Standard SimplyRaffle Article 28 GDPR DPA, incorporating EU Standard Contractual Clauses Module 2 (controller-to-processor). Provided in template form for school districts, dioceses, EU-based nonprofits, and other institutional controllers who need a signed DPA on file. To execute, contact [email protected] — we will return a signed version with your organization's details filled in within 5 business days.
Template status: This document is intended for review by your legal counsel. Final terms incorporate the EU Standard Contractual Clauses (Commission Decision 2021/914) by reference. Fields shown in yellow highlight are filled in at the time of signature. SimplyRaffle is currently operated as a sole proprietorship by its founder. Until a corporate entity is formed, the Processor party in an executed DPA will be identified as the founder doing business as SimplyRaffle, San Francisco, California, USA.
This Data Processing Agreement (“DPA”) is entered into between:
This DPA supplements the SimplyRaffle Terms of Service & Privacy Policy and governs Processor’s processing of Personal Data on behalf of Controller. Defined terms not specifically defined here have the meanings given in GDPR Article 4 (Regulation (EU) 2016/679).
Subject matter: Processor’s processing of Personal Data necessary to provide the SimplyRaffle raffle platform to Controller, including event setup, participant registration, Magic Link delivery, draw execution, audit-log generation, and post-event reporting.
Duration: This DPA remains in effect for the duration of Controller’s active SimplyRaffle subscription and the post-event retention period defined in Section 9.
Processor processes Personal Data solely to deliver the platform Controller has purchased: hosting Controller’s event, accepting participant entries, sending raffle-related communications (invitations, reminders, draw notifications), executing the random draw, generating an audit log of the draw, and providing Controller with downloadable reports of results.
Personal Data:
Data subjects: Controller’s authorized administrators and event participants. Where Controller uses AI features, data subjects may also incidentally include persons depicted in prize photos submitted by Controller.
Processor does not process Special Category data (Article 9), criminal-conviction data (Article 10), or data concerning children under 13 (see Section 12).
Article 28(3)(a): Processor processes Personal Data only on documented instructions from Controller, including with regard to international transfers. Controller’s instructions are set forth in: (a) this DPA, (b) the SimplyRaffle Terms of Service, and (c) Controller’s use of the platform’s administrative controls. If Processor is required by Union or Member State law to process beyond these instructions, Processor will inform Controller of that legal requirement before processing (unless that law prohibits notice on important grounds of public interest).
Article 28(3)(b): Processor ensures that persons authorized to process the Personal Data (including employees, contractors, and authorized subprocessor personnel) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Article 28(3)(c) and Article 32: Processor maintains the following technical and organizational security measures. Specific implementations vary by hosting environment (see Section 8); the measures below apply consistently across environments.
<tenant-slug>/) through a single helper function. Bucket-level credentials are not scoped per-tenant; tenants do not receive direct R2 credentials. Processor is transparent that this is logical-isolation; Controllers requiring per-tenant IAM-scoped storage credentials should advise Processor before execution.Article 28(3)(d) and 28(2): Controller grants Processor general authorization to engage the subprocessors listed below. Subprocessors are organized by category: Universal (engaged for every tenant), Conditional Hosting (one of three is engaged depending on Controller's plan and provisioning), and AI (engaged only when the corresponding optional feature is used).
Universal subprocessors:
simplyraffle-uploads-prod, key-prefixed by tenant). EU-US Data Privacy Framework certified; Global CBPR and Global PRP certified. SOC 2 Type II + ISO 27001. Cloudflare DPA.Conditional hosting subprocessors (which one is engaged depends on Controller's plan):
AI subprocessors (engaged only when the corresponding optional feature is used):
Onward transfers: Each subprocessor's onward processing is governed by their own DPA, which incorporates EU SCCs Module 3 (processor-to-subprocessor) where applicable. Processor flows the same data-protection obligations to subprocessors as imposed on Processor by this DPA.
Subprocessor change notice: For Universal subprocessors, Controller's general authorization extends to changes notified by at least 30 days' advance written notice. For Conditional Hosting subprocessors, Controller's authorization is specific to the platforms listed above; changes within this category (e.g., adding a fourth hosting target) require at least 14 days' written notice. For AI subprocessors, Controller's authorization extends to the named vendors only; replacing or adding a new AI vendor requires at least 30 days' notice. Controller may object to a new subprocessor within the applicable notice period; if the objection cannot be resolved, Controller may terminate the affected services without penalty. Controller acknowledges that objecting to a Conditional Hosting or AI subprocessor may limit or eliminate availability of the associated feature or provisioning tier.
