Data Processing Agreement
Verwerkersovereenkomst
This agreement supplements section 12 of the BEAMS Terms of Service. Section 12 already binds every account. This document is the standalone version, for customers whose own clients, labels or legal teams require a separate signable agreement with the annexes that Article 28(3) GDPR calls for.
1. Parties
Processor: Momo Agency, a sole proprietorship (eenmanszaak) registered in the Netherlands under Chamber of Commerce (KVK) number 86057049, VAT number NL004182651B71, registered at Johan David Zocherstraat 95, 2272 KB Voorburg, the Netherlands, trading as BEAMS ("we", "us", "our").
Controller: the person or organisation holding a BEAMS account and accepting this agreement ("you", "your").
Together, the "parties".
2. What this agreement covers
This agreement applies to personal data about other people that you enter into or generate in BEAMS — promoter and venue contacts, crew and agent details, guestlist names, lineup names, signatories on contracts, and notes about individuals. In respect of that data you are the controller and we are the processor.
It does not apply to your own account data — your name, email address, billing details and usage of the Service. In respect of that data we are the controller, and the Privacy Policy governs it.
Capitalised terms not defined here have the meaning given in Regulation (EU) 2016/679 (the "GDPR") and in the Terms of Service.
3. Duration
This agreement takes effect when you accept it or first enter personal data about another person into BEAMS, whichever is earlier, and continues for as long as we process that data on your behalf. Sections 10, 11 and 13 survive termination.
4. Your instructions
Your documented instructions consist of this agreement, the Terms of Service, the Privacy Policy, and your use of the features of the Service. We will not process the personal data for any other purpose.
We will tell you if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection law. We may suspend the affected processing until the instruction is withdrawn or amended.
If we are required by Union or Member State law to process the personal data otherwise than on your instructions, we will inform you of that requirement before processing, unless that law prohibits us from doing so on important grounds of public interest.
5. Your obligations as controller
You warrant that:
(a) you have a lawful basis under Article 6 GDPR for entering and processing personal data about third parties in the Service, and, where any of it falls within Article 9, a condition under that Article;
(b) you have given the people concerned any information required of you under Articles 13 and 14 GDPR;
(c) your instructions to us will not cause either party to breach data protection law; and
(d) you will not enter special categories of personal data, criminal conviction data, or the personal data of children into the Service. The Service is not designed for, and our security measures are not calibrated to, data of that kind.
6. Our obligations as processor
We will:
(a) process the personal data only on your documented instructions, as described in section 4;
(b) ensure that every person we authorise to access the personal data is bound by an obligation of confidentiality, whether by contract or by statute;
(c) implement and maintain the technical and organisational measures set out in Annex 2;
(d) respect the conditions in section 9 for engaging another processor;
(e) taking into account the nature of the processing, assist you by appropriate technical and organisational measures, so far as possible, in fulfilling your obligation to respond to requests to exercise data subject rights, as described in section 7;
(f) assist you in complying with Articles 32 to 36 GDPR — security, breach notification, data protection impact assessments and prior consultation — taking into account the nature of processing and the information available to us;
(g) at your choice, delete or return the personal data at the end of the provision of services, as described in section 13; and
(h) make available to you the information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, as described in section 10.
7. Data subject requests
The Service gives you direct access to the personal data you hold in it. You can view, correct, export and delete it yourself, at any time, without asking us. In most cases that is the whole of the assistance required.
Where you need more, we will assist you so far as is reasonably possible. If a data subject contacts us directly about data held in your account, we will not respond on the substance; we will tell them to contact you, and inform you promptly.
We may charge for assistance that requires material effort beyond the self-service tools, at a rate agreed in advance.
8. Security
We implement and maintain the technical and organisational measures set out in Annex 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to the rights and freedoms of natural persons.
We may change individual measures over time. We will not reduce the overall level of security during the term of this agreement.
9. Sub-processors
You give general written authorisation for us to engage the sub-processors listed in Annex 3.
Before adding or replacing a sub-processor we will give you notice, by email or in the Service, at least thirty (30) days before the change takes effect. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may terminate the affected subscription and we will refund the unused portion of any fees paid in advance.
We will impose on each sub-processor, by contract, data protection obligations no less protective than those in this agreement. Where a sub-processor fails to fulfil those obligations, we remain fully liable to you for its performance.
10. Audit and information
On reasonable written request we will provide the information necessary to demonstrate compliance with Article 28 GDPR, including the measures in Annex 2 and the sub-processor terms in section 9.
Where that is not sufficient, you may audit, or appoint an independent auditor to audit, our processing. Audits will take place on at least thirty (30) days' written notice, during business hours, no more than once in any twelve-month period, and without unreasonable disruption. A supervisory authority may require an audit at any time and the limits in this paragraph do not apply to it. You bear the cost of an audit you initiate, unless it reveals a material breach of this agreement.
11. Personal data breach
We will notify you without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting personal data processed on your behalf.
The notification will describe, so far as we know it at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. Where we cannot provide all of it at once, we will provide it in phases without further undue delay.
Notifying a supervisory authority or the data subjects is your decision and your obligation as controller. We will not make either notification on your behalf unless you ask us to in writing.
12. International transfers
The personal data is stored in the European Union. Where any transfer outside the European Economic Area occurs — in the course of support, administration or email delivery by the providers in Annex 3 — it is covered by the European Commission's Standard Contractual Clauses or another valid transfer mechanism under Chapter V GDPR.
