Data Processing Addendum

Between the creator or organisation that accepts the Creator Terms of Service (“Controller”, “you”) and Famclaim Ltd, company number 17538804, 34 Yarrow Road, ME5 0RY, United Kingdom (“Processor”, “Famclaim”). This DPA forms part of the Creator Terms and is accepted when you accept them. It meets Article 28 of the UK GDPR and, where it applies, the EU GDPR.

1. Scope and roles

Famclaim processes personal data in your fam list (and related Fan data such as keywords unlocked and email delivery status) on your behalf. You are the controller and Famclaim is the processor. The subject matter, duration, nature, purpose, data types and data subjects are in Annex 1. Famclaim is a controller, not a processor, for its own purposes described in the Privacy Policy (creator accounts, billing, security, and the Famclaim fan account used for verification and device recognition).

2. Our obligations as processor

1. Instructions. We process the data only on your documented instructions, which are the Creator Terms, this DPA and your use of the dashboard. If we think an instruction breaks data protection law we will tell you.
2. Confidentiality. Everyone we authorise to process the data is bound by confidentiality.
3. Security. We apply the measures in Annex 2.
4. Sub-processors. You give general authorisation for the sub-processors in Annex 3. We will give at least 30 days’ notice of any new or replacement sub-processor. You may object on reasonable data protection grounds within 14 days; if we cannot resolve it within 30 days you may close your account and receive a pro-rata refund of prepaid fees. We bind each sub-processor to obligations no less protective than this DPA and remain liable to you for their performance.
5. Data subject requests. We give you the tools (export, delete, unsubscribe) and reasonable help to answer requests. If a Fan contacts us about a fam-list entry we will tell them how to reach you, may pass the request to you, and may act on an unsubscribe or erasure request directly so that the Fan’s choice is honoured.
6. Breaches. We notify you without undue delay and within 48 hours of becoming aware of a personal data breach affecting your data, with the information you need to assess and report it.
7. Assistance. We help with security, breach notification, data protection impact assessments and consultation with regulators, taking account of the information we hold.
8. Return and deletion. On closure you can export your data for 30 days. We then delete it, and our copies, within 60 days, unless the law requires us to keep it. Backups are overwritten in the normal cycle.
9. Audit. We give you the information reasonably needed to show our compliance and allow reasonable audits (usually by questionnaire and documents) on notice, no more than once a year unless a breach or regulator requires more.

3. Your obligations as controller

You are responsible for having a lawful basis (for emails, consent) and giving Fans the information the law requires, for the lawfulness of your instructions, and for the points in section 4 of the Creator Terms.

4. International transfers

We process your data in the UK and, via our sub-processors, in the United States. We transfer data outside the UK only under the UK’s adequacy regulations (including the UK–US data bridge where the recipient is certified) or the UK International Data Transfer Addendum to the EU standard contractual clauses. For transfers that need them, the clauses are incorporated by reference.

5. Liability, precedence and term

Each party’s liability under this DPA is subject to the limits in the Creator Terms, except where the law does not allow limiting it. If this DPA conflicts with the Creator Terms on data protection, this DPA prevails. It lasts as long as we process your data.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption in transit between users, Famclaim and our providers.
• One-time-code verification of Fans and secure password handling for creators.
• Role-based, least-privilege access to production data for Famclaim staff and tools; separation of each creator’s data.
• Logging and monitoring of access and security events; regular software updates.
• Due diligence and written data protection terms with providers.
• Backups and an incident response and breach notification process.
• Deletion of one-time codes after use or expiry.

Annex 3: Approved sub-processors

Sub-processor notices: privacy@famclaim.com