Data processing agreement
Applies when Houselist processes personal data on the client’s behalf. It is part of the terms.
Draft: this text has not been reviewed by a lawyer yet.
Parties and roles
The client is the controller, and Modgift ApS, CVR DK46722779 ("Houselist"), is the processor for the personal data the client enters into Houselist to use the service, such as names in playlist titles, descriptions and images. For the client’s own account and billing, Houselist is itself the controller (see the privacy policy).
Houselist: Fenstenvej 10, DK-8300 Odder, [email protected].
The processing
- Purpose: providing Houselist under the terms: storing, showing and publishing the client’s playlists.
- Duration: as long as the client has an account.
- Types of data: ordinary personal data the client enters. The client must not enter special categories of data.
- Data subjects: people the client’s content names or shows.
Instructions
Houselist processes the data only on the client’s documented instructions, which are the terms and the client’s use of the service. If Houselist believes an instruction breaks the law, it says so at once.
Confidentiality and security
Everyone with access to the data is bound by confidentiality. Houselist has appropriate technical and organisational measures under Art. 32, including encryption in transit, row-level access control in the database, sign-in without passwords and backups.
Sub-processors
The client gives general authorisation to use sub-processors. The current ones are Cloudflare, Supabase (EU), Resend, Frisbii and Google Workspace. Houselist tells the client 30 days before adding a new one, so the client can object. Sub-processors are bound by the same obligations as Houselist.
Transfers to third countries
Transfers outside the EU/EEA happen only with a valid transfer basis under Chapter V, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
Assistance
Houselist helps the client answer data subjects’ requests and meet its obligations under Art. 32–36, as far as is reasonable.
Personal data breaches
Houselist notifies the client without undue delay, and no later than 48 hours after becoming aware of a breach, with the information the client needs for its own notification.
When the agreement ends
When the client deletes its account, Houselist deletes the data at once; backups are overwritten within 7 days. The client can download its data first.
Audits
Houselist makes available the information needed to show compliance with this agreement and allows audits with reasonable notice, at the client’s cost.