Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Music Artist Manager ("Processor") and the Customer ("Controller") and sets out the terms that apply when Personal Data is processed by Music Artist Manager on behalf of the Customer.

1. Definitions

• "Data Protection Laws" means all applicable data protection and privacy laws and regulations, including the UK GDPR, the EU GDPR, and the UK Data Protection Act 2018.
• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller.
• "Sub-processor" means any third party appointed by the Processor to process Personal Data on behalf of the Controller.

2. Processing of Personal Data

2.1. Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller, Music Artist Manager is the Processor, and that Music Artist Manager will engage Sub-processors pursuant to the requirements set forth in Section 4.

2.2. Customer's Instructions. Music Artist Manager will only process Personal Data in accordance with the Customer's documented instructions, unless required by law to do otherwise. The app's functionality (e.g., uploading files, creating contacts, sending invoices) constitutes the Customer's documented instructions.

2.3. Nature and Purpose of Processing. The processing is for the purpose of providing the Music Artist Manager SaaS platform, including project management, financial ledger tracking, contact management, and file storage.

3. Security and Confidentiality

3.1. Security Measures. Music Artist Manager implements and maintains appropriate technical and organisational security measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, theft, alteration, or disclosure. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest (AES-256).
• Strict logical access controls and principle of least privilege.
• Secure enterprise-grade infrastructure hosted within the UK/EU (Google Cloud Platform).

3.2. Confidentiality. Music Artist Manager ensures that its personnel engaged in the processing of Personal Data are informed of the confidential nature of the Personal Data and have executed written confidentiality agreements.

4. Sub-processors

The Customer grants Music Artist Manager general authorisation to engage Sub-processors to assist in providing the Services. Our primary Sub-processors include:

• Google Cloud Platform (Firebase) - Hosting, Database, and File Storage.
• Vercel - Frontend Application Hosting.
• Supabase - Relational Database Services.

Music Artist Manager will enter into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this DPA.

5. Data Subject Rights

Music Artist Manager provides the Customer with the necessary tools within the application dashboard (via the Data & Compliance settings page) to independently fulfill data subject requests, including:

• The ability to securely export a full archive of all Workspace data.
• The ability to execute a "Right to be Forgotten" wipe to permanently delete all records.

6. Data Deletion and Return

Upon termination or expiration of the Customer's account, or upon the Customer's explicit request via the application settings, Music Artist Manager will securely delete all Personal Data in its possession, save for any data required to be retained by applicable law.

7. Cross-Border Data Transfers

Music Artist Manager operates primarily within the United Kingdom and the European Economic Area (EEA). Any transfer of Personal Data outside the UK/EEA will only take place in compliance with Data Protection Laws, utilizing mechanisms such as Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA).

The WrightyMedia Agency Limited Details

Music Artist Manager is a product of The WrightyMedia Agency Limited, a company incorporated in England and Wales with registered number 15352083.

Registered Address:
Cornelius House
178/180 Church Road, Hove
East Sussex, BN3 2DJ