DATA PROCESSING AGREEMENT

This agreement (in Norwegian, databehandleravtale) is between the customer that runs a production in Showrunner (the controller) and Diverse AS, org.nr. 937 775 466 (the processor). It meets the requirements of article 28 of the GDPR and forms part of the Terms of Service. If the two conflict on data protection, this agreement takes precedence.

It covers personal data the customer adds to Showrunner about other people, such as cast, crew, extras and location contacts. Data about Showrunner account holders that we handle for our own purposes is covered by our Privacy Policy, where we are the controller.

• Purpose and nature: providing Showrunner to the customer, which means storing, organising, displaying and sending production data (for example emailing call sheets), encoding video, and running AI features when the customer uses them.
• Duration: for as long as the customer uses Showrunner, plus the deletion period in section 7.
• People concerned: cast, crew, extras, contacts, location owners and other people involved in the customer’s productions, and the customer’s users.
• Types of data: names, roles and departments, contact details, addresses, schedules and availability, photos and headshots, video footage, wardrobe measurements, emergency contacts, contracts, timesheets, expenses and notes.
• Sensitive data: Showrunner is not designed for special categories of personal data. If the customer records any, such as dietary or medical needs, it is responsible for having a lawful basis, and we protect that data in the same way as all other data.

• We process the data only on the customer’s documented instructions. These terms and the customer’s use and settings of Showrunner are those instructions. We tell the customer if we believe an instruction breaks data protection law.
• Everyone with access to the data is bound by confidentiality.
• We keep the security measures in section 4 in place.
• We help the customer respond to requests from the people concerned (access, correction, deletion and so on), through Showrunner’s features and through support.
• We help the customer with data protection impact assessments and with consulting the Data Protection Authority, where that is reasonable.
• We notify the customer of a personal data breach without undue delay, and where possible within 48 hours of becoming aware of it, with the information the customer needs to meet its own obligations.
• We give the customer the information it needs to show compliance with article 28, as described in section 8.

• All traffic is encrypted in transit (TLS), and data is encrypted at rest.
• Access inside a production is limited by the roles and permissions its administrators set. Direct database access is denied by default.
• Sessions use signed, expiring tokens. We don’t store passwords.
• Staff access to production systems is limited to the people who need it.
• Backups are taken regularly and rotated out within 30 days.

The customer gives general authorisation for us to use the sub-processors below. Each is bound by a written agreement with data protection obligations at least as strict as these.

We’ll announce new or replaced sub-processors on this page, and by email to production owners, at least 30 days in advance. The customer may object on reasonable data protection grounds. If we can’t resolve the objection, the customer may stop using Showrunner and end the agreement.

Where a sub-processor processes data outside the EU/EEA, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

The customer can export or delete its production data at any time, and for 30 days after it stops using Showrunner we’ll help with an export on request. We delete the remaining data within 90 days after the agreement ends. Backups are rotated out within 30 days after that, unless the law requires us to keep something longer.

On request, we answer reasonable written questions about how we protect the data. If that isn’t enough, the customer may have an audit carried out, at its own cost, with 30 days’ notice and no more than once a year, unless a breach or a Data Protection Authority requires one sooner. Auditors must be bound by confidentiality.

Liability under this agreement follows the Terms of Service, without limiting the rights of the people concerned under article 82 of the GDPR. Norwegian law applies.

Contact for data protection matters: privacy@showrunner.no.