Lineup Lab

Data processing agreement

Version [1.0] · Last updated: [date]

Draft for legal review. Items highlighted like this must be completed, and the whole document should be checked by a solicitor before Lineup Lab is sold.

This agreement forms part of the terms of service between the customer (the controller) and [Nicoby Studios — full legal name, company number, registered address] (the processor) for Lineup Lab. It sets out the terms required by Article 28 of the UK GDPR (and the EU GDPR where it applies).

1. Details of the processing

Subject matter and purposeProviding Lineup Lab: storing the customer's shows, performer roster, availability, lineups, fees and notes; sending emails and portal links on the customer's instructions; backups and support.
DurationFor the term of the agreement, plus the deletion periods in section 8.
Data subjectsThe customer's team members; performers on its roster; event managers and client contacts; any other person the customer adds.
Personal dataNames (stage and real names), email addresses, phone numbers, availability and responses, booking details, fees and costs, free-text notes, sign-in and activity records.
Special category dataNot required. The customer should not enter special category data (e.g. health information) into free-text fields.

2. The processor's obligations

  1. Process personal data only on the customer's documented instructions — these terms and the customer's use of the service are its instructions — unless the law requires otherwise, in which case we will tell the customer first unless the law prevents it.
  2. Ensure everyone authorised to access the data is bound by confidentiality.
  3. Apply the security measures in Schedule 1.
  4. Help the customer respond to data-subject requests, including by providing a full data export on request.
  5. Help the customer meet its obligations on security, breach notification, impact assessments and consultation with the ICO, taking into account the information available to us.
  6. Notify the customer without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting its data.
  7. Make available the information needed to show compliance with this agreement and allow for reasonable audits, on reasonable notice and at the customer's cost.

3. Support access

We access a customer's workspace only to provide support the customer has asked for, to keep the service secure, or where the law requires it. Each support access is recorded in the customer's own Activity feed.

4. Sub-processors

The customer gives general authorisation for us to use the sub-processors below. We will give at least 30 days' notice of any new sub-processor, and the customer may object on reasonable grounds.

Sub-processorPurposeLocation
Railway CorporationApplication and database hosting[EU West (Netherlands) — confirm]; US parent company
Sendinblue SAS (Brevo)Transactional emailEU (France)
Google Ireland / Google LLCEncrypted off-site backups (Google Drive)[EU / US — if enabled]

5. International transfers

Where personal data is transferred outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with any supplementary measures needed.

6. The customer's obligations

The customer is responsible for having a lawful basis for the personal data it adds, for giving its performers and contacts appropriate privacy information, and for the accuracy of that data.

7. Liability

Each party's liability under this agreement is subject to the limits in the terms of service, except where the law does not allow it.

8. Return and deletion

At the end of the agreement the customer can download all of its data for 30 days. We then delete the workspace and its data, and delete it from backups within [90] days, unless the law requires us to keep it.

Schedule 1 — Security measures