Data Processing Agreement

Last updated: 2 August 2026
Effective date: 11 July 2026

This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service (the "Agreement") between Backline Limited ("Backline", "Processor") and the customer that accepts those Terms (the "Client", "Controller"). Where a Client accepts the Terms, including electronically when creating or being granted an account, the Client also accepts this DPA. A Client that requires a countersigned copy for its records may request one from ds@backlineagency.co.uk; the terms are the same.

This DPA governs Backline's processing of personal data on the Client's behalf and reflects the parties' obligations under the UK GDPR, the Data Protection Act 2018, and, where applicable, the EU GDPR (together, "Data Protection Law"). It supplements the Privacy Policy. Where this DPA conflicts with the Agreement on the subject of data processing, this DPA prevails.

1. Roles of the parties

For the personal data Backline processes on the Client's behalf to provide the platform (the "Client Personal Data"), the Client is the controller and Backline is the processor. Backline processes Client Personal Data only on the Client's documented instructions, which are given by the Agreement, this DPA, the Client's configuration and use of the platform, and any further written instructions the Client provides. For Backline's own account, authentication, and platform-usage data, Backline is an independent controller, as described in the Privacy Policy.

2. Subject-matter and details of processing

• Subject-matter: provision of the Backline analytics platform and its features.
• Duration: for the term of the Agreement, plus the return/deletion period in Section 9.
• Nature and purpose: retrieving, aggregating, storing, analysing, and displaying analytics on the Client's behalf, and generating AI-assisted insights, so the Client can manage and analyse its artists and projects.
• Types of personal data: as set out in Annex 1.
• Categories of data subjects: as set out in Annex 1.
• Special category data: none is required or intended. The Client must not upload or connect special category data (Article 9) or criminal-offence data through the platform.

3. Backline's obligations as processor

Backline shall:

1. Process only on instructions: process Client Personal Data only on the Client's documented instructions, including for international transfers, unless required to do otherwise by law (in which case Backline will inform the Client first, unless the law prohibits it).
2. Confidentiality: ensure that personnel authorised to process Client Personal Data are bound by confidentiality obligations and are trained on data protection at induction and periodically thereafter.
3. Security: implement the technical and organisational measures set out in Annex 2, appropriate to the risk.
4. Sub-processors: engage sub-processors only in accordance with Section 7.
5. Assist the Client: taking into account the nature of processing, assist the Client by appropriate measures in responding to data-subject requests (Section 8) and in meeting its obligations on security, breach notification, data protection impact assessments, and prior consultation (Articles 32–36).
6. Breach notification: notify the Client without undue delay, and in any event no later than 48 hours, after becoming aware of a personal data breach affecting Client Personal Data, with the information the Client reasonably needs to meet its own notification duties.
7. Deletion or return: at the Client's choice, delete or return Client Personal Data as set out in Section 9.
8. Demonstrate compliance: make available the information reasonably necessary to demonstrate compliance with Article 28 and allow for and contribute to audits as set out in Section 10.
9. Flag unlawful instructions: inform the Client if, in Backline's opinion, an instruction infringes Data Protection Law.

4. Client's obligations as controller

The Client shall:

1. Ensure it has a lawful basis and all necessary rights, consents, and permissions for Backline to process the Client Personal Data, and that its instructions comply with Data Protection Law.
2. Only connect third-party platforms and accounts it owns or is authorised to access, and only provide credentials or access grants it is entitled to share.
3. Not use the platform to process personal data of fans or consumers other than as the platform is designed to handle it, the platform is designed not to collect fan personally identifiable information, and rejects ticket-sales uploads that appear to contain buyer personal data.

5. AI processing

Where AI-assisted features process Client Personal Data, that data is sent to Backline's AI sub-processor (Anthropic) under commercial terms that prohibit its use to train the provider's models and retain it only as long as needed to provide the service. AI output is analytical assistance, not professional advice, and does not constitute a decision producing legal or similarly significant effects on a data subject.

6. International transfers

Backline processes and stores Client Personal Data primarily in the EU. Where Backline or a sub-processor transfers Client Personal Data outside the UK or EEA to a country without a UK adequacy decision, the transfer is made under an appropriate safeguard, in practice the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures identified by a proportionate Transfer Impact Assessment. The Client authorises these transfers and the reliance on those mechanisms.

