Data Processing Addendum
Data Processing Addendum (DPA)
1. Scope, precedence and roles
This DPA forms part of the B2B agreement between the customer as controller/business and Daniel Rödl as processor/service provider where ProfileOS processes personal data on the customer’s documented instructions. It lasts for the relevant processing under the main agreement. Mandatory data-protection law prevails; otherwise this DPA prevails over conflicting processing terms in the main agreement.
2. Processing details
The subject is hosting and operating ProfileOS. The nature and purpose are storage, organisation, transmission, retrieval, support, security, backup and deletion of customer-controlled workspace, model, contact, booking, document, chat and media data. Data subjects may include customer staff, models or talent, people shown in media, customer contacts and chat participants. Data may include identification, contact, professional, booking, communication, media, account, consent and technical data. Special-category data may occur only where the customer lawfully chooses to process it and gives compliant instructions.
3. Instructions and compliance
The Provider processes personal data only on documented instructions, including those in the agreement and the customer’s configured use, unless law requires otherwise. The Provider will notify the customer before legally required processing unless prohibited and will inform the customer if an instruction appears to violate applicable data-protection law. The customer is responsible for lawful instructions, transparency, data minimisation, legal bases and rights in uploaded data.
4. Confidentiality and security
Authorised personnel are bound by confidentiality. The Provider maintains risk-appropriate technical and organisational measures, including identity and access management, least privilege, tenant controls, transport security, protected storage where offered, backups, change and vulnerability management, logging, incident response and recovery procedures. Measures may evolve without materially reducing overall protection.
5. Subprocessors
The customer gives general authorisation for the Provider’s subprocessors; the current list is available on request. The Provider will impose materially equivalent data-protection duties and remain responsible for its subprocessors as required by applicable law. Material additions or replacements will be notified through the configured business contact or service notice with a reasonable opportunity to object on legitimate data-protection grounds. If no reasonable solution exists, either party may terminate the affected service according to the main agreement.
6. Assistance and incidents
Taking account of the processing and information available, the Provider will reasonably assist with data-subject requests, security, breach assessment and notification, data-protection impact assessments, prior consultation and regulator enquiries. The Provider will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data and provide available information in phases. Notification is not an admission of fault.
7. Return, deletion, audits and evidence
At the end of service, the Provider will delete or return customer personal data as selected or provided by the service, unless law requires retention. Backup deletion follows the documented cycle. On reasonable written request, the Provider will supply information necessary to demonstrate compliance. Audits must be proportionate, protect other customers and security, use existing independent reports first where suitable, and avoid unreasonable disruption; mandatory audit rights remain unaffected.
8. International transfers and government requests
Where required, the parties will incorporate the applicable approved transfer clauses or addendum and supplementary measures. The Provider will assess legally binding government requests, redirect the requester to the customer where lawful, disclose only what is legally required and notify the customer unless prohibited.
9. Regional annexes
EU / EEA
For processing subject to the GDPR, the requirements corresponding to Article 28 apply. The customer is controller and the Provider processor unless the facts require another role. The parties will use an applicable Chapter V transfer mechanism where required.
United Kingdom
For processing subject to UK data-protection law, controller and processor obligations apply with the necessary UK terminology. Where required, an approved UK transfer addendum or other valid safeguard will be used.
United States
Where state privacy law applies, the Provider acts as processor, service provider or contractor for covered customer personal data; it will not sell or share that data for cross-context behavioural advertising or retain, use or disclose it outside the contracted business purposes except as legally permitted. Applicable state-specific terms prevail.
Canada
The parties will support comparable protection, accountability, safeguards, access and breach duties required by applicable Canadian privacy law. The customer remains responsible for consent or another lawful authority.
Australia
The parties will support applicable Australian Privacy Principles, security and eligible data-breach duties. Cross-border disclosures must be managed according to the customer’s and Provider’s actual roles.
Other countries
Mandatory local processor, localisation, transfer or data-subject requirements apply to the extent they govern the processing. No regional note represents a guarantee that one contractual mechanism is sufficient in every country.
10. Processing annexes
Annex A — Processing
The subject, duration, nature, purposes, data types and data-subject categories are those described in Sections 1–3 for the customer’s actual use of ProfileOS.
Annex B — Technical and organisational measures
The measures in Section 4 form the baseline technical and organisational measures. The Provider documents its detailed controls, reviews them according to risk and makes appropriate evidence available on request.
Annex C — Hosting and approved subprocessors
The current list is available on request.
Annex D — International transfers
Information on transfer locations and safeguards is available on request.
11. Liability and contact
Liability is governed by the main agreement subject to mandatory data-protection law. Nothing in this DPA limits rights or liability that cannot lawfully be limited. Privacy contact: daniel.roedl@getprofileos.com. Governing law and venue follow the main agreement unless mandatory privacy law requires otherwise.