This addendum applies when incorporated into an accepted AgencyPin customer order, with the agreed processing and deployment details.
1.1 This DPA forms part of the AgencyPin Agreement when incorporated in an accepted Order. For personal data processed on Customer's behalf, Customer is controller and AgencyPin is processor, or Customer is processor and AgencyPin is its authorized subprocessor. Customer must have the authority needed to appoint AgencyPin. Each party is separately responsible for any processing it determines for its own lawful purposes, such as its business contact and statutory billing records; that processing is not converted into processor activity by this DPA.
1.2 Applicable Data Protection Law includes GDPR and applicable implementing laws. GDPR definitions apply. This DPA prevails over inconsistent general terms. Transfers requiring EU standard contractual clauses (SCCs) must use the applicable approved transfer instrument, whose mandatory provisions prevail. This DPA is not itself an international transfer mechanism.
2.1 Subject matter is hosting and operating Customer's agreed AgencyPin environment, related support and authorized integrations. Duration is the subscription plus the return, deletion, backup and lawful retention periods in section 8. Nature of processing includes collection, storage, organization, retrieval, display, transmission, export, correction and deletion. Purposes are the agency workflows and integration operations instructed by Customer, not advertising or unrelated analytics on identified people.
2.2 Data subjects may include talent, models, applicants, including minors where lawfully supported, Customer staff, client and partner contacts, suppliers and payment recipients. Data may include names, contact details, profile descriptions, measurements, photos and videos, availability, booking and travel information, applications, communications, user identifiers and logs, invoice and statement records, tax identifiers and payment details where the agreed workflow requires them. No payment-card security code storage is authorized. Special-category, criminal-offence and identification-document processing requires a specific lawful instruction and agreed safeguards before use.
2.3 Documented instructions consist of the Agreement, Order, lawful configuration and authorized written requests. AgencyPin will process only on those instructions, including for transfers, unless applicable law requires otherwise; it will inform Customer of the legal requirement before processing unless prohibited. AgencyPin will immediately inform Customer if it considers an instruction infringes applicable data protection law and may pause that instruction pending clarification.
2.4 Customer supplies required notices, lawful bases and instructions and handles the overall lawful operation of its agency. The parties must complete the deployment record before live processing: hosting locations, authorized subprocessors, integration scope, relevant transfers, security configuration and any special data. Missing details must be resolved, not treated as an unlimited authorization.
3.1 AgencyPin ensures persons authorized to process personal data are bound by confidentiality and access only what is necessary. It maintains measures appropriate to the risk under GDPR Article 32 and reviews their effectiveness. Customer is responsible for permissions and endpoint controls under its control; AgencyPin remains responsible for its own measures.
3.2 The security baseline includes individual staff access, least privilege, prompt access revocation, secure transport, protected storage and backups, credential protection, patch and vulnerability management, security logging, controlled changes, incident handling, recovery procedures and periodic review. Exact implemented measures, including encryption at rest, administrator MFA, backup frequency and recovery targets, must be recorded accurately in the deployment security schedule; this list does not assert a certification or an unverified technical implementation. Measures must not fall below Article 32 requirements or be materially reduced during the term.
4.1 Customer gives general written authorization only for the subprocessors disclosed in the initial deployment record accepted with the Order. The record identifies legal entity, purpose, locations and transfer safeguards. No undisclosed provider is approved merely by its category. AgencyPin gives at least 30 calendar days' advance written notice of additions or replacements, with information sufficient to assess them.
4.2 Customer may object within 15 calendar days on reasonable data protection grounds. The parties seek a reasonable alternative or safeguards; AgencyPin must not use the disputed new subprocessor for Customer Data while the objection remains unresolved. If no practical compliant solution is possible, either party may terminate only the affected Service before the new processing begins; unused prepaid fees for that Service are refunded. Urgent changes required to protect data or comply with law require prompt notice and an equivalent opportunity to resolve or end the affected processing; they do not create blanket authorization.
4.3 AgencyPin imposes equivalent relevant data protection duties by written contract and remains responsible to Customer for the subprocessor's performance as required by GDPR Article 28(4). A QuickBooks connection instructed by Customer does not automatically make Intuit AgencyPin's subprocessor; actual roles depend on the arrangement, the data flow and Intuit's applicable terms and must be recorded.
5.1 AgencyPin will not transfer or enable access to Customer personal data outside the EEA without a lawful transfer basis and documented Customer authorization. Adequacy decisions or appropriate safeguards, including the applicable SCC module and supplementary measures where required, must be identified in the deployment record. Remote support access is included in this assessment.
5.2 Customer-directed transfers to its own third-party account are documented instructions, not an exemption from transfer rules. The parties assess their respective exporter, importer, controller and processor obligations. AgencyPin will provide relevant information and cooperate on transfer assessments; it will not assert that all processing stays in Estonia without evidence.
6.1 AgencyPin will promptly forward requests from data subjects relating to Customer's data and, taking account of the nature of processing, provide appropriate technical and organizational assistance for Customer to meet its duties. It will not respond substantively except on Customer instruction or as legally required.
6.2 Taking account of processing and information available, AgencyPin assists Customer with security obligations, breach notifications, data protection impact assessments and prior consultation under GDPR Articles 32 to 36. Routine information and assistance are included; extraordinary customer-specific work may be quoted in advance where lawful, but a fee dispute must not delay mandatory assistance.
6.3 AgencyPin notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. Initial notice will include information then available on the nature of the breach, affected data and persons, likely consequences, measures taken or proposed and a contact point. Further information is provided in phases without undue delay. AgencyPin investigates, mitigates and preserves appropriate evidence. Notice is not postponed until a final report or admission of fault. Customer decides its regulatory and individual notifications, subject to AgencyPin's own legal duties.
7.1 AgencyPin makes available information necessary to demonstrate compliance and allows and contributes to audits, including inspections, by Customer or its mandated independent auditor. Parties first use existing documentation where sufficient, but documentation is not an absolute substitute for an audit legally required by Article 28.
7.2 Audits use reasonable notice, confidentiality and security arrangements, avoid exposure of other customers' data and minimize disruption. Normally one routine audit in a 12-month period is sufficient; this limit does not apply to reasonable evidence of material non-compliance, an incident, regulator requirements or mandatory law. Any agreed allocation of extraordinary audit costs must not make statutory audit rights ineffective.
8.1 At Customer's choice, AgencyPin returns or deletes personal data after the services end, and deletes existing copies unless law requires storage. The standard contractual process provides a 30-day request window after termination, delivery within 15 days of a timely standard export request or a documented reasonable extension, and active deletion within 30 days after the return window or extension. Where AgencyPin delays delivery, requested data is preserved until delivery plus 15 days for collection. A lawful instruction for earlier deletion takes precedence where feasible and consistent with legal duties.
8.2 Isolated backups are erased or overwritten within 90 days after active deletion, access remains restricted, and any restoration reapplies deletion instructions. Required statutory records and lawful holds are separated and used only for their lawful purpose and period. AgencyPin confirms deletion on reasonable request and identifies any legally retained categories and basis. Data must not be withheld solely to compel payment where this would defeat mandatory return or deletion rights.
9.1 Contractual liability between the parties follows section 12 of the Agreement to the extent lawful. This does not restrict data subjects, supervisory authorities, statutory compensation, GDPR Article 82 allocation or SCC rights. No automatic indemnification of fines or transfer of AgencyPin's statutory responsibilities is created.
9.2 Amendments follow the Agreement and cannot reduce mandatory protections. This DPA is effective through the same authorized acceptance as the Order. It is a standard form; the accepted deployment record is part of it and must reflect the actual service before live processing.