Data Processing Agreement

This Data Processing Agreement ("DPA") is made between:

• The Customer — the account holder identified in the CueSync account, acting as controller; and
• to be confirmed — write to contact@cuesync.live, of to be confirmed — write to contact@cuesync.live (to be confirmed — write to contact@cuesync.live), trading as CueSync, acting as processor.

Subject matter. Our provision of CueSync Studio, the hosted collaboration workspace in which the Customer builds a show with the people it invites.

Duration.From the moment the Customer first puts personal data into Studio until the later of (a) the end of the Customer's Studio entitlement and (b) the expiry of the retention windows set out in the Data Retention Schedule, subject to the deletion clause below.

Nature of the processing.Collection through the Customer's own use of the service; storage; structuring; retrieval; transmission to the collaborators the Customer has invited; automated derivation of waveform data from audio the Customer uploads; backup; and erasure.

Purpose.Solely to provide, secure and support the service under the Studio Terms. We do not process the Customer's personal data for our own purposes, we do not sell or share it for advertising, and we do not use it to train machine-learning models.

The categories of data subject and of personal data are set out in Annex 1.

For the personal data the Customer puts into Studio — principally its collaborators' and crew's data — the Customer is the controller and CueSync is the processor. The Customer is responsible for having a lawful basis for putting that data into the service and for telling the people concerned that it has done so.

For a separate and narrower set of data — the account holder's own registration and billing details, our security and anti-abuse telemetry, and the analytics on our public website — CueSync acts as a controller in its own right. That processing is described in the Privacy Policy and is not governed by this DPA.

Where a person is both a collaborator on a Customer's project and a CueSync account holder in their own right, both roles apply to the respective data sets; neither displaces the other.

We process the Customer's personal data only on the Customer's documented instructions, including as to international transfers, unless we are required to do otherwise by law to which we are subject. Where the law requires it, we will inform the Customer before processing unless that law forbids us to on important grounds of public interest.

The Customer's documented instructions consist of:

• This DPA and the Studio Terms
• The Customer's own configuration and use of the service — creating projects, inviting collaborators, assigning roles and disciplines, uploading content, exporting and deleting
• Any further written instruction the Customer sends to privacy@cuesync.live and that we accept

We will tell the Customer if, in our opinion, an instruction infringes the GDPR or other applicable data protection law. An instruction that would require material work outside the scope of the service may be chargeable, and we will say so before doing it rather than after.

We ensure that every person authorised to process the Customer's personal data is bound by an obligation of confidentiality, whether contractual or statutory, and that the obligation survives the end of their engagement.

Access is granted on a need-to-know basis and is limited to what a specific task requires. The administrative surfaces that can reach customer records are gated behind an explicit operator allowlist, an enrolled authenticator app, and a fresh re-authentication challenge — see Annex 2 — and administrative actions are written to the tamper-evident audit log.

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing.

The measures actually in place are listed in Annex 2 rather than described in general terms here, because a list a customer can check is worth more than an assurance it cannot. We may change a measure for an equivalent or better one; we will not reduce the overall level of security during the term.

Report a suspected vulnerability or incident to security@cuesync.live.

The Customer gives general written authorisationfor us to engage sub-processors. The complete current list, with each one's purpose, the categories of data it receives, and its location, is published and kept up to date at https://www.cuesync.live/legal/subprocessors.

Taking into account the nature of the processing, we assist the Customer by appropriate technical and organisational measures, insofar as this is possible, to fulfil the Customer's obligation to respond to requests to exercise rights under Chapter III of the GDPR — access, rectification, erasure, restriction, portability and objection.

In practice, the Customer can satisfy most requests itself: a project owner or admin can read, correct and delete the content and membership records in their own projects, and any member can export a project in a machine-readable show file. Where a request cannot be satisfied through the product, write to privacy@cuesync.live and we will assist without undue delay.

If a data subject contacts us directly about data we process on the Customer's behalf, we will not respond to the substance of the request ourselves. We will tell them to contact the Customer, and tell the Customer promptly so it can respond within its own one month deadline.

We assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to us. That includes providing the information a data protection impact assessment needs about how Studio processes data, and supporting a prior consultation with a supervisory authority where one is required.

