Data Processing Agreement

1. Definitions

• "Controller" means the agency, independent artist, or other organisation that has subscribed to Agency Assistant and determines the purposes and means of processing personal data entered into the platform.
• "Processor" means Agency Assistant, which processes personal data on behalf of and under the instructions of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
• "Processing" has the meaning given in Article 4(2) GDPR.
• "Data Subject" means the individual to whom personal data relates.
• "Sub-processor" means any third party engaged by the Processor to carry out processing activities on behalf of the Controller.
• "Supervisory Authority" means the competent data protection authority in the relevant jurisdiction.

2. Subject matter and duration

The Processor shall process personal data on behalf of the Controller for the duration of the Controller's active subscription to the Agency Assistant platform. Processing continues until the Controller's account is terminated and any applicable data retention period has elapsed.

3. Nature and purpose of processing

The Processor provides a booking and artist management platform. Processing carried out on behalf of the Controller includes:

• Storing, organising, and retrieving booking, contract, and invoice records entered by the Controller.
• Sending transactional emails (contract notifications, invoice reminders, advancing requests, portal invitations) using the contact data provided by the Controller.
• Making booking and advancing information available to authorised workspace members, artists through the Artist Portal, and promoters or document recipients through shared documents and links.
• Supporting invoice payments through Stripe when the Controller enables online payments. Agency Assistant also uses Stripe for its own subscription billing; operating accounts and subscriptions is described separately in the Privacy Policy.
• Providing hosting, database and file storage, authentication, and security measures needed to operate the workspace.
• Synchronizing booking and hold events with a selected Google Calendar when a user authorizes the optional connection.
• Providing AI-assisted drafting, analysis and document review when users request those features, including the assistant's review of authorized contract attachments. Requests, extracted document text and relevant workspace content may be processed by OpenAI through the Replit AI integration.

The Processor shall process personal data only for these purposes and only on the documented instructions of the Controller, unless required to do so by applicable law. The Processor shall promptly inform the Controller if, in its opinion, an instruction infringes applicable data protection law.

Google Calendar information is used only to provide and maintain requested calendar features, not for advertising, sale, or training generalized AI or machine-learning models. Human access is limited to consent for a specific purpose, necessary security or abuse investigations, or applicable law. The Privacy Policy's Google Calendar section describes the permissions and Limited Use commitments.

4. Categories of personal data

The following categories of personal data may be processed under this DPA:

• Identity data: names of artists, promoters, venue contacts, and staff members.
• Contact data: email addresses, phone numbers, and mailing addresses of the above.
• Professional data: job titles, company names, VAT numbers, and contractual roles.
• Financial data: performance fees, invoice amounts, payment references, and bank details stored on invoices (not full payment card numbers, which are processed exclusively by Stripe).
• Logistical data: travel itineraries, hotel details, rider requirements, and day-of-show information relating to artists and their touring parties.
• Account data: login credentials and session information for staff users, managed via Clerk.
• Communications: messages exchanged between the Controller's staff and promoters or artists through the platform's messaging features.
• Calendar connection data: calendar identifiers, names and access permissions, encrypted OAuth access and refresh tokens, event references and synchronization status. Synced booking and hold events may contain titles, dates, times, locations, descriptions and links.
• AI feature content: user requests, conversation history, extracted text from documents reviewed by the assistant and relevant workspace records needed for the requested feature.

The Processor does not knowingly process special categories of personal data (Article 9 GDPR) or personal data of children under the age of 16. The Controller is responsible for ensuring that no such data is entered into the platform.

5. Categories of data subjects

• Staff members and agents employed by or contracted to the Controller.
• Artists managed or represented by the Controller.
• Promoters, venue operators, and their team contacts with whom the Controller conducts business.
• Third parties (e.g. touring crew, guests) whose details are entered into booking or advancing records by the Controller.

6. Obligations of the Processor

In accordance with Article 28 GDPR, the Processor shall:

1. Process only on instructions. Process personal data only on the documented instructions of the Controller (including as set out in this DPA and in the Terms of Service) and not for any other purpose.
2. Ensure confidentiality. Ensure that all personnel authorised to process personal data are bound by appropriate confidentiality obligations, whether by contract or statutory duty.
3. Implement appropriate security. Implement technical and organisational measures appropriate to the risk of processing, in accordance with Article 32 GDPR. See Section 9 for specifics.
4. Respect sub-processor conditions. Not engage any sub-processor without the Controller's general prior authorisation (granted by acceptance of this DPA, subject to Section 7) and impose equivalent data protection obligations on all sub-processors.
5. Assist with data subject rights. Assist the Controller, by appropriate technical and organisational measures, in fulfilling its obligations to respond to data subject requests under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).
6. Assist with compliance obligations. Assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor.
7. Delete or return data. At the Controller's choice, delete or return all personal data to the Controller after the end of the service, and delete existing copies unless retention is required by applicable law.
8. Provide audit assistance. Make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits or inspections conducted by the Controller or an auditor mandated by the Controller, subject to reasonable advance notice and confidentiality obligations.

7. Sub-processors

The Controller grants general authorisation for the Processor to engage the sub-processors listed below. The Processor shall notify the Controller of any intended changes (additions or replacements) with reasonable advance notice, giving the Controller the opportunity to object. The Processor shall impose data protection obligations no less protective than those set out in this DPA on each sub-processor.

This list describes services used by the platform, not a statement that each provider acts solely as a sub-processor for every activity. Provider roles depend on the service and the Controller's configuration; this includes Google Calendar connected by a user and Stripe's payment services. Contact us for the applicable provider roles, processing locations and transfer safeguards. No particular hosting region or executed vendor agreement is asserted by this list. The Processor's obligations under Sections 6, 7 and 12 remain unchanged.

