This Data Processing Agreement (the “DPA”) under Art. 28 GDPR is concluded between the user as controller and us as processor. It is incorporated when the contract for the use of DJPlayThat is concluded and forms part of our Terms and Conditions.
Parties
The controller is the user (organizer, DJ or agency) with the details stored in their user account.
The processor is:
§ 1 Subject matter, duration and delimitation
(1) The subject matter of the processing is the personal data that arises in connection with the events created by the controller – in particular receiving, storing and displaying the guests' song requests and votes.
(2) The duration of the processing corresponds to the term of the contract for use.
(3) This DPA does not cover processing for which we ourselves are the controller – in particular managing the user account, billing, server logging and preventing misuse. Our privacy policy applies to that processing.
§ 2 Nature and purpose of the processing
The processing serves exclusively to provide the song request and voting feature for the controller's events. It comprises collecting, storing, displaying, altering (status changes by the controller), anonymizing and erasing the data.
Types of personal data
- display name freely chosen by the guests
- content of the song requests (artist, title, genre, free-text comment)
- votes on song requests
- randomly generated device identifier of the browser
- timestamps of the entries
Categories of data subjects
- guests of the controller's events
- co-organizers invited by the controller, to the extent their data is processed in connection with the event
Special categories of personal data under Art. 9 GDPR are not covered by the processing. The controller will not use the platform to process such data.
§ 3 Instructions
(1) We process the data only on documented instructions from the controller. The settings and features the controller uses in the application, together with this agreement, are deemed to be instructions. Further instructions must be sent in text form to the address stated above.
(2) We will inform the controller without undue delay if we believe that an instruction infringes data protection provisions. We are entitled to suspend carrying out such an instruction until it is confirmed or changed.
(3) The data is not processed for our own purposes, not disclosed to third parties and not used for advertising.
§ 4 Confidentiality
Persons deployed to carry out the processing are bound to confidentiality and are made familiar with the data protection requirements to the extent necessary. The obligation continues after their work has ended.
§ 5 Technical and organizational measures
(1) We take the measures described in Annex 2 in accordance with Art. 32 GDPR and maintain them for the term of the agreement.
(2) The measures are subject to technical progress. We may adapt them as long as the agreed level of protection is not reduced.
§ 6 Sub-processors
(1) The controller grants general authorization to engage the sub-processors listed below:
| Company | Service | Place of processing |
|---|---|---|
| We currently do not engage any sub-processors for processing the data covered by this agreement. The platform is operated on our own infrastructure. | ||
(2) We will inform the controller in text form at least four weeks in advance before adding or replacing a sub-processor. The controller may object to the change within two weeks of receiving the information for good cause relating to data protection. In the event of a justified objection that we cannot remedy, both parties have a special right of termination.
(3) We bind sub-processors to a level of protection that corresponds to this agreement (Art. 28(4) GDPR).
(4) Ancillary services that we use for our own purposes – such as payment processing by Stripe or sending system emails to the controller – are not sub-processing. They do not concern the guests' data.
§ 7 Assistance to the controller
(1) If data subjects contact us with requests under Art. 15 to 22 GDPR, we will refer them to the controller and inform the controller without undue delay.
(2) We assist the controller, as far as we are able, in fulfilling data subjects' rights and in meeting its obligations under Art. 32 to 36 GDPR (data security, notification of breaches, data protection impact assessment).
(3) If we become aware of a personal data breach, we will inform the controller without undue delay and provide the information required for the notification under Art. 33 GDPR.
§ 8 Evidence and audit rights
(1) On request, we will demonstrate compliance with the obligations under this agreement in a suitable manner, in particular by providing information in text form.
(2) The controller is entitled to satisfy itself of compliance during normal business hours, by prior arrangement and with reasonable advance notice. The audit must not unreasonably disrupt operations. For effort beyond simple information, we may charge reasonable remuneration unless there is a specific reason for the audit.
§ 9 Erasure and return
(1) The guests' data is anonymized automatically no later than 90 days after the end of the event concerned. In the process, the display name, device identifier and free-text entries are removed irrevocably; only information that does not relate to a person remains.
(2) If the controller deletes an event, an individual request or its account, the associated data is removed.
(3) After the contract for use ends, we erase the data processed on the controller's behalf unless a statutory retention obligation prevents this. We do not owe a handover in a specific format; the controller can save the information relevant to it through the application before the contract ends.
§ 10 Liability and final provisions
(1) Art. 82 GDPR applies to liability. Otherwise, the provisions of our Terms and Conditions apply.
(2) If this DPA and the Terms and Conditions conflict with regard to data processing, this DPA takes precedence.
(3) German law applies.
Annex 1 – Overview of the processing
| Item | Details |
|---|---|
| Subject matter | Receiving and displaying the guests' song requests and votes |
| Duration | Term of the contract for use; anonymization 90 days after the end of the event |
| Nature of the processing | Collecting, storing, displaying, altering, anonymizing, erasing |
| Purpose | Providing the song request feature at the controller's events |
| Types of data | Display name, request content, comments, votes, device identifier, timestamps |
| Data subjects | Guests of the events, co-organizers |
| Third-country transfers | We do not transfer data to third countries. Note: for the search suggestions shown while entering a request, the guest's device queries Apple directly; the guest establishes this connection themselves, and the data does not pass through our systems. |
Annex 2 – Technical and organizational measures
Confidentiality
- Physical access control: The servers are located in locked premises that are not open to the public.
- System access control: Access to the application only through personal accounts with a password. Passwords are stored exclusively as a non-reversible hash. Minimum length and complexity requirements are technically enforced. After several failed attempts, the account is locked temporarily. The servers are administered exclusively over an encrypted VPN connection; database access is restricted to that network.
- Data access control: Role- and permission-based access control. Every access to an event is checked centrally against the account's permissions; the check is carried out on the server and not only in the user interface.
- Separation control: Data is firmly assigned to workspaces and events; queries are made only within that assignment. Guest access is limited to the event concerned.
- Pseudonymization and anonymization: Guests enter a freely chosen name; there is no registration. After 90 days, the personal details are removed automatically and irrevocably.
Integrity
- Transfer control: Data is transmitted exclusively in encrypted form over HTTPS/TLS, including the live connection used to update the request lists.
- Input control: Security-relevant actions are logged. Changes to requests are assigned to the event concerned and to the time they were made.
- Protection against tampering: Forms are protected against cross-site request forgery; inputs are validated on the server and limited in length. Guest actions are rate-limited (protection against automated mass requests).
Availability and resilience
- Backups: The database is backed up regularly; the ability to restore it is checked.
- System hardening: The server is connected through a reverse proxy and can only be reached on the ports required. The operating system and application components are updated regularly.
Procedures for review and assessment
- Order control: Processing exclusively within the scope of this agreement and the controller's instructions.
- Data protection by design: Only the data required for the feature is collected. Guests do not need an account; the display name can be a pseudonym. No analytics or tracking services and no external content are embedded.
- Review: The measures are reviewed and updated when there is a reason to do so and whenever the application changes significantly.