Annex 1 and Annex 2 of this document, plus the Sub-processors and Data Retention Schedule pages, are intended to be sufficient for an ordinary impact assessment without a separate request.

We notify the Customer without undue delayafter becoming aware of a personal data breach affecting personal data we process on the Customer's behalf. Notice goes to the email address on the account and, where the Customer has given one, to a nominated security contact.

The notification describes, to the extent known at the time:

• The nature of the breach, including the categories and approximate number of data subjects and records concerned
• The likely consequences
• The measures taken or proposed to address it and to mitigate its effects
• A contact point for further information

Where the full picture is not available at once, we provide the information in phases rather than delaying the first notification until everything is known. We do not notify a supervisory authority or data subjects on the Customer's behalf unless the Customer asks us to and we agree: those are the controller's obligations, and a duplicate notification from a processor is not a help to anyone.

At the Customer's choice, we delete or return the personal data we process on its behalf after the end of the provision of the service, and delete existing copies, unless Union or Member State law requires us to keep them.

• Return is self-service and available throughout the term: any project member can export a project as a machine-readable show file, and uploaded source files can be downloaded from the project. We recommend doing this before the entitlement lapses.
• Deletion happens on the schedule published in the Data Retention Schedule, or earlier on written request to privacy@cuesync.live.

Two honest exceptions. First, encrypted operational backups are taken on a rolling cycle and are not selectively editable; data deleted from the live system persists in backups until those backups age out on the cycle stated in the retention schedule, and remains subject to this DPA while it does. Second, records we must keep by law — principally transaction records kept for the statutory accounting period — survive an erasure request, and the retention schedule says which they are.

We make available to the Customer all information necessary to demonstrate compliance with the obligations in Article 28, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.

In the first instance we satisfy this by providing the published documentation — this DPA and its annexes, the sub-processor list, the retention schedule — and by answering a written questionnaire. Where that is genuinely insufficient for the Customer's own compliance obligation, the Customer may request an audit on 30 days' written notice, no more than once in any 12-month period except where a supervisory authority requires otherwise or following a personal data breach.

An audit must be conducted during business hours, must not unreasonably interfere with our operations, and must not access another customer's data or any part of our systems that would compromise their security. The auditor must be bound by confidentiality and must not be a competitor of ours. The Customer bears its own costs and our reasonable costs of supporting an on-site audit.

We do not currently hold a SOC 2 or ISO 27001 report. Whether to obtain one is a business decision that has not been made; we would rather say so than imply a certification we do not have.

Studio is operated from infrastructure in more than one country, and several of our sub-processors are global providers. Where personal data protected by the GDPR or UK GDPR is transferred outside the EEA or the UK to a country without an adequacy decision, that transfer is made under an approved transfer mechanism — the European Commission's Standard Contractual Clauses (Decision 2021/914) with the UK International Data Transfer Addendum where UK data is involved — together with the supplementary measures set out in Annex 2, principally encryption in transit and at rest.

The per-sub-processor location and transfer mechanism is published in the Sub-processorstable. Cells in that table that read "to be confirmed" are exactly that: not yet verified, and marked rather than guessed.

The controller-side transfer analysis also depends on where CueSync's own establishment sits, which is recorded on this page as: to be confirmed — write to contact@cuesync.live. Until that is settled, treat the transfer position as provisional and ask us before relying on it in your own assessment.

This DPA takes effect when the Customer first uses Studio and continues for as long as we process personal data on the Customer's behalf. The obligations in the deletion, confidentiality and audit clauses survive its termination for as long as we hold any of that data.

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where those limitations cannot lawfully be applied to a claim under data protection law.

In the event of a conflict, this DPA prevails over the Terms of Service and the Studio Terms on matters of data protection, and the Standard Contractual Clauses prevail over this DPA where they apply.

The measures below are the ones in place, described specifically enough to be checked. Where a measure has a stated threshold, the threshold is the one the service enforces.

Data protection enquiries, DPA acceptance and data-subject assistance: privacy@cuesync.live.

Security reports: security@cuesync.live.

Related documents: Studio Terms, Sub-processors, Data Retention Schedule, and the Privacy Policy.