Data processing agreement

Annex 1 to the StripBoard Terms of Service. This English version is provided for convenience. In case of any discrepancy, the Polish version prevails.

§ 1. Parties and conclusion

1. This agreement is concluded between the Customer as defined in the Terms, as controller (the Controller), and Jakub Mączka, running a business under the name Jakub Mączka Production (Omka Production), al. Jana Pawła II 27, 00-867 Warsaw, Poland, tax ID (NIP) 7671628404, REGON 380683088, as processor (the Processor).
2. The agreement is concluded when the Terms are accepted on Account creation and also applies during the Testing period. At the Customer's request, the Processor will sign the agreement as a document signed by both parties.
3. Capitalised terms have the meaning given in the Terms; other terms have the meaning given in Regulation (EU) 2016/679 (GDPR).

§ 2. Subject matter, nature and purpose

1. The Controller entrusts the Processor with processing personal data contained in Customer Content to the extent and for the purpose necessary to provide the Service.
2. Processing consists of storing, organising, displaying, making data available to Users designated by the Controller, exporting (PDF, project file), sending emails initiated by Users, making backups and deleting data.
3. Data subjects: crew members and production collaborators; cast, talent and casting candidates; contact persons of clients, agencies, suppliers and locations; drivers and persons in transport plans; other persons named in production documents uploaded by the Controller.
4. Types of data: name, role and department, phone number, email address, call times and schedules, addresses of locations and pick-up points, image (casting photos and visual materials), notes and data contained in documents uploaded by the Controller.
5. The Controller may enter health information (e.g. allergies or contraindications relevant to safety on set) only to the minimum extent necessary for the safety of people on set, on the basis of a condition under Article 9(2) GDPR (in particular the person's explicit consent) and after informing that person. The Controller limits access to documents with such information to those who need it. The Controller does not enter other special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR).
6. The agreement applies for as long as the Service is provided to the Controller.

§ 3. Processor's obligations

The Processor:

1. processes data only on documented instructions from the Controller; the Terms, this agreement and actions of the Controller's Users in the application constitute instructions. Where Union or Member State law requires processing, the Processor informs the Controller before processing unless the law prohibits it;
2. immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other law;
3. allows access to data only to authorised persons bound by confidentiality, and accesses Customer Content only where necessary to handle the Controller's request, resolve a failure or security incident, or where required by law;
4. applies the technical and organisational measures described in § 9, appropriate to the risk (Article 32 GDPR), and may change them provided the level of protection does not decrease;
5. assists the Controller in responding to data subject requests; a request sent to the Processor by mistake is forwarded to the Controller within 5 business days and not answered by the Processor unless the Controller authorises it;
6. assists the Controller with its obligations under Articles 32–36 GDPR, taking into account the nature of processing and the information available to it;
7. keeps a record of categories of processing activities (Article 30(2) GDPR).

§ 4. Sub-processors

1. The Controller gives the Processor general authorisation to engage sub-processors. The current list is in § 8.
2. The Processor informs the Controller by email at least 14 days before adding or replacing a sub-processor. During that time the Controller may raise a reasoned objection. If the parties cannot agree, the Controller may terminate the Service agreement with immediate effect.
3. The Processor imposes on sub-processors data protection obligations no less protective than this agreement and is liable for them as for its own actions.
4. Data is transferred outside the European Economic Area only on the basis of an adequacy decision or standard contractual clauses adopted by the European Commission.

§ 5. Personal data breaches

1. The Processor notifies the Controller of a personal data breach without undue delay and no later than 36 hours after becoming aware of it, by email to the Organisation owner.
2. The notification includes, as far as available: a description of the breach, categories and approximate number of persons and records, likely consequences, measures taken and proposed, and contact details. Information not available at once is provided in phases.
3. Notifying the supervisory authority and data subjects is the Controller's responsibility. The Processor does not contact data subjects without the Controller's consent unless required by law.

§ 6. Audits

1. The Processor provides the Controller with the information necessary to demonstrate compliance with Article 28 GDPR, primarily as written answers and documentation.
2. The Controller may carry out an audit, also through an independent auditor bound by confidentiality, no more than once a year, with at least 30 days' notice and at its own cost. The frequency limit does not apply after a data breach or at the request of a supervisory authority.
3. Audits do not cover other customers' data or sub-processors' infrastructure; for these, the Processor provides their reports and certifications.

§ 7. End of processing

1. After the Service ends, the Controller has 30 days to export data. The Processor then deletes the personal data unless the law requires further storage.
2. Backups containing the data expire in their normal cycle, no later than 30 days after deletion.
3. On request, the Processor confirms deletion by email.

§ 8. Sub-processors

• Supabase Pte. Ltd. (Singapore): database, authentication and file storage; data in the EU (Ireland); standard contractual clauses in case of access from outside the EEA.
• Vercel Inc. (USA): application and server function hosting; servers in the EU and the USA; standard contractual clauses.
• Plus Five Five, Inc. (Resend, USA): sending emails initiated by Users, such as project invitations; sent from the EU, logs in the USA; EU-US Data Privacy Framework and standard contractual clauses.
• Google Cloud Poland sp. z o.o. (Google Maps Platform): location and pick-up address suggestions; receives only the address text.
• Openweather Ltd (United Kingdom): weather forecasts; receives only location coordinates and the date; European Commission adequacy decision.

§ 9. Technical and organisational measures

• Customer isolation: database-level access policies (Row Level Security) on all tables containing data, also enabled automatically on new tables. Users see only data of Organisations they belong to and projects shared with them.
• Permissions: roles in the Organisation and in shared projects (editor, view-only) enforced by the database, not only by the interface.
• Files: private storage, paths separated per Organisation and project, access through signed links valid for at most 1 hour.
• Encryption in transit: HTTPS (TLS) for the website, application and database.
• Passwords: stored only as cryptographic hashes; sign-in and password reset messages do not reveal whether an account exists.
• Invitations: single-use token, only its hash stored in the database, valid for 7 days, sending limits.
• Data location: database and files in the EU region (Ireland).
• Secrets: service keys only on the server side, outside the code repository.
• Logs: no document contents, passwords or tokens.
• Backups: database and file backups at least weekly, encrypted, kept for up to 30 days; restore tested at least quarterly.
• Administrative access: two-factor authentication on administrative accounts of services storing data.
• Updates: monitoring and fixing vulnerabilities in libraries used.
• Incidents: breach handling procedure and breach register.
• Personnel: only the Processor has access to data; any collaborators only after a written confidentiality undertaking.

§ 10. Final provisions

1. The parties' liability is governed by the GDPR and the Terms.
2. Matters not covered are governed by the Terms. In case of conflict regarding personal data protection, this agreement prevails.
3. Changes to this agreement follow the procedure for changes to the Terms.