Data Processing Agreement
Standard data-processing terms for qualifying business-customer relationships where X2 acts as processor.
1. Roles
Where the customer determines the purposes and means of processing personal data and X2 processes that data on documented instructions, the customer acts as controller and X2 acts as processor for that processing.
X2 remains an independent controller for its own account administration, security, billing, fraud prevention, legal compliance and other independent purposes.
2. Subject Matter and Duration
The subject matter, nature, purpose and duration of processing are those necessary to provide the contracted X2 Services for the term of the applicable agreement and any lawful retention period.
3. Data and Data Subjects
Data may include account, contact, catalog, rights, audience, analytics, professional, technical or other personal data submitted or made accessible by the customer. Data subjects may include the customer's personnel, clients, artists, contributors, rightsholders, audiences or other individuals relevant to the service.
4. Instructions
X2 will process personal data on documented customer instructions unless applicable law requires otherwise. X2 may inform the customer where an instruction appears unlawful or materially inconsistent with the agreed service.
5. Confidentiality and Security
Persons authorized to process customer data are subject to appropriate confidentiality obligations. X2 will maintain reasonable technical and organizational security measures appropriate to the processing.
6. Subprocessors
X2 may use subprocessors for relevant service functions and remains responsible for imposing appropriate data-protection obligations consistent with applicable law.
7. International Transfers
Where restricted transfers occur, X2 will use an appropriate transfer mechanism or safeguard required by applicable law.
8. Data Subject Rights
Taking into account the nature of processing, X2 will provide reasonable assistance with data-subject requests where required and where the relevant data is within X2's processor role.
9. Security Incidents
X2 will provide legally required notification and reasonable information regarding personal-data breaches affecting processor data, subject to available facts and security considerations.
10. Assessments and Audits
X2 will provide reasonable information necessary to demonstrate compliance with applicable processor obligations and may support proportionate audits subject to confidentiality, security and operational safeguards.
11. Return and Deletion
At the end of processing, X2 will delete or return processor data as required by the applicable agreement and law, except where retention is legally required or the data is independently controlled by X2 for a lawful purpose.
12. Priority
If this DPA conflicts with general service terms regarding processing of personal data in X2's processor role, this DPA controls for that processing.