Data processing agreement

1. Scope

This agreement is part of the Unsleeve terms and applies to every plan, including Free. It is the contract under Article 28 GDPR between you as controller and FUTR UG (haftungsbeschränkt), Eiffestraße 78, 20537 Hamburg, Germany, as processor (“we”). You conclude it electronically when you accept the terms.

If you run a workspace for a client, such as an artist you manage, and are a processor yourself, we act as your sub-processor. You make sure your client’s instructions reach us through you.

2. Who is responsible for what

Roles follow what actually happens:

We do not use personal data of your visitors or fans for our own product improvement. Platform-wide figures are used only in aggregated form.

3. Instructions

We process personal data only on your documented instructions, unless Union or Member State law requires otherwise. If it does, we tell you first where that law allows it. Your instructions are these terms, this agreement and what you set in the app, for example pixels, consent settings and fan sign-ups. You can give further instructions by email to unsleeve-feedback@futrhodl.de. If we think an instruction breaks data protection law, we tell you at once and can pause it.

4. Confidentiality and security

Everyone we authorise to process this data is bound to confidentiality. We take the measures in Annex 3, as Article 32 GDPR requires. We can improve them, as long as protection does not drop.

5. Sub-processors

You authorise the sub-processors in Annex 2. We tell you by email at least 30 days before adding or replacing one. You can object in that time on data protection grounds. If we cannot solve it, you can end the affected service before the change takes effect. We bind each sub-processor to the same data protection duties and remain fully liable to you for its work.

6. Transfers outside the EEA

We transfer personal data outside the EEA only as Annex 2 describes. If you connect a platform pixel, the data goes to that platform on your instruction. The platform is not our sub-processor. Audio previews load directly from the music service when a visitor presses play.

7. Requests from people

Fan contacts can be searched, exported and deleted in the app, and each email has an unsubscribe link. If someone contacts us directly about data on your pages, we forward the request to you and do not answer it ourselves, unless you ask us to. We help you with requests under Chapter III GDPR as far as you cannot handle them in the app.

8. Help and data breaches

We help you with your duties under Articles 32 to 36 GDPR, taking account of the nature of the processing and the information we have. We notify you by email without undue delay after we become aware of a personal data breach affecting your data, with the details we know at that point.

9. End of the service

You choose what happens to the data at the end: export it first with the exports in section 12 of the terms, then delete the workspace. We erase its data after 30 days. Backups expire as Annex 1 says. We keep data longer only where the law requires it. If you cancel a paid plan without deleting the workspace, it continues on Free and this agreement continues with it.

10. Information and audits

We give you the information you need to show that we meet Article 28 GDPR. You can audit us, or have an auditor bound to confidentiality do so, if this information is not enough or if an authority requires it. Tell us 30 days ahead unless an authority sets a shorter time. You bear your own costs, and audits must not disturb our operations more than needed.

11. Your responsibilities

• You need a legal basis for what you do with visitor and fan data, and you inform people about it. Without your own link, your pages show our fallback notice. Your own link replaces it, and it must then cover this processing.
• You choose the consent settings for your pixels and page routing.
• Your legal notice and privacy address must be correct, so that people can reach you.
• On small pages, statistics and raw exports can point to individual visitors. Use them for statistics only. Do not try to identify anyone.
• Delete fan contacts you no longer need.

12. Liability and priority

Section 16 of the terms applies, without limiting the rights of data subjects under Article 82 GDPR. If this agreement and the terms conflict on data protection, this agreement takes priority.

Annex 1: Processing details

Retention:

Annex 2: Sub-processors

Annex 3: Technical and organisational measures

• Server access. Sign-in with keys only, no root login, firewall open only for the ports we need, brute-force protection, automatic security updates.
• Database. Reachable only from the server itself. Production and staging use separate databases.
• App access. No passwords: sign-in by email link valid for 15 minutes, stored hashed, or with Google. Session cookies are HTTP-only. Roles and permissions per workspace, and a log of actions in each workspace.
• Transfer and encryption. Connections use HTTPS. Pixel access tokens are stored encrypted with AES-GCM.
• Data minimisation. Statistics contain no IP address field. Visitors are counted with a hash built with a random daily key, which is discarded after the day. The dashboard shows fan addresses only masked, and exports are logged.
• Abuse limits. Rate limits on forms, events and emails.
• Availability. Public pages keep running if our main server fails. Daily and weekly database backups in EU storage, a monthly automatic restore test, and uptime checks every five minutes.
• Error reports. Our server removes database query values from error reports.