Article 28(3)(e): Processor will, taking into account the nature of the processing, assist Controller by appropriate technical and organizational measures, insofar as possible, in fulfilling Controller’s obligation to respond to requests from data subjects exercising their GDPR Chapter III rights (access, rectification, erasure, restriction, objection, portability).
Processor responds to verified data-subject requests sent to [email protected] within Article 12(3)’s one-month window. If a request is received directly by Processor but pertains to data Processor processes on behalf of Controller, Processor will forward the request to Controller without undue delay.
Article 28(3)(f) and Article 33-34: Processor will:
Article 28(3)(g): Upon termination of Controller’s services with Processor (or earlier on Controller's documented request), Processor will, at Controller's election, either delete or return all Personal Data and existing copies, except to the extent applicable law requires storage of the Personal Data.
Retention modes during active engagement. Processor's platform supports two retention configurations:
The retention mode applicable to Controller's account is identified in Controller's admin settings and, where material to Controller's compliance posture, may be specified as an annex to this DPA. Processor will confirm the active retention mode upon request.
For Community (free) tier accounts that go inactive: a reminder email is sent, followed by a grace period, then permanent deletion of the account and all associated data, regardless of configured retention mode.
On Controller’s documented request, Processor will provide an export of Controller’s data in a structured, commonly-used format (CSV) before deletion, where technically feasible.
Processor certifies deletion on Controller's written request.
Article 28(3)(h): Processor will make available to Controller all information necessary to demonstrate compliance with the obligations in this DPA. On reasonable prior written notice (minimum 30 days), Controller may conduct an audit, at Controller’s expense, of Processor’s compliance with this DPA. Processor may satisfy this obligation by providing Controller with the relevant portions of its most recent third-party security audit, where applicable. Audit cooperation shall not unduly disrupt Processor’s normal business operations and shall be limited to one audit per calendar year except where a breach has occurred or regulatory inquiry is pending.
Processor does not knowingly collect personal information from children under 13. Controller represents and warrants that, where Controller’s event involves participants under 13 (e.g., school events), Controller has obtained verifiable parental consent before submitting any child’s personal information through the platform. If Processor becomes aware of unsolicited child data in its systems, Processor will delete it without undue delay and notify Controller.
AI features and incidental imagery: Where Controller's events involve participants or settings where minors may be present (e.g., school events, youth organization events) and Controller uses the AI prize-description feature (Google Gemini, see Section 8), Controller represents that it has assessed and complied with all applicable legal requirements regarding transmission of imagery that may incidentally capture minors to a third-party AI processor, including without limitation COPPA, FERPA (where applicable to educational records), and any applicable state student-data-privacy laws. If Controller's institutional policies or applicable law prohibit transmission of images that may contain minors to AI services, Controller should not use the AI prize-description feature for those events; descriptions can be entered manually without invoking any AI processing.
All personal data is processed in the United States. Processor does not transfer personal data outside the US. Where Controller is established in the EU/EEA, UK, or Switzerland, transfers from Controller to Processor and onward to subprocessors are subject to the following safeguards:
Each party’s liability under this DPA is subject to the limitation-of-liability provisions in the underlying SimplyRaffle Terms of Service. Where the SCCs include their own liability provisions (Clauses 12 of the EU SCCs), those provisions apply to the transfers governed by them.
This DPA takes effect when signed and remains in force for the duration of Controller’s relationship with Processor plus the retention period in Section 11. Either party may terminate the underlying Terms of Service in accordance with their provisions; this DPA terminates with them, subject to the deletion obligations in Section 11.
This DPA is governed by the laws of the State of California, USA, except that for transfers governed by the EU SCCs, the governing-law provisions of the SCCs themselves (Clause 17, designating the law of an EU Member State) prevail. For UK SCCs, the laws of England & Wales prevail for those transfers.
SimplyRaffle
Operated by [Legal Entity]
Address: [Business Address]
By: ____________________________
Name: [Print Name]
Title: [Title]
Date: ____________________
[Organization Name]
Address: [Address]
By: ____________________________
Name: [Print Name]
Title: [Title]
Date: ____________________
Attorney review note: This template is provided in good faith based on Article 28 GDPR, EU SCCs (Commission Decision 2021/914), and standard SaaS-processor practice. SimplyRaffle recommends that institutional Controllers have this DPA reviewed by their data-protection or legal counsel before execution. The final executed version will incorporate the EU SCCs by direct attachment or by reference, depending on Controller’s preference.