DATA PROCESSING AGREEMENT

1. ROLES

For data the Customer uploads or generates about its own artists, staff, roster members, applicants or ticket holders, the Customer is the controller and ReggaeVerse OS is the processor. For account, billing, security and product-improvement data about the Customer itself, ReggaeVerse OS is a controller and the Privacy Notice applies.

2. SUBJECT MATTER AND DURATION

Processing lasts for the term of the Customer's use of the platform and any wind-down period, and covers the operation of the features the Customer chooses to use — roster and organisation management, projects and splits, events and ticketing, bookings, rentals, distribution, courses and messaging.

3. NATURE, PURPOSE AND DATA

• Data subjects: the Customer's staff, artists, collaborators, applicants, students, buyers and attendees.
• Categories: identity and contact details, account identifiers, profile and content data, rights and split information, transaction and attendance records, messages, technical and usage data.
• Purpose: providing, securing and supporting the platform in accordance with the Customer's documented instructions.
• No special category data is requested; Customers should not upload it.

4. CUSTOMER INSTRUCTIONS

We process personal data only on the Customer's documented instructions, which include use of the platform's features and any support requests, unless required otherwise by law. We tell the Customer if we believe an instruction infringes data protection law.

5. CONFIDENTIALITY AND SECURITY

Personnel with access are bound by confidentiality. We implement the technical and organisational measures described in our Information Security Policy, including row-level access control, encryption in transit and at rest, least-privilege administration and logging.

6. SUBPROCESSORS

The Customer gives general authorisation for the subprocessors listed on the Subprocessor List. We impose equivalent data protection obligations on each of them and remain liable for their performance. We publish changes to that list and give the Customer the opportunity to object on reasonable data protection grounds.

7. INTERNATIONAL TRANSFERS

Where personal data leaves the UK/EEA we rely on an adequacy decision, the EU-US Data Privacy Framework where the recipient is certified, or Standard Contractual Clauses with the UK Addendum, plus supplementary technical measures.

8. ASSISTANCE

Taking into account the nature of processing, we assist the Customer with data subject requests, data protection impact assessments, prior consultations and security obligations. If a data subject contacts us directly about Customer data, we refer them to the Customer.

9. BREACH NOTIFICATION

We notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data, with the information reasonably available to us, and follow our Incident Response Policy.

10. DELETION AND RETURN

On termination the Customer may export its data. We delete or anonymise Customer personal data within 90 days of the end of the service, except where retention is required by law or needed for tax, accounting or dispute records.

11. AUDIT

We make available the information necessary to demonstrate compliance and allow for audits by the Customer or an independent auditor, on reasonable notice, no more than once a year unless required by a supervisory authority, subject to confidentiality and without compromising other customers' data.

12. PAYMENTS

Payments are processed by our Merchant of Record, Paddle.com, which acts as an independent controller for payment, tax and invoicing data. That processing sits outside this agreement.

13. ACCEPTING THESE TERMS

Business customers may request a countersigned copy at legal@reggaeverseos.com. Otherwise these terms apply automatically to the Customer's use of the platform.