13. Deletion and return
You can delete personal data from the Service yourself at any time.
On termination of your account you may, within thirty (30) days, export the personal data using the export tools in the Service. After that period we will delete it, including from any backup copies then held, in the ordinary course of backup rotation, unless Union or Member State law requires us to keep it. Where law requires retention, we will keep it only for as long as, and for the purpose for which, retention is required, and continue to protect it under this agreement.
14. Liability and precedence
The limitations and exclusions of liability in the Terms of Service apply to this agreement, and liability under both together is subject to a single aggregate cap.
If this agreement conflicts with the Terms of Service or the Privacy Policy, this agreement prevails in respect of the processing it covers.
15. Governing law
This agreement is governed by the laws of the Netherlands. The courts of Amsterdam have exclusive jurisdiction, subject to the consumer protections in section 14 of the Terms of Service.
Annex 1 — Details of the processing
Subject matter. Provision of the BEAMS booking agenda: storing and making available the bookings, contacts, contracts and related records that you enter.
Duration. For as long as your account is open, plus the retention periods in section 13.
Nature of the processing. Collection, recording, organisation, structuring, storage, retrieval, consultation, use, transmission by email where you send a contract or invitation, erasure and destruction — all carried out by automated means.
Purpose of the processing. To provide the Service to you: to let you record and manage bookings, keep contact details, generate and send performance contracts for signature, and share a calendar where you choose to.
Types of personal data.
• Names and artist or professional names
• Email addresses and telephone numbers
• Company or organisation names and roles
• Postal addresses of venues and accommodation
• Contract signature records — signatory name, email address, IP address, browser user agent and timestamp
• Free-text notes, day sheets, itineraries, lineups and guestlist entries, whose content you determine
• Fee and deal-term figures associated with named individuals or organisations
Categories of data subjects.
• Promoters, venue staff and bookers
• Agents, managers and other representatives
• Artists and other performers on a lineup
• Crew, drivers and technical staff
• Guestlist attendees
• Any other individual you choose to record
Special categories of personal data. None. Section 5(d) of this agreement prohibits entering them.
Annex 2 — Technical and organisational measures
These are the measures in place under Article 32 GDPR.
Separation of customer data. Every table holding customer data enforces row-level security in the database itself, so that a query can only return rows belonging to the requesting account. Access is decided by the database, not by the application, and a fault in the application cannot widen it.
Access control. Accounts are protected by email and password, or by a one-time code sent to a verified email address. Passwords are stored only as a one-way hash and cannot be read by us. Sessions expire, and an idle session is signed out automatically.
Encryption. All traffic between the browser and our systems, and between our systems and sub-processors, uses TLS. Data is encrypted at rest by the database provider.
Administrative credentials. Keys capable of bypassing row-level security exist only in server-side environment variables of our serverless functions. They are never present in the browser, in application source, or in any client the customer receives.
Local data on the device. The application keeps a working copy on the device for offline use. Signing out erases it, including the browser cache store.
Logging. Server-side functions log operational events. Logs are retained by the infrastructure provider on its standard schedule and are not used for any purpose other than operating and securing the Service.
Resilience and restoration. The database is operated by Supabase on Amazon Web Services infrastructure in the eu-central-1 (Frankfurt) region and relies on that provider's storage-level redundancy. We do not presently hold independent backup copies of the database, and we therefore make no commitment as to restoration time or recovery point. The Service provides export tools that allow you to take your own copy of your data at any time, and you are responsible for retaining copies of data you cannot afford to lose. We will update this Annex, and tell you, if and when scheduled backups with point-in-time restoration are introduced.
Testing. Access control, session expiry, sign-out behaviour and account separation are covered by an automated test suite that is run before each release.
Personnel. The Service is operated by its founder. Any future personnel with access to customer data will be bound by written confidentiality obligations before access is granted.
Annex 3 — Approved sub-processors
Supabase Inc. — Database, authentication, server-side functions. Hosts all account data and everything entered into BEAMS. Processing takes place in the European Union, in the AWS eu-central-1 region in Frankfurt, Germany. Transfer mechanism: Entity established in the United States; Standard Contractual Clauses.
Mollie B.V. — Subscription payment processing. Receives billing email, name and amount. Card and bank details are given to Mollie directly and never pass through our systems. Processing takes place in the Netherlands. Transfer mechanism: Not applicable — EEA.
Resend — Transactional email: confirmations, password resets, invitations, contract delivery, billing notices. Receives recipient email addresses and message content. Processing takes place on EU infrastructure. Transfer mechanism: Standard Contractual Clauses where applicable.
Mijndomein Hosting — Web hosting for beamshq.com and app.beamshq.com. Receives server log data including IP addresses. Processing takes place in the Netherlands. Transfer mechanism: Not applicable — EEA.
Mollie acts as an independent controller for its own regulatory purposes, including anti-money-laundering obligations.
The current list is always the one published at beamshq.com and in the Privacy Policy.
Momo Agency, trading as BEAMS
Johan David Zocherstraat 95, 2272 KB Voorburg, the Netherlands
KVK 86057049 · VAT NL004182651B71
hello@beamshq.com
Draft. This wording has not yet been checked by a lawyer. Have it reviewed before you take your first payment.