Data Processing Agreement

This DPA is between the label or business operating a Fannera workspace (the "Controller") and Fannera (company no. 17197430), registered office 20 Wenlock Road, London, N1 7GU, England (the "Processor").

The processing of personal data by the Processor on behalf of the Controller in connection with the Fannera fan-CRM service, for the term of the Controller's subscription.

Provision of the fan-CRM service: storing and organising fan contact details, purchases and engagement; sending broadcasts on the Controller's instruction; hosting the Controller's public artist, release and smart-link pages; and related analytics for the Controller.

Fan contact information (email address, and name where provided), city and location data where provided or derived, purchase and engagement history, and any other personal data the Controller chooses to input into the service.

The Controller's fans, customers, and marketing list members.

The Processor shall:

• process personal data only on the Controller's documented instructions, including with regard to transfers, unless required by law;
• ensure that persons authorised to process personal data are bound by confidentiality obligations;
• implement appropriate technical and organisational security measures per UK GDPR Article 32, including encryption in transit, access controls and row-level tenant isolation;
• assist the Controller, taking into account the nature of processing, in responding to data subject requests;
• assist the Controller with breach notification, data protection impact assessments and prior consultations where required;
• at the Controller's choice, delete or return all personal data on termination of the service, and delete existing copies unless law requires retention;
• make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, on reasonable notice.

The Controller gives general authorisation for the Processor to engage the sub-processors listed at fannera.com/sub-processors. The Processor will notify the Controller by email before engaging a new sub-processor, giving the Controller the opportunity to object on reasonable data protection grounds. Where an objection cannot be resolved, the Controller may terminate the subscription. The Processor remains fully liable for its sub-processors' performance.

Where personal data is transferred outside the UK, the Processor ensures a valid transfer mechanism is in place: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK–US Data Bridge where the importer participates. The mechanism applicable to each sub-processor is listed on the sub-processors page.

The Processor will notify the Controller of a personal data breach without undue delay and in any event within 48 hours of becoming aware of it, providing reasonable information about the nature of the breach, its likely consequences, and the measures taken or proposed to address it.

On termination of the subscription, the Controller may export its data (including fan data to CSV) for 30 days. After that window the Processor deletes the Controller's personal data within a further 30 days, except where retention is required by law.

Liability under this DPA is subject to the limitation of liability in the Terms of Service.

This DPA is governed by the laws of England & Wales, and the courts of England & Wales have exclusive jurisdiction.

Data protection queries: support@fannera.com.