Draft. Highlighted parts are still being filled in. Questions in the meantime: see the imprint.

Data Processing Agreement (Art. 28 GDPR)

Version VERSION · Last updated DATE

DRAFT. Not legal advice. This agreement becomes part of the Terms of Service when a band is created. It covers personal data of other people that a band stores in Bandkit, such as booking contacts, promoters, venue staff, band members entered by the owner, and people named in notes. Bandkit's own processing of its users' data is covered by the Privacy Policy, not by this agreement.

Between the band, represented by its owner, which accepts the Terms of Service (the "Controller"), and Jonathan Manierre, trading as Bandkit, Im Weichserhof 9, 50678 Köln (the "Processor").

1. Subject, duration, nature and purpose

1.1 Subject: providing the Bandkit service to the Controller as described in the Terms of Service.

1.2 Duration: as long as the Controller uses Bandkit. Section 10 governs what happens afterwards.

1.3 Nature and purpose: storing, organising, displaying, sharing within the band, and publishing at the Controller's request (public band page, shared links); generating documents such as PDFs; and AI-assisted features when a user triggers them.

2. Types of personal data and data subjects

The Controller must not store special categories of personal data (Art. 9 GDPR), such as health data in rider notes, or data about criminal convictions (Art. 10), unless this is strictly necessary and lawful.

3. The Controller's responsibilities

3.1 The Controller is responsible for:

• the lawfulness of the processing, including its own legal basis for collecting the data,
• informing the data subjects (Art. 13/14 GDPR), and
• handling their requests.

3.2 Bandkit provides tools to help: editing, deleting and exporting records, and setting visibility. REQUIRES compliance-gaps P1-1, P1-4

4. The Processor's obligations

The Processor:

1. processes the data only on documented instructions from the Controller. These terms and the Controller's use of the app's functions are the instructions. The Processor tells the Controller if it believes an instruction breaches data protection law. Processing required by EU or member-state law is an exception; the Processor will inform the Controller of it unless the law forbids that.
2. ensures that everyone authorised to process the data is bound to confidentiality.
3. takes the technical and organisational measures in Annex 1 (Art. 32 GDPR). The Processor may update them, provided the level of protection does not fall.
4. uses sub-processors only as set out in section 5.
5. helps the Controller respond to data subjects' requests (Art. 12–22 GDPR), as far as possible through the app's functions.
6. helps the Controller with its obligations under Art. 32–36 GDPR (security, breach notification, impact assessments), taking into account the nature of the processing and the information available to the Processor.
7. notifies the Controller without undue delay, and within 48 hours at most, after becoming aware of a personal data breach affecting the Controller's data. The notification includes the information required by Art. 33(3) GDPR, as far as it is known.
8. deletes or returns the data after the end of the service (section 10).
9. makes available the information necessary to demonstrate compliance, and allows and contributes to audits (section 7).

5. Sub-processors

5.1 The Controller generally authorises the sub-processors listed in Annex 2.

5.2 The Processor informs the Controller of any intended addition or replacement at least 30 days in advance by email or in the app. The Controller may object on reasonable data-protection grounds within that period. If no solution is found, either party may end the contract, and the Controller can export its data first.

5.3 The Processor imposes data protection obligations on each sub-processor that are equivalent to this agreement, and remains liable for them.

6. Transfers to third countries

Data is stored in the EU. Any transfer to a third country, including access from there, takes place only in line with Chapter V GDPR, using an adequacy decision (such as the EU-US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses. Annex 2 states the mechanism for each sub-processor.

7. Audits

The Processor demonstrates compliance mainly through:

• this agreement and its annexes, and
• on request, documentation and certifications of its sub-processors (for example Supabase SOC 2 and AWS ISO 27001). VERIFY

On-site audits are possible at the Controller's cost, with at least 30 days' notice, during business hours, without disrupting operations, and subject to confidentiality.

8. Requests from data subjects

If a data subject contacts the Processor about the Controller's data, the Processor forwards the request to the Controller without undue delay, and does not answer it itself unless instructed to.

9. Liability

Liability follows Art. 82 GDPR and the liability provisions of the Terms of Service.

10. End of processing

After the Controller deletes the band, or the contract ends, the Processor deletes the data within 30 days. Copies in backups are deleted when those backups expire (at most 14 days later). The Controller can export its data before deletion. The Processor keeps data longer only where EU or member-state law requires it.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Review against reality before publishing. Each line must be true.

Confidentiality

• Data hosted in ISO 27001 / SOC 2 certified data centres (AWS Frankfurt via Supabase). Physical access control is the providers' responsibility.
• Authentication by email and password, with passwords stored as bcrypt hashes by Supabase Auth. Sessions use signed tokens in httpOnly cookies.
• Row-level security in the database: every query is limited to the bands the signed-in user belongs to, with roles of owner, manager and member. File storage write access is limited to a band's owners and managers.
• Administrative access (Supabase, hosting, GitHub, domain registrar) is limited to the operator and protected by multi-factor authentication. VERIFY MFA is on for each
• Shared links and invite links use unguessable random tokens. Invites expire after 14 days and can be revoked.

Integrity

• All traffic is encrypted in transit (TLS 1.2+). Data is encrypted at rest (AES-256, provider-managed).
• Database changes are made only through versioned, reviewed migrations, tested on a separate development project before production.

Availability and resilience

• Nightly database backups, kept for 14 days, stored encrypted. VERIFY: FileVault on the backup Mac; Supabase Pro daily backups once upgraded
• Restore procedure documented. test a restore at least quarterly

Procedures for regular review

• Security advisor checks after every database change.
• Dependency updates and security patches applied promptly.
• Breach response plan: assess, contain, notify the Controller (48 h) and authority (72 h, Art. 33) where required, and document. write it, see compliance-gaps

Data minimisation

• No analytics or tracking.
• AI features send data only when a user triggers them, and only what the feature needs.

Annex 2: Sub-processors