Data processing agreement
This agreement forms part of the terms of use between Togra Software ("the processor") and the producer company that signs up ("the controller"). It applies to personal data the controller enters into Togra Transparency.
1. What is processed
| Subject matter | Preparing and issuing Article 19 transparency reports for the controller's titles. |
|---|---|
| Duration | While the controller has an account, then until the data is returned or deleted under clause 9. |
| Nature and purpose | Storing the data, calculating each participant's figures, producing reports, emailing them and recording when they were opened. For a controller that connects a Togra account: storing the report files and figures that account publishes and showing them to the participant they are addressed to. |
| Types of personal data | Names, email addresses, roles, credit categories, share percentages and report figures of participants; the date a report was sent, opened and acknowledged; the name and IP address given when a confidentiality agreement is signed. |
| Whose | The controller's participants: writers, directors, composers, financiers and others the controller reports to. |
2. Instructions
The processor processes the data only on the controller's documented instructions, which are these terms and what the controller does in the service, unless the law requires otherwise. It tells the controller if it thinks an instruction breaks data protection law.
3. Confidentiality
The processor makes sure everyone who may process the data is bound by confidentiality.
4. Security
The processor keeps the data secure, including: each company's data is separated from every other company's; passwords are stored as one-way hashes; two-step sign-in is available; participants reach only their own figures through single-use sign-in links or per-report secure links; and access to the production system is limited to named operators.
5. Sub-processors
The controller authorises the processor to use these sub-processors: hosting, Hetzner; email delivery, Scaleway (Transactional Email). The processor tells the controller before it adds or replaces one. [Notice period and objection process to insert.] The processor puts the same obligations on each sub-processor and remains responsible for it.
6. Transfers outside the EEA
[Locations of processing and any transfer mechanism to insert.]
7. Helping the controller
The processor helps the controller answer requests from participants to exercise their rights, and helps it meet its security, breach-notification and impact-assessment duties, taking into account the nature of the processing. A request that reaches the processor directly is passed to the controller.
8. Personal data breaches
The processor tells the controller without undue delay, and within [number of hours to insert] hours, after becoming aware of a personal data breach affecting the controller's data, with the information it then has.
9. Ending
When the controller closes the account or asks, the processor deletes the controller's data, or returns it first if asked, and deletes remaining copies [within the period to insert], unless the law requires it to keep them.
10. Audit
The processor gives the controller the information needed to show compliance with this agreement and allows and contributes to audits by the controller or an auditor it appoints. [Procedure and notice to insert.]
Questions, data requests and abuse reports: contact@togra.online