Legal Terms >> Data Processing Addendum (DPA) for Processors and Sub-processors
Data Processing Addendum (DPA) for Processors and Sub-processors
Last Updated: February 11, 2026
This Data Processing Addendum (“DPA”) shall govern any services provided to Cigar & Bourbon Tickets LLC (“Cigar & Bourbon Tickets,” “we,” “us,” or “our”) by a third-party service provider (“you,” “your,” or “Vendor”) acting as a Processor or Sub-processor (the “Services”). You and Cigar & Bourbon Tickets shall each be referred to herein as a “Party” and together as “Parties.”
Cigar & Bourbon Tickets is a limited liability company organized under the laws of the State of Wyoming, with its principal place of business at 312 West 2nd Street, #3293, Casper, WY 82601 USA. Cigar & Bourbon Tickets operates a ticketing, registration, and membership platform for cigar and bourbon events in the United States.
This DPA is incorporated into and shall remain in effect for the term of any agreement between the Parties, including but not limited to any executed or click-through agreement or, if applicable, the duration of Services, or the processing of Cigar & Bourbon Tickets Data, whichever is later (the “Term”). The subject matter, nature, and purpose of the processing under this DPA is the provision of the Services under the Agreement, and the categories of personal data and categories of data subjects are those necessary to provide the Services under the Agreement, as described more fully in the Agreement. The Parties agree as follows:
1. Definitions
1.1. “Data Protection Laws” means all applicable data protection and privacy laws and regulations, including but not limited to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and any other applicable federal, state, or local data protection laws governing the processing of personal data under this DPA.
1.2. “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) that is processed by the Vendor on behalf of Cigar & Bourbon Tickets in connection with the Services. This includes any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
1.3. “Sub-processor” means any third-party processor engaged by the Vendor to process Personal Data on behalf of Cigar & Bourbon Tickets in connection with the Services.
2. Data Processing Obligations
2.1. Purpose and Instructions. The Vendor shall process Personal Data on behalf of Cigar & Bourbon Tickets solely for the purpose of providing the Services as outlined in the Agreement. The Vendor shall act only on the documented instructions of Cigar & Bourbon Tickets regarding the processing of Personal Data unless required to do otherwise by applicable law. If the Vendor is required by applicable law to process Personal Data other than as instructed by Cigar & Bourbon Tickets, the Vendor shall inform Cigar & Bourbon Tickets of that legal requirement before processing, unless prohibited by law. Any additional or alternative processing of Personal Data shall require prior written approval from Cigar & Bourbon Tickets.
2.2. Confidentiality. The Vendor shall ensure that its personnel engaged in the processing of Personal Data are subject to appropriate confidentiality obligations, whether by contract or statutory duty, and are trained on applicable data protection requirements.
2.3. Security Measures. The Vendor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage of Personal Data. Such measures shall include, as appropriate: (a) encryption of Personal Data in transit and at rest; (b) access controls limiting personnel access to Personal Data on a need-to-know basis; (c) regular testing and evaluation of security measures; and (d) incident response procedures.
2.4. Data Subject Rights. The Vendor shall assist Cigar & Bourbon Tickets in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under Data Protection Laws, including rights to access, correction, deletion, and data portability. The Vendor shall promptly notify Cigar & Bourbon Tickets (and in any event within 48 hours) if it receives any such requests directly from Data Subjects, and shall not respond to such requests directly unless authorized by Cigar & Bourbon Tickets.
2.5. Sub-processors. The Vendor shall not engage any Sub-processor without the prior specific written authorization of Cigar & Bourbon Tickets. In the event of authorization, the Vendor shall: (a) impose data protection obligations on the Sub-processor that are no less protective than those imposed on the Vendor under this DPA; (b) remain fully liable to Cigar & Bourbon Tickets for the acts and omissions of its Sub-processors; and (c) notify Cigar & Bourbon Tickets of any intended changes to Sub-processors, giving Cigar & Bourbon Tickets the opportunity to object to such changes.
2.6. Data Breach Notification. In the event of a Personal Data breach, the Vendor shall notify Cigar & Bourbon Tickets without undue delay and in any event within 72 hours after becoming aware of the breach. The notification shall include: (a) a description of the nature of the breach, including the categories and approximate number of Data Subjects and Personal Data records affected; (b) the likely consequences of the breach; (c) a description of the measures taken or proposed to address the breach and mitigate its effects; and (d) the name and contact details of the Vendor’s designated contact for further information.
2.7. Data Deletion and Return. Upon termination or expiration of the Agreement, or upon written request by Cigar & Bourbon Tickets, the Vendor shall, at Cigar & Bourbon Tickets’ election, securely delete or return all Personal Data processed under this DPA within 30 days, and certify in writing that it has done so. The Vendor may retain Personal Data only to the extent required by applicable law, and shall inform Cigar & Bourbon Tickets of any such retention requirement.
2.8. Audit and Compliance. The Vendor shall make available to Cigar & Bourbon Tickets all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by Cigar & Bourbon Tickets or an auditor mandated by Cigar & Bourbon Tickets. Such audits shall be conducted with reasonable notice and during normal business hours, and shall not unreasonably interfere with the Vendor’s operations.
3. Cigar & Bourbon Tickets Obligations
3.1. Compliance with Data Protection Laws. Cigar & Bourbon Tickets shall be solely responsible for ensuring that its instructions and use of the Services comply with Data Protection Laws, and that it has obtained all necessary consents or has a valid legal basis for the processing of Personal Data provided to the Vendor.
3.2. Notification of Changes. Cigar & Bourbon Tickets shall promptly notify the Vendor of any changes to its data processing instructions that may affect the Vendor’s obligations under this DPA.
4. Data Transfers
4.1. Personal Data shall be processed and stored within the United States unless otherwise agreed in writing by the Parties. The Vendor shall not transfer Personal Data outside the United States without the prior written consent of Cigar & Bourbon Tickets. If such transfer is authorized, the Vendor shall ensure that appropriate safeguards are in place as required by applicable Data Protection Laws.
5. Term and Termination
5.1. This DPA shall be effective as of the Effective Date of the Agreement and shall continue in force for the duration of the Term.
5.2. Termination of the Agreement shall automatically terminate this DPA, subject to the Vendor’s obligations regarding data deletion or return as described in Section 2.7.
5.3. The obligations of the Vendor regarding confidentiality, data deletion, and security shall survive termination of this DPA.
6. Liability
6.1. The Vendor shall be liable to Cigar & Bourbon Tickets for any damages arising from the Vendor’s breach of this DPA, including any failure to comply with Data Protection Laws in the processing of Personal Data.
6.2. The Vendor shall indemnify and hold Cigar & Bourbon Tickets harmless from any claims, losses, damages, liabilities, or expenses (including reasonable attorneys’ fees) arising from the Vendor’s breach of this DPA or any Data Protection Laws applicable to its processing of Personal Data.
7. Governing Law and Jurisdiction
7.1. This DPA shall be governed by and construed in accordance with the laws of the State of Wyoming and applicable federal laws of the United States, without regard to conflict of laws principles. Any dispute arising out of or in connection with this DPA shall be resolved through arbitration in accordance with the rules of the American Arbitration Association.
Contact
For questions regarding this DPA, please contact:
Cigar & Bourbon Tickets LLC
312 West 2nd Street, #3293
Casper, WY 82601 USA
Email: legal@cigarandbourbontickets.com