

2. Subject and duration

1. We process personal data for the organiser when it runs programmes in Juryline: collecting and storing applications, screening, evaluation by jurors, results, messages and a live finale.
2. Purpose: running the organiser's call and selection procedure.
3. Nature of processing: collection through forms, storage, display to authorised people, assignment to jurors, calculation of rankings, sending e-mails, exports, deletion and the related security records.
4. Data subjects: applicants and the people named in applications (for example team members), jurors, the organiser's staff, and members of the audience who vote at a live finale.
5. Categories of data: contact details; answers to the fields the organiser defines; uploaded files (up to 25 MB each); team members' names; application status, notes, screening and decisions; jurors' names, e-mail addresses, affiliations, conflict declarations, scores and comments; message logs; for audience votes, keyed hashes of a device identifier and optionally of an e-mail address.
6. Juryline does not ask for special categories of data. If the organiser asks for them in its form, the organiser is responsible for having a legal basis.
7. This agreement lasts as long as the organiser uses Juryline.

3. Instructions

1. We process personal data only on the organiser's documented instructions, including on transfers to third countries, unless EU or Slovak law requires otherwise.
2. The instructions are this agreement and the organiser's actions in Juryline, such as publishing a call, setting fields and visibility for jurors, inviting jurors, assigning applications, sending messages, exporting, setting the retention period and deleting data. Further instructions can be given by e-mail.
3. The organiser instructs us to:
   • show applicants the call, the organiser's privacy notice and the form,
   • send confirmations, reminders and results e-mails the organiser triggers,
   • hide from jurors the fields the organiser marks as hidden,
   • delete a programme with all its applications, files and scores the set number of months (default 24) after results are published, or after the call closes if results are never published, after reminding the owners a month before.
4. We tell the organiser if we believe an instruction breaks data protection law.

4. Our obligations

1. Everyone at Everlong with access to personal data is bound to confidentiality. Access is limited to people who need it to run and support Juryline. Our support opens an organisation only in a recorded support session for 2 hours, read-only, with a reason the organiser can see in its settings.
2. We take the measures in Annex 1 (Art. 32 GDPR) and review them regularly.
3. We engage subprocessors only under Article 5.
4. We help the organiser answer requests from data subjects and forward requests that reach us without undue delay.
5. We help the organiser with Art. 32 to 36 GDPR, taking into account the nature of processing.
6. We do not use the organiser's data for our own purposes, do not sell it and do not send applications, scores or other programme data to AI services. Anonymous totals (such as the number of applications) may be used to run and improve Juryline.
7. We keep a record of processing activities carried out for organisers (Art. 30(2) GDPR).

5. Subprocessors

1. The organiser gives general written authorisation to engage the subprocessors in Annex 2.
2. We announce intended changes at least 30 days ahead by e-mail to organisation owners. The organiser may object; if we cannot agree, it may terminate the agreement before the change applies.
3. We bind each subprocessor to the same data protection obligations (Art. 28(4) GDPR).

6. Transfers outside the EU

1. The database and files are stored in the EU (Frankfurt, Germany) and the app runs in the EU.
2. Where a subprocessor may access data from outside the EU, the transfer relies on Chapter V GDPR, in particular the EU-US Data Privacy Framework or standard contractual clauses.

7. Personal data breaches

1. We notify the organiser of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, by e-mail to the organisation's owners, with the information under Art. 33(3) GDPR as far as available.
2. We help the organiser notify the supervisory authority and data subjects. The organiser decides about notifications.

8. Information and audits

1. We provide the information needed to show compliance with Art. 28 GDPR on request.
2. The organiser or an auditor bound to confidentiality may carry out an audit announced at least 30 days in advance, at most once a year and at the organiser's cost, except after a breach or when a supervisory authority requires it.

9. The organiser's obligations

1. The organiser is responsible for the lawfulness of processing, for its privacy notice to applicants and jurors and for the retention period it sets.
2. The organiser gives access to its organisation only to people who need it and removes it when they no longer do.
3. The organiser is responsible for data it exports, downloads or sends outside Juryline.

10. End of the agreement

1. The agreement ends when the organiser's organisation is deleted or when the service ends under the terms of use.
2. Before the end the organiser can export its data. Within 30 days after the end we delete the organiser's personal data, unless EU or Slovak law requires us to keep it. Backups are overwritten within their regular cycle.

11. Final provisions

1. Processing under this agreement is part of the Juryline service and has no separate fee.
2. The parties are liable under Art. 82 GDPR and Slovak law.
3. The agreement is concluded electronically (Art. 28(9) GDPR) when the organiser publishes a programme and confirms that it accepts the terms and this agreement. We record the version, the time and the account that confirmed it.
4. If the organiser is a public body that must publish contracts, it publishes this agreement itself.
5. On data protection, this agreement takes precedence over the terms of use. Annexes 1 and 2 are part of it.

Annex 1. Technical and organisational measures

• Location: database, files and the app in the EU (Frankfurt, Germany).
• Encryption: in transit with TLS and HSTS; at rest by our hosting providers.
• Access control: row level security in the database decides what each person can read and change. Organisers see their own programmes; jurors see only applications assigned to them and never hidden fields; applicants see only their own applications. These rules are tested automatically for every role.
• Sign-in: no passwords; one-time codes and personal links sent by e-mail; sessions end after 30 days without use.
• Files: private storage, downloads through links valid 5 minutes after a permission check, file type verified from content, size limit 25 MB.
• Integrity: scores, screening decisions, conflict declarations and results decisions cannot be overwritten; changes are added as new records. Protocols are sealed with a SHA-256 hash and a verification code.
• Support access: only in recorded, time-limited, read-only support sessions visible to the organiser.
• Audit log: exports, protocol downloads, role changes, support sessions and billing events, kept 24 months.
• Deletion: automatic, daily, by the retention period of each programme.
• Backups: daily database backups by our hosting provider, kept for 7 days.
• Abuse protection: request limits with pseudonymous keys kept at most 2 days.
• AI: programme data is never sent to AI services.

Annex 2. Subprocessors

Version of 27 October 2026.