Data Processing Agreement

BETWEEN: Customer / Venue ("Data Controller") AND Showrunner ApS, CVR DK46298020, Tornerosevej 106, 2730 Herlev, Denmark ("Data Processor")

1. Scope and Purpose of Processing

The Processor shall process personal data on behalf of the Controller solely to provide the Showrunner venue management software services, including document extraction, contract management, settlement processing, and ticket sales tracking.

2. Categories of Data & Data Subjects

• Data subjects: venue staff, promoters, booking agents, tour managers, artists, and ticket buyers.
• Categories of data: contact details (names, emails, phone numbers), financial settlements, performance contracts, email text metadata, and ticket transaction metadata.

3. Processor Obligations

1. Instructions: the Processor shall process personal data exclusively on documented instructions from the Controller.
2. Confidentiality: the Processor guarantees that staff authorized to process personal data have committed themselves to confidentiality.
3. Security: the Processor shall implement technical and organizational measures in accordance with GDPR Article 32 (encryption in transit and at rest, access restriction, system resilience).
4. Data subject rights: the Processor shall assist the Controller by appropriate technical measures in fulfilling requests under GDPR Chapter III (access, erasure, rectification).

4. Subprocessors, AI Processing and International Transfers

1. General authorisation. The Controller grants the Processor general written authorisation to engage the subprocessors listed in Showrunner's Privacy Policy, which forms an integral part of this Agreement. That list is the authoritative record of the subprocessors engaged at any time.
2. Notice of changes and right to object. The Processor shall inform the Controller in writing of any intended addition or replacement of a subprocessor at least 30 days before the change takes effect, giving the Controller the opportunity to object to the change before it is implemented. Notice is given by email to the Controller's designated workspace administrators. Removing a subprocessor, or narrowing the categories of data a subprocessor processes, may take effect immediately, as it cannot prejudice the Controller.
3. Flow-down and liability. The Processor shall impose on each subprocessor, by contract, data-protection obligations providing at least the same level of protection as those set out in this Agreement, and remains fully liable to the Controller for the performance of that subprocessor's obligations.
4. AI processing. Where personal data is processed by an artificial-intelligence service — for automated extraction of ingested emails, documents and images, or for the optional in-app AI support assistant:
   • Processing takes place on Amazon Bedrock within the European Union (Frankfurt, eu-central-1) using an EU-geography inference profile, which routes inference requests only to AWS Regions within the European Union. No transfer to a third country occurs for this processing.
   • Amazon Bedrock does not use Controller input or output data to train or improve any model and does not share it with the underlying model provider (per AWS: “your content is not used to improve the base models and is not shared with any model providers”); the model provider has no access to the AWS accounts in which inference takes place, and therefore has no access to Amazon Bedrock's logs or to Controller prompts and completions.
   • The Controller may disable AI extraction entirely for its workspace at any time through the Showrunner application, without loss of the remaining Services.
5. Third-country transfers. Personal data processed under this Agreement is processed within the European Union, with the following exception: inbound mail infrastructure (Google Workspace, per the subprocessor list in Showrunner's Privacy Policy) may process data outside the EU, governed by EU Standard Contractual Clauses and the EU-US Data Privacy Framework. No third-country transfer occurs for the AI processing described above.
6. Onward transfer. The Processor shall not transfer personal data to a third country or an international organisation without the Controller's prior authorisation, except where required by Union or Member State law to which the Processor is subject, in which case the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.