7. Sub-processors

1. The Client gives general authorisation for Backline to engage sub-processors to process Client Personal Data. The current sub-processors are listed at /subprocessors and in Annex 3.
2. Backline imposes on each sub-processor data-protection obligations equivalent to those in this DPA and remains liable to the Client for a sub-processor's performance.
3. Backline will give the Client advance notice of any intended addition or replacement of a sub-processor by updating the sub-processors page and notifying Clients who subscribe to changes at ds@backlineagency.co.uk. The Client may object on reasonable data-protection grounds within 14 days; the parties will work in good faith to resolve the objection, and if they cannot, the Client may terminate the affected service.

8. Data-subject requests

Backline will, taking into account the nature of the processing, assist the Client by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects exercising their rights under Data Protection Law. Where a data subject contacts Backline directly about Client Personal Data, Backline will refer them to the Client and act only on the Client's instructions.

9. Return and deletion

On termination of the Agreement, or on the Client's earlier written request, Backline will, at the Client's choice, delete or return the Client Personal Data, and delete existing copies, within 90 days, unless it is required by law to retain it. Where a Client disconnects a specific integration, associated tokens and stored data for that integration are deleted or de-identified in line with the Privacy Policy.

10. Audit

Backline will make available to the Client information reasonably necessary to demonstrate compliance with this DPA. The Client may audit that compliance on at least 60 days' written notice, no more than once per 12 months (or more often following a personal data breach or where required by a supervisory authority), during business hours, without unreasonably disrupting Backline's operations, and subject to confidentiality. Backline may satisfy an audit request by providing relevant third-party certifications or reports where available.

11. Liability

Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Agreement. Nothing in this DPA limits either party's obligations or liability to a data subject or supervisory authority under Data Protection Law.

12. Governing law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, consistent with the Agreement.

Annex 1: Details of processing

Categories of data subjects

• The Client's authorised users (managers, label staff) who hold platform accounts.
• The Client's own audiences and prospects, only in aggregate, e.g. audience geography and counts, never identified individuals.
• Senders of emails to a project's optional context-intake address, where the Client enables it.

Types of personal data

• Account/identity data: name, email, authentication and session tokens, profile settings, project access, and content a user creates (notes, suggestions, comments, mentions, reactions).
• Aggregated analytics: streaming, catalogue and audience-geography statistics; social follower/engagement counts; advertising performance; website search-performance and site analytics; newsletter/CRM aggregate metrics and subscriber counts; aggregate ticket-sales totals; press-coverage metadata. These are aggregate figures and counts, not data identifying individual listeners, visitors, subscribers, or ticket buyers.
• Landing-page interaction data: non-identifying destination, country (from edge headers), device type/OS, and timestamp. No fan name, email, or IP is stored.
• Account-security events: sign-ins, password changes, and 2FA enrolment/reset, with approximate IP and user-agent.

Special categories: none.

Annex 2: Technical and organisational measures

• Access control: Row-Level Security and role-based access so users see only the projects they are authorised for; least-privilege service access.
• Authentication: invite-based provisioning with email confirmation, authentication rate limiting, and mandatory two-factor authentication on every account.
• Secret handling: credentials, API keys, and OAuth tokens handled server-side only, masked in any UI, never logged; single-use, expiring tokens for sensitive public flows.
• Encryption: encryption in transit (HTTPS) and at rest through infrastructure providers.
• Data minimisation: the platform is designed not to collect fan PII; ingested analytics are aggregate; uploads that appear to contain buyer personal data are rejected.
• Auditability: append-only admin, context, and account-security audit trails.
• Resilience & response: managed, backed-up infrastructure and a documented breach-response process.

Annex 3: Sub-processors

The current list of sub-processors, with their processing purpose, is published and kept up to date at /subprocessors. It forms part of this DPA.

This DPA is a working template aligned to how the Backline platform operates. It is not legal advice; both parties should satisfy themselves it meets their needs.

Backline Limited · Data protection contact: Daniel Starr, ds@backlineagency.co.uk