Annex No. 1 — data processing agreement

This document constitutes Annex No. 1 to the Terms of Service of LiveRun, forms an integral part of them and constitutes a data processing agreement (the “Data Processing Agreement”) within the meaning of Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).

Accepting the Terms is equivalent to concluding this Data Processing Agreement. No separate document or handwritten signature is required — Article 28(9) GDPR allows electronic form.

The Service Provider records which version of the Terms, together with this Annex, the Client accepted and when. This information is made available to the Client on request sent to privacy@liverun.io.

Matters not regulated herein are governed by the Terms and the Privacy Policy. In case of discrepancy regarding the rules of entrustment — this Annex prevails.

Service Provider / Processor: Arkadiusz Grzanko, conducting business under the name: ARKADIUSZ GRZANKO 50FRAMES

For the purposes of this Data Processing Agreement, the term “Client” also includes an entrepreneur concluding the Data Processing Agreement under § 5(9) of the Terms (Workspace User), with respect to its Own Data (within the meaning of the Terms).

The Client is the controller of the personal data it enters into the Service or that are entered by persons authorised by it — crew members, crew leads, directors, drivers, production contacts (all persons using the Service within the Client's organisation, excluding Workspace Users with respect to their Own Data) — unless, with respect to a given production or part of the data entered within it, the Client acts as a processor on behalf of another controller (e.g. a broadcaster), hereinafter the “Original Controller”. A Client who is a Workspace User is the controller or processor of all Own Data entered by it or by persons authorised by it.

The Service Provider is the processor (or, accordingly, a further processor) of these data and processes them only to the extent and for the purpose described in § 3.

With respect to the data of the Client's own Account (e-mail address, name, sign-in log), the Service Provider is the controller — the rules are described in the Privacy Policy.

Under this Data Processing Agreement, the Client entrusts the Service Provider with the processing of the personal data indicated in § 3 and 4 of this Data Processing Agreement, and the Service Provider undertakes to process them in accordance with the GDPR and the provisions of this Data Processing Agreement.

The Client hereby represents and warrants that (subject to section 6 below) it is the controller of the entrusted personal data within the meaning of the GDPR, that they are collected and processed in accordance with the GDPR and generally applicable law, and that the Client is entitled to entrust the processing of the personal data to the Service Provider and to enter them into the Service.

If the Client acts as a processor on behalf of the Original Controller, the Service Provider is a further processor within the meaning of Article 28(4) GDPR, and the Client represents and warrants that:

In the case referred to in section 6 above:

If a production is carried out by joint controllers (Article 26 GDPR), the Client declares that it acts on behalf and with the consent of each of them, and the Service Provider follows instructions only through the Client.

Should any of the Client's declarations referred to in this paragraph prove untrue, the Client will indemnify the Service Provider against any third-party claims in this respect and will remedy the damage suffered by the Service Provider in this respect.

The Service Provider processes data only on documented instructions from the Client (or the Original Controller) - including with regard to transfers of personal data to a third country or an international organisation – unless required to do so by Union law or Polish law; in such a case the Service Provider informs the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Such instruction is the use of the Service in accordance with its intended purpose — including the configuration of the Service and the actions performed in it by the Client and persons authorised by it — and the content of this Annex.

Instructions going beyond ordinary use of the Service are sent by the Client to privacy@liverun.io — in written or documentary form. For instructions going beyond the functions of the Service, the Service Provider may make their execution conditional on technical feasibility within the Service and on the Client covering the reasonable costs of execution.

If, in the Service Provider's opinion, an instruction infringes the GDPR or other data protection provisions, the Service Provider promptly informs the Client and may suspend its execution until the instruction is clarified or modified.

The Service Provider processes data outside the Client's instructions only where required by law — informing the Client before processing, unless the law prohibits this.

Instructions of the Client and of persons acting under its authority concern only the data covered by the entrustment it has made. The rights to manage a Workspace do not include the right to give instructions concerning the Own Data of other entities, in particular their disclosure, return or deletion, without an appropriate legal basis and authority.

The obligation to inform the persons whose data the Client enters rests with the Client as the controller.