8. Data subject rights

Where a data subject makes a request to the Processor to exercise their rights under Chapter III GDPR (e.g. a request for access or erasure), the Processor shall promptly forward that request to the Controller and shall not respond to the data subject directly, except to confirm receipt and that the request has been forwarded, unless the Controller authorises otherwise. The Processor shall assist the Controller with fulfilling such requests by providing access to relevant data held within the platform within a reasonable timeframe.

9. Security measures

Taking into account the nature, scope, context, and purposes of processing, and the risks to the rights and freedoms of data subjects, the Processor maintains the following technical and organisational security measures:

• Encryption in transit: all data transmitted between clients and the platform is protected by TLS (HTTPS). Unencrypted connections are not permitted.
• Encryption at rest: databases and storage are encrypted at rest by the hosting provider.
• Access control: staff accounts have role-based permissions. Production systems are accessible only to authorised personnel. API keys and secrets are stored as environment variables and never in source code.
• Data isolation: each Controller's data is logically isolated at the application layer. Queries are scoped to the Controller's workspace; cross-tenant access is not possible through normal application flows.
• Authentication: account authentication is managed by Clerk, supporting secure session management and multi-factor authentication.
• Incident response: the Processor maintains procedures for detecting, investigating, and responding to security incidents, including personal data breaches.

A fuller description of security practices is available on the Security page.

10. Personal data breaches

In the event that the Processor becomes aware of a personal data breach (as defined in Article 4(12) GDPR) affecting data processed under this DPA, the Processor shall notify the Controller without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. The notification shall include, to the extent available at the time: a description of the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences of the breach, and the measures taken or proposed to address the breach. The Processor shall cooperate with the Controller to enable the Controller to fulfil its notification obligations to the Supervisory Authority and affected data subjects.

11. Data return and deletion

Upon termination or expiry of the Controller's subscription, the Controller may request an export of their data in a machine-readable format (CSV / JSON) within 30 days of termination. After this period, or upon the Controller's written instruction, the Processor shall securely delete all personal data processed under this DPA, except where retention is required by applicable law (for example, financial records required to be kept for tax purposes). The Processor shall confirm deletion in writing upon request.

Disconnecting Google Calendar is separate from deleting a workspace. Through Settings → Notifications → Google Calendar sync, the app attempts to remove events it created for that workspace before deleting the stored connection and tokens. If Google cannot be reached or event cleanup fails, the connection can remain pending and require a retry. Unrelated calendar events are not intentionally removed, and disconnecting does not delete workspace booking records.

Users can also revoke access through their Google Account connections. Revocation stops future authorized access but does not itself delete stored Agency Assistant data or events already in Google Calendar. Contact us to request deletion of stored connection information.

The Privacy Policy describes general retention, including backup copies that may remain until their normal retention cycle ends. Those general descriptions do not extend or replace the Controller's rights or the Processor's deletion and return obligations under this DPA. Contact us for the handling of retained records, provider-held copies and backups relevant to a deletion request.

12. International data transfers

Service providers may process personal data outside the European Economic Area (EEA) or the UK. Where personal data is transferred to such sub-processors, the Processor shall ensure that appropriate safeguards are in place, including the EU Standard Contractual Clauses (Commission Decision 2021/914) or the UK's International Data Transfer Agreement, as applicable. Details of the transfer mechanisms used by each sub-processor are available from the Processor on request.

13. Audit rights

The Controller may request, no more than once per calendar year (except where required by a Supervisory Authority), written confirmation that the Processor is complying with this DPA. The Processor shall respond to such requests within 30 days. On-site audits or inspections may be conducted by the Controller or a mandated third-party auditor subject to: (a) at least 30 days' written notice; (b) agreement on scope, timing, and confidentiality; and (c) reasonable compensation to the Processor for time and resources involved.

14. Controller responsibilities

The Controller acknowledges that it is responsible for:

• Ensuring that it has a lawful basis for processing the personal data it enters into the platform.
• Providing appropriate privacy notices to data subjects whose data it enters into the platform.
• Ensuring that personal data entered into the platform is accurate and limited to what is necessary for the stated purposes.
• Not entering special category data or data relating to children unless it has established an appropriate legal basis and implemented necessary safeguards.
• Ensuring that its own use of the platform's features (e.g. messaging, email dispatch) complies with applicable law.

15. Liability

Each party shall be liable for its own violations of applicable data protection law. Where both parties are responsible for a loss or damage suffered by a data subject, liability shall be apportioned according to each party's degree of fault. The total aggregate liability of the Processor under this DPA is subject to the limitation of liability set out in the Terms of Service.

16. Governing law

This DPA is governed by the laws of the Netherlands. Any disputes arising under this DPA shall be subject to the exclusive jurisdiction of the competent courts in the Netherlands. Where the GDPR applies, the lead Supervisory Authority for Agency Assistant is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). The Controller's own Supervisory Authority may also have jurisdiction with respect to the Controller's processing activities.

17. Order of precedence

In the event of any conflict between this DPA and the Terms of Service with respect to the subject matter of data protection, this DPA shall prevail. In all other respects, the Terms of Service shall govern.

18. Contact and execution

This DPA comes into effect automatically when the Controller accepts the Terms of Service. No separate signature is required; acceptance of the Terms of Service constitutes acceptance of this DPA.

For questions about this DPA, data protection matters, or to submit a data subject request, contact our Data Protection contact at hello@agency-assistant.app.