Data Processing Agreement

1. Parties and scope

This agreement is between you, the artist or account holder (“you”, the controller), and LL Platforms UG (haftungsbeschränkt), Wuhlestraße 7a, 12683 Berlin, Germany (“we”, the processor). It is part of our Terms of Service and applies to the personal data of fans that we process on your behalf. It applies as long as your account exists, and afterwards until that data is deleted. Where this agreement and the Terms of Service differ on data protection, this agreement prevails.

2. What we process for you

• Purpose: keeping your fan list, confirming sign-ups (double opt-in), sending the emails your fans signed up for in your name, handling unsubscribes and bounces, and letting you view, download and remove fans.
• Data: email address, the release or bio link a fan signed up on, the platform they chose, their status (pending, confirmed, unsubscribed, bounced) and the dates of sign-up, confirmation and unsubscribing.
• People concerned: fans who sign up on your release pages or your bio link.

3. Your instructions

We process the data only on your documented instructions, which you give through the settings and features of meloshare (for example switching release emails on, removing a fan, or deleting your account) or by email. We use the data for no other purpose, in particular not for our own marketing, and we don’t combine it with other artists’ lists. If we believe an instruction breaks data protection law, we will tell you.

4. Your responsibilities

You are responsible for the lawfulness of the processing, for using the list only as fans agreed, and for answering fans who contact you about their data. If you download the list, you are its sole controller from then on.

5. Confidentiality and security

Everyone at meloshare who can access the data is bound to confidentiality. We protect the data with technical and organisational measures appropriate to the risk (Art. 32 GDPR), in particular:

• encryption of all connections (HTTPS) and of stored data at our providers,
• storage in data centres in the EU (Frankfurt, Germany),
• access rules in the database that let each account see only its own fans,
• access by our team only where needed to run or support the service, with personal accounts,
• regular backups, and updates of the software we use.

6. Subprocessors

You agree that we use these subprocessors:

• Supabase Pte. Ltd. (Singapore): database and storage, data stored in Frankfurt, Germany; EU standard contractual clauses for any access from outside the EU.
• Resend, Inc. (USA): sending emails; EU-U.S. Data Privacy Framework and EU standard contractual clauses.
• Cloudflare, Inc. (USA): hosting and network; EU-U.S. Data Privacy Framework and EU standard contractual clauses.

We bind every subprocessor to the same data protection duties as this agreement. We will tell you by email at least 30 days before we add or replace a subprocessor. If you object for a good reason relating to data protection and we can’t find a solution together, you can end the contract before the change takes effect.

7. Helping you

We help you answer fans who exercise their rights: you can look up, download and remove fans yourself, unsubscribes take effect automatically, and we pass on any request we receive directly. We also support you, as far as we can, with security, reports of data breaches and data protection impact assessments (Art. 32 to 36 GDPR).

8. Data breaches

If we become aware of a breach affecting your fans’ data, we will tell you without undue delay, at the latest within 48 hours, with the information you need to meet your own duties.

9. When the contract ends

You can download your fan list at any time. When you delete your account, or a fan is removed, we delete the data within 30 days, unless the law requires us to keep it.

10. Checks

We give you the information you need to see that we keep to this agreement, in the first place in writing. If that is not enough, you or an auditor bound to confidentiality may check on site after reasonable notice, during business hours, without disrupting our operations, and at your own cost.

11. Liability and contact

Liability between us follows Art. 82 GDPR; otherwise, the liability rules of our Terms of Service apply. Questions about this agreement go to support@meloshare.com.