Draft – pending legal review. Not in force until Victoriny AB has completed the stated factual checks and adopted a final version.

Data Processing Agreement

Version 2026-10-25 · Legal

This Data Processing Agreement ("DPA") is part of the Terms of Service between the customer (the "Customer") and Victoriny AB (the "Processor"). The Customer acts as controller or, where the order says so, as a processor authorised by the relevant controller; Victoriny then acts as processor or sub-processor accordingly. Instructions from the Customer include properly authorised instructions given through that processor. The Customer warrants that it has the necessary authorisation and passes on the controller's relevant restrictions. This DPA does not cover Victoriny's own purposes as controller described in the Privacy Policy.

1. Subject matter, duration, nature and purpose

• Subject matter: providing Artistwing to the Customer.
• Duration: as long as the Terms of Service apply, and until the data has been deleted or returned.
• Nature: private media storage, publication the Customer approves, email and form submissions the Customer orders, receipt and classification of replies, administration of fan consent, AI generation the Customer approves, analysis and deletion. Processing is ongoing during the service.
• Purpose: only to provide the service as described in the Terms of Service and on the Customer's instructions.

2. Data subjects and types of data

• Data subjects: the Customer's team, artists and collaborators, curators and other professional contacts, fans, people who appear in or reply to the Customer's content, and recipients of the Customer's messages.
• Types of data: professional contact details, fans' email addresses and consent records, account identifiers, message content, images, voices and media metadata.
• Special categories of data, data on criminal offences, biometric data for identification and fan profiles of children are not allowed without separate written approval with documented safeguards and a legal basis.
• Recipients and international transfers are limited to the supplier register.

3. The Processor's obligations

• Instructions. The documented instructions are this DPA, the agreed service description, the settings the Customer approves and the actions it authorises and that are recorded. They do not allow unrelated reuse or model training. If EU or Member State law requires other processing, the Processor informs the Customer before processing, unless that law prohibits it on important grounds of public interest. The Processor informs the Customer immediately if it considers an instruction unlawful, suspends the affected processing and asks for clarification.
• Confidentiality. Everyone who processes the data is bound by confidentiality.
• Security. The Processor takes the measures in Annex 1 (Article 32 GDPR).
• Assistance. The Processor assists with data subjects' requests and with Articles 32–36 GDPR, taking into account the nature of the processing and the information available to it.
• Breaches. The Processor notifies the Customer without undue delay, and at the latest within 24 hours, after becoming aware of a personal data breach, first with the information available and then in phases. The notice describes the nature of the breach, the categories and approximate number of people and records where known, a contact point, the likely consequences and the measures taken or planned. The Processor preserves evidence, helps contain the breach and assists with Articles 33–34; the notice does not wait for the investigation to finish. The Customer decides on notifications to authorities and individuals unless the law requires the Processor to act.
• Return and deletion. At the end of the processing, at the Customer's choice, the Processor returns or deletes the personal data and deletes existing copies, unless EU or Member State law requires storage. Backups are isolated and expire within the maximum in Annex 1; if a backup is restored, deletions and opt-outs are reapplied before ordinary use. The Processor confirms the deletion on request.
• Audits. The Processor makes available the information needed to show compliance and allows and contributes to audits and inspections by the Customer or an independent auditor it appoints. Reasonable confidentiality, safety and notice arrangements protect other customers but must not prevent effective or urgent audits the law requires. Reasonable costs of routine audits may be agreed in advance; there is no charge for help needed because of the Processor's breach or a supervisory authority's requirement.

4. Sub-processors

The Customer authorises the sub-processors listed in the supplier register. The Processor gives at least 30 days' notice by email before a new or replacement sub-processor processes the Customer's data. The Customer may object within that period on reasonable data protection grounds. The Processor will then find an alternative, stop the affected processing, or let the Customer terminate the affected service without penalty and with a proportionate refund of unused prepaid fees before the new processing begins. An existing authorisation does not allow a materially new purpose or an undisclosed onward transfer. The Processor imposes equivalent Article 28 obligations on each sub-processor in writing and remains fully liable to the Customer for their performance (Article 28(4) GDPR).

5. Transfers outside the EU/EEA

The main database, sign-in and file storage are in the EU (Stockholm). Other processing, such as content delivery, remote support, AI inference, email and logs, takes place in the locations stated in the supplier register; no general promise of EU/EEA-only processing is made. Before a transfer to a third country, the Processor ensures a safeguard under Chapter V GDPR. Where standard contractual clauses are needed, Module 2 (controller to processor) or Module 3 (processor to processor) is used, with completed annexes, a transfer assessment and supplementary measures where required. The mandatory terms of the clauses prevail over this DPA.

6. Connected platforms

Platforms the Customer connects and publishes to (for example Meta, TikTok and Google/YouTube) normally act under their own terms for their own purposes. Their role for each actual data flow is stated in the supplier register.

7. Liability and precedence

The allocation of liability between the parties follows the Terms of Service. It does not limit data subjects' rights, the powers of supervisory authorities, the Processor's responsibility under Article 28(4) GDPR or rights under mandatory standard contractual clauses. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.

Annex 1: Security measures

• Each workspace is separated from others in the database by row-level security, and server functions act for one workspace at a time.
• Encryption in transit (TLS) and at rest.
• Files are stored privately and shared only through short-lived signed links, or publicly when the Customer publishes them.
• Access tokens for connected channels are stored encrypted in a dedicated vault, and reads are logged.
• Roles within each workspace (owner, admin, editor, approver, viewer), least-privilege access for staff and strong authentication for privileged accounts.
• Logging of access and administrative actions without unnecessary message content or secrets.
• Patch and vulnerability management, incident response and deletion procedures covering active systems and backups.
• Backups and the ability to restore. Backup cycle, maximum backup retention and the interval for restore tests: [BACKUP SCHEDULE].
• Hard usage limits per workspace.

The overall level of protection will not be materially reduced.