Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between KONAH MEDIA GROUP LLC ("Processor") and the studio account owner ("Controller") and applies when KONAH processes personal data on the Controller's behalf, including personal data of the Controller's clients, under the GDPR, UK GDPR and similar laws.

1. Scope. Subject matter: hosting, delivering and organizing the Controller's content and client records. Duration: the term of the Terms plus the deletion period. Nature and purpose: storage, transmission, display and the features the Controller uses. Data subjects: the Controller's clients, contacts and team members, and people depicted in content. Data types: names, contact details, messages, images and videos.
2. Instructions. KONAH processes personal data only on the Controller's documented instructions (these Terms and the Controller's use of the Service), unless the law requires otherwise, in which case we'll inform the Controller where legally permitted.
3. Confidentiality. Anyone authorized to process the data is bound by confidentiality.
4. Security. KONAH implements appropriate technical and organizational measures, including encryption in transit, encrypted storage at providers, role-based access, salted password hashing and logging.
5. Subprocessors. The Controller authorizes the subprocessors listed on our Subprocessors page. We'll give at least 30 days' notice of new subprocessors on that page or by email, and the Controller may object on reasonable data-protection grounds. We impose data-protection obligations on subprocessors and remain responsible for them.
6. Data subject requests. KONAH will help the Controller respond to requests to exercise data subject rights, taking into account the nature of the processing.
7. Personal data breaches. KONAH will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available.
8. Assistance. KONAH will reasonably assist with data protection impact assessments and consultations with supervisory authorities.
9. Deletion. At the end of the Service, KONAH will delete the Controller's personal data (the Controller can export it first), from active systems promptly and backups within 90 days, unless the law requires retention.
10. Audits. KONAH will make available information reasonably necessary to demonstrate compliance and allow for reasonable audits, no more than once a year, on reasonable notice.
11. International transfers. Transfers of personal data from the EEA, UK or Switzerland to countries without an adequacy decision are governed by the Standard Contractual Clauses (Module 2, and Module 3 where applicable) and the UK International Data Transfer Addendum, which are incorporated by reference.

To request a countersigned copy, email privacy@konahmedia.com.