Digitainment — Data Processing Agreement (DPA)

Version: 2 (2026-10-16)
Effective date: 9 October 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Digitainment.io (“Processor”, “we”; full provider details in the Impressum) and the Customer (“Controller”) and applies where we process personal data on the Controller’s behalf.

1. Roles

1.1 For personal data the Controller and its Users upload, enter, or generate in the Service about third parties (e.g. promoter and venue contacts; where the merchandise module is enabled, the Controller's own customers who buy merchandise; where the Ticketing module is used, the buyers of the Controller's tickets and the persons named on them; or, where Label Services is used, the artists, songwriters, producers and other contributors credited on the Controller's releases and persons named in rights documents the Controller uploads), the Controller is the controller and Digitainment is the processor under Art. 4 and Art. 28 GDPR.

1.2 This DPA does not apply to venue reference information that contains no personal data (e.g. venue names, addresses, capacity, technical specifications, or general venue contact points such as a booking@ address, whether curated by us directly or enriched by our own AI-assisted research, and without a named individual), nor to data for which Digitainment is itself the controller (covered by the Privacy Policy), including the signing records of Label Services Terms acceptances and Distribution Agreements, and the payout and royalty records Digitainment keeps under a Distribution Agreement.

2. Subject matter and instructions

2.1 We process personal data only on the Controller’s documented instructions, including as set out in this DPA and as given through the Service’s features, unless required otherwise by EU or Member State law (in which case we inform the Controller unless legally prohibited).

2.2 The subject matter, duration, nature, purpose, types of personal data, and categories of data subjects are described in Annex I.

3. Confidentiality

3.1 We ensure that persons authorised to process the personal data are bound by confidentiality.

4. Security (Art. 32)

4.1 We implement appropriate technical and organisational measures as described in Annex III, taking into account the state of the art, costs, and the risks to data subjects.

4a. AI processing on the Controller's own provider account

4a.1 We do not provide AI processing as part of the Service. AI-assisted features operate only where the Controller has connected its own Anthropic API key. The Controller holds the account with Anthropic, contracts with Anthropic directly, is billed by Anthropic, and accepts Anthropic's own terms. We hold no account, contract, or commercial relationship with Anthropic in respect of that processing. (Where we use an AI provider for our own internal purposes, such as curating the shared venue reference data described in Clause 1.2, we do so on our own account and outside this Clause; no Controller personal data is processed for that purpose.)

4a.2 Where the Controller invokes such a feature, the Controller thereby instructs us to transmit the relevant records from our systems to Anthropic under the Controller's own key. Anthropic is not our sub-processor for that processing and is not listed in Annex II. Anthropic acts under the Controller's own account and authority; where it is a processor at all, it is the Controller's processor. The Controller is responsible for putting in place and maintaining whatever arrangement Art. 28 GDPR requires between the Controller and Anthropic, and for any transfer safeguard required for processing outside the EEA.

4a.3 We give no warranty as to Anthropic's processing, security, retention, availability, or output, and accept no responsibility or liability for it. An interruption, change, or failure affecting the Controller's own AI provider account is not a failure of the Service.

4a.4 What remains ours is the part performed in our systems. We store the Controller's API key encrypted at rest, restrict access to the Controller's account owner, do not display it after entry, and use it for no purpose other than performing the features the Controller invokes. The Controller may replace or remove the key at any time; removing it disables AI features for the Controller's workspace.

4a.5 Usage limits the Controller sets in the Service are applied on a best-efforts basis and are not a spending cap. Amounts payable to Anthropic are a matter between the Controller and Anthropic.

4b. Distribution through The Orchard (Label Services)

4b.1 Where the Controller uses Label Services, the Controller instructs us, each time it submits a release, to deliver that release's metadata (including the names and roles of the artists, songwriters, producers and other contributors credited on each track), audio and artwork to The Orchard, and through The Orchard to the digital stores and streaming services the release is delivered to. Rights documents the Controller uploads (with every release while it is a new label, and on request once we have moved it to on-request proof) are not sent with a release: we use them to check the release, and share them with The Orchard only when it asks for proof of rights, for example in a rights claim.

4b.2 The purpose of that delivery is publication: the stores display contributor credits publicly, worldwide, as part of the release. The Controller is responsible for having a lawful basis to credit each contributor and to have their name published, and for informing contributors as data protection law requires.

4b.3 A takedown or pull-down the Controller requests is passed to The Orchard as set out in the Label Services Terms. We send the request to The Orchard straight away; removal from the stores is carried out by the stores and may take up to 14 working days. Once delivered, we cannot recall metadata that The Orchard or a store holds for its own records, royalty accounting or legal obligations.

4b.4 The Orchard receives release data as an independent controller, under its own privacy policy: it distributes the release, keeps its own sales and accounting records, and sends us sales reports and statements. It is therefore not our sub-processor and is not listed in Annex II; it is named, with the transfer safeguard, in the note below Annex II. Stores and streaming services receive release metadata from The Orchard, not from us, and are not our sub-processors either.