The Service Provider makes available in the Service an information notice (the “Info” tab and the chat header) and the full Privacy Policy. This does not replace the Client's obligation.

The Client declares that it has a legal basis for transferring crew data for processing in the Service, that these data have been collected and are processed in accordance with the GDPR and generally applicable law, and that it is entitled to entrust their processing to the Service Provider.

The Service Provider ensures that persons with access to the data are bound by confidentiality — under a contract or a statutory obligation.

The confidentiality obligation applies indefinitely, also after the provision of the Service ends.

The Service Provider's personnel access Client Content only to the extent necessary to remedy a failure or handle a Client request.

The Service Provider applies technical and organisational measures appropriate to the risk (Article 32 GDPR). A description of the organisational and technical measures applied is available on the security page, to the extent that making them public does not compromise the security of the Service.

The description includes, among other things, encryption of connections, separation of data between Clients at database level, role-based access control and backups.

The Service Provider may change the measures applied, provided the level of protection is not reduced.

The Client gives general authorisation for the Service Provider to use further processors. The current list is public: list of subprocessors.

The Service Provider gives notice of an intended removal, change or addition of a subprocessor at least 14 days in advance.

Within that period the Client has the right to raise a reasoned objection and — if the objection cannot be accommodated — to stop using the Service without negative consequences, retaining the right to download its data.

The Service Provider imposes on subprocessors obligations no less stringent than those under this Annex and is liable for their actions as for its own.

The Client undertakes not to object without a justified reason (relating strictly to the protection of personal data).

The Service Provider does not transfer data to a third country or an international organisation without the Client's consent. The Client consents to the transfer of data to the subprocessors indicated on the list of subprocessors, also outside the European Economic Area (where applicable), provided that it takes place on the basis of a European Commission decision finding an adequate level of protection (Article 45 GDPR) or standard contractual clauses (Article 46(2)(c) GDPR).

The Service Provider undertakes to comply with the conditions for engaging another processor referred to in Article 28(2) and (4) GDPR.

Taking into account the nature of the processing, the Service Provider will, insofar as possible, assist the Client by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR.

A large part of these rights the Client exercises itself in the Service — viewing, correcting and deleting crew data and exporting summaries are available from the interface.

A request sent by a data subject directly to the Service Provider is forwarded to the Client without undue delay; the Service Provider does not decide on it itself.

Taking into account the nature of the processing and the information available to it, the Service Provider assists the Client in fulfilling the obligations under Articles 32–36 GDPR to the extent they concern processing in the Service.

The Service Provider notifies the Client of a personal data breach without undue delay, no later than within 48 hours of becoming aware of it, to the data protection contact address provided by the Client.

The notification contains a description of the nature of the breach, the categories and approximate number of persons and records concerned, a description of the likely consequences and the measures taken or proposed.

Where it is not possible to provide all the information referred to in section 2 at the same time, the Service Provider provides it in phases without undue delay.

Security reports and questions: security@liverun.io.

The Client acknowledges that team conversation channels are not accessible to the producer or the production owner — by accepting this Annex, the Client instructs the Service Provider to shape access in this way.

The only way to disclose a single message is for a channel participant to report it.

The Client assesses for itself whether this arrangement meets its obligations under labour law — in particular Article 94³ of the Polish Labour Code.

The restriction in section 1 does not exclude the obligations under § 10 regarding requests from data subjects.

After the provision of the Service ends, the Service Provider — at the Client's choice — deletes the data or returns them in a machine-readable format, unless Union or Member State law requires further storage of the data. Return of data in a format other than the one normally available in the Service, or requiring non-standard work, is at the Client's expense.

The Client notifies its choice within 30 days of the end. Failure to notify means deletion.

The Client may download its data itself (Account → Data export, summary exports in the production) — also after the service ends, within 30 days.

Deletion covers copies held by subprocessors, except for backups, which expire according to their cycle — not longer than 30 days.

The Service Provider makes available to the Client the information necessary to demonstrate compliance with Article 28 GDPR.

The Service Provider allows audits — conducted by the Client or an auditor mandated by it — on a date agreed at least 14 