Data Processing Agreement
Last updated 22 October 2026
This agreement applies whenever an organiser (you, the controller) runs an event on Marshalmap. It sets out how Nordcam AS, organisation number 938 070 040, Olav Magnussons veg 16D, 7046 Trondheim, Norway (Marshalmap, the processor) handles the personal data in your events, as required by Article 28 of the GDPR. It forms part of your agreement with us when you create or run an event. Account, agency and billing data are covered by our Privacy Policy instead.
1. What is processed
| Details | |
|---|---|
| Purpose | Planning and running events: a shared live venue map, teams and positions, incidents, tasks, written reports, photos, crew chat and the post-event debrief. |
| People concerned | The organiser's staff, volunteers and contractors working the event, and people mentioned in incidents (for example, attendees who needed help). |
| Types of data | Names, email addresses, roles, team and position assignments, incident and task details with their status history, written reports, photos, chat messages. |
| Special categories | Incident details may include health information (for example, a medical incident). The organiser decides whether and how much to record. |
| Duration | For as long as the event exists on Marshalmap: until the organiser deletes it, or automatically 6 months (Free) or 24 months (paid) after the event ends. |
2. Our commitments as processor
- We process event data only to provide Marshalmap and on your documented instructions, which are given through how you set up and use the service.
- Everyone at Marshalmap who can access event data is bound by confidentiality.
- We keep appropriate security measures in place: EU data storage, encryption in transit, role-based access within each event, and read-only locking of archived events.
- We help you answer requests from people exercising their GDPR rights, and with security and impact assessments where our service is involved.
- We tell you without undue delay after becoming aware of a personal data breach affecting your events, with the information you need to meet your own obligations.
- We make available the information needed to show we meet this agreement, and answer reasonable audit questions.
3. Sub-processors
You authorise us to use the following sub-processors. We bind each of them to data protection terms at least as protective as these, and remain responsible for them.
| Service | Purpose | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | EU (Frankfurt, Germany) |
| Lovable | Hosting the app, error reports and visitor statistics | Sweden; the app is delivered through Cloudflare's network in Europe and worldwide |
| Paddle | Payments, invoices and tax (merchant of record) | EU and United States |
| Resend | Emails such as deletion warnings | EU region |
| "Sign in with Google", only if you choose it | Global |
We will announce new or replaced sub-processors on this page and in the app at least 30 days in advance; if you object, you can stop using the service and delete your events. Transfers outside the EU/EEA rely on an EU adequacy decision or the EU Standard Contractual Clauses.
4. When processing ends
You can export each event's PDF debrief and incident log at any time and delete the event whenever you choose. Otherwise events are deleted automatically at the end of the period above, after a warning to event admins 30 days before. Deleted data disappears from backups and server logs within 7 days. Payment records are kept separately for 5 years for bookkeeping and are not event data.
5. Your responsibilities as controller
- Have a lawful basis for the data you and your crew add, and tell your crew how their data is used.
- Record only what you need, especially health information in incidents.
- Invite only people who should see the event, and remove them when they no longer need access.
6. General
This agreement follows Norwegian law. If it conflicts with other terms between us about personal data in events, this agreement wins. Questions: privacy@marshalmap.com.