5. Sub-processors

5.1 The Controller grants general authorisation for the sub-processors listed in Annex II. We impose data-protection obligations on each sub-processor equivalent to those in this DPA and remain fully liable for their performance.

5.2 We will inform the Controller of intended additions or replacements of sub-processors with reasonable notice, giving the Controller the opportunity to object on reasonable data-protection grounds.

6. Assistance to the Controller

6.1 Taking into account the nature of processing, we assist the Controller by appropriate measures in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection).

6.2 We assist the Controller in ensuring compliance with Art. 32–36 GDPR, including security, breach notification, and data-protection impact assessments, taking into account the information available to us.

6.3 We notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, with information reasonably available to us to support the Controller’s own notification obligations.

7. International transfers

7.1 We do not transfer the Controller’s personal data outside the EEA except to sub-processors under an appropriate safeguard (e.g. EU Standard Contractual Clauses), as indicated in Annex II, or on the Controller’s own instruction as described in Clauses 7.2 and 7.3.

7.2 Delivery of release metadata to The Orchard in the United States under Clause 4b is made under the safeguard named for The Orchard in the note below Annex II. Onward delivery from The Orchard to stores, and the stores' publication of contributor credits, are carried out by those parties.

7.3 Transmission to the Controller's own AI provider under Clause 4a is not a transfer by us to a sub-processor. It is made on the Controller's own instruction, to an account the Controller holds, and the applicable safeguard is the one the Controller has in place with that provider.

8. Return and deletion

8.1 On termination of the Service, we delete or return the Controller’s personal data at the Controller’s choice, and delete existing copies, unless retention is required by law. Export functionality within the Service enables the Controller to retrieve its data before deletion.

9. Audits

9.1 We make available information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable notice, confidentiality, and no disruption to the Service. We may satisfy audit requests by providing relevant certifications or reports where available.

10. Liability and term

10.1 Liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law. This DPA runs for as long as we process personal data on the Controller’s behalf.

10.2 This DPA is governed by German law.

Annex I — Description of processing

Subject matter: Provision of the Digitainment platform to the Controller.
Duration: For the term of the Controller’s account.
Nature and purpose: Hosting, storage, organisation, retrieval, enrichment, display, and transmission of contact and related records to enable booking, contract, and marketing workflows the Controller operates; and, where the Controller enables the merchandise module, processing of the Controller's own customer order and delivery records — whichever way the customer paid (card through the Controller's Stripe account, PayPal.me, cash, or bank transfer) — to enable those modules' sale-recording, fulfilment, and settlement workflows; and, where the Controller uses the Ticketing module, processing of ticket orders, tickets, refunds and admission scans to enable ticket sales, delivery of tickets by email, admission control at the Controller's events, refunds and settlement; and, where the Controller uses Label Services, storage, validation and checking of release metadata, audio, artwork and rights documents, and delivery of releases to The Orchard for distribution to digital stores and streaming services (Clause 4b).
AI-assisted processing: Not performed by us. Where the Controller connects its own Anthropic API key, records the Controller directs an assistant to process are transmitted, on the Controller's instruction, to the Controller's own Anthropic account under that key (Clause 4a). We perform no AI processing on our own provider account for the Controller, and no such transmission occurs without a key the Controller has connected.
Types of personal data: Business contact details of the Controller’s industry contacts (e.g. names where provided, role-based or individual email addresses, phone numbers, social handles), notes, and communications recorded by the Controller. Where the merchandise module is enabled: the Controller's own customers' order data (name, email address), and — for merchandise shipped to a customer — delivery/shipping address, entered by the customer at checkout in the Controller's storefront, or recorded by the Controller at the point of sale, to support inventory, fulfilment-status, and settlement features. Where the Ticketing module is used: the ticket buyer's name and email address, the name of a ticket holder where given, the order and its tickets (ticket type, price, unique ticket code, status), refunds, and admission scans (time and the name of the Controller's user who scanned). Payment card data is entered on Stripe's pages and is not received by us. Where Label Services is used: names (legal or professional) and roles of the artists, featured artists, remixers, songwriters, composers, lyricists, producers and other contributors credited on a release; the nationality of the copyright owner and the country of recording where given; the email address of the Controller's user who confirmed the rights for a release; and personal data contained in rights documents the Controller uploads (for example names, addresses, signatures and contract terms in artist, producer, licence or sample-clearance agreements). Where Logistics is used: travel and identity data the Controller enters for band members and guests, including legal names, date of birth, nationality, passport number and expiry, and ID numbers.
Categories of data subjects: The Controller’s business contacts, including promoters, venue staff, partners; where the Controller enables the merchandise module, the Controller’s own customers who buy merchandise (fans); where the Controller uses the Ticketing module, the buyers of its tickets and the persons named on them (fans); and, where the Controller uses Label Services, the artists and contributors credited on its releases and the parties to its rights documents.
Special category data: Not intended or required. The Controller must not upload special-category data.

Annex II — Sub-processors

Sub-processor	Purpose	Location / transfer safeguard
Hetzner Online GmbH	Hosting / infrastructure	Germany (EU)
Stripe Payments Europe, Limited ("SPEL")	Payments. Two distinct relationships: (1) our own use of Stripe to bill Controllers for their Digitainment subscription — this does not involve Controllers' own customer/fan data; (2) where the Controller enables the merchandise or ticketing module and connects their own Stripe account via Stripe Connect, Stripe additionally processes the Controller's own customers'/fans' order, payment, and (for online sales) shipping data on the Controller's behalf — via Stripe Connect for online storefront checkout and ticket checkout, and via Stripe Terminal (a supported physical card reader paired to the Controller's Stripe account) for in-person card sales, both under the same Connect relationship — with us as an intermediate processor receiving order/sale-confirmation data via webhook (see Annex I).	Ireland (EU). Digitainment's Stripe account country is Germany, and under Stripe's Services Agreement the contracting entity is determined by account country — for merchants outside the Americas that maps to SPEL. Confirmed. No third-country transfer arises from this relationship itself; Stripe's group also holds EU-US DPF certification and offers SCCs for any residual US-side processing.
Resend (legal entity: Plus Five Five, Inc.)	Email delivery	United States — primary processing occurs in the US. Resend is certified under the EU-US Data Privacy Framework and its DPA additionally includes EU/UK SCCs as a backstop.
Google (Maps/Places)	Venue lookup	US — SCCs
SocialAPI.ai (legal entity: EP ENTPREPRISE, SIREN 102198884)	Social publishing	France (EU) — an EU-established company, so no third-country transfer for this relationship itself. Its own infrastructure is EU-hosted (Hetzner, Germany; Cloudflare EU for media). Its own sub-processors include Stripe and Resend (both covered above, DPF-certified).

The Orchard is not a sub-processor. For Label Services, release data (including contributor names and roles, audio and artwork, and rights documents only when The Orchard asks for proof of rights) is delivered on the Controller's instruction to The Orchard (The Orchard Enterprises, Inc., New York, United States), which receives it as an independent controller for distribution, sales reporting and accounting (Clause 4b). Transfer safeguard: EU Standard Contractual Clauses (controller to controller).

PayPal is not a sub-processor. Where the Controller adds its own PayPal.me handle, the Service shows the Controller's customer a PayPal.me payment link, or a QR code of that link drawn in the customer's or seller's own browser, for the order amount — at the point of sale and as a payment option in the online storefront. The customer pays the Controller directly on PayPal. We have no PayPal integration, send PayPal no personal data, and receive nothing back from it: the Controller confirms in the Service that the payment arrived. PayPal's processing is between the customer, the Controller and PayPal.

Anthropic is not a sub-processor. AI-assisted features run on the Controller's own Anthropic API key and account, and Anthropic is therefore the Controller's own provider, not ours (Clause 4a). It is named here for transparency about where data goes, not as a Digitainment sub-processor: we hold no contract with Anthropic for that processing, the transfer safeguard is the one the Controller has in place with Anthropic, and the Controller is responsible for that relationship. Removing the key stops the transmission entirely.

Annex III — Technical and organisational measures (Art. 32)

The following reflects Digitainment’s current security posture and should be kept accurate:

Encryption in transit via HTTPS/TLS across the platform.
Authentication & session security: JWT verification with live database checks on each request; server-side active-session validation; middleware fails closed on token errors; aligned session lifetimes; sliding refresh; rate limiting on authentication routes; concurrent-session caps with self-service reset.
Access control: Multi-tenant isolation so each Controller’s data is scoped to its own agency; role/seat-based permissions; Super Admin controls restricted.
Input/output safety: Server-side HTML sanitisation of user-supplied content at render time; safe JSON-LD encoding to prevent injection.
Credential storage: Third-party credentials the Controller connects, including its Anthropic API key, are encrypted at rest with AES-256-GCM, are never returned to a client after entry, and are readable only by the Controller's account owner role.
Encryption of sensitive identifiers: passport numbers, ID numbers, dates of birth, passport expiry dates and label payout bank details are encrypted at rest with AES-256-GCM. Viewing or changing them requires the signed-in user to re-enter their password, and that access lapses after 10 minutes.
Protection of shared pages: name lists and travel details on public show pages (including travel agent links) stay locked until the visitor enters a per-show 5-digit access code sent separately from the link; wrong attempts are rate-limited and a show is locked out after repeated failures; changing the code immediately locks all visitors again.
File storage: Uploads stored outside the public web root in a private, agency-namespaced directory with randomised filenames; direct web access to raw upload paths blocked at the web server; downloads served through gated routes.
Signed records: Label Services Terms acceptances and Distribution Agreements are stored with a frozen copy of the exact text signed and its SHA-256 fingerprint, so any later change to the text can be detected. Label rights documents, audio and artwork are held in the same private upload storage as other files and are served only through gated routes.
Hosting: EU-based infrastructure (Hetzner, Germany) with process management and reverse-proxy hardening.
Data segregation & deletion: Per-tenant data separation; deletion/return on account termination; export functionality for data portability.

This annex is updated whenever the security measures change.

Last updated: 16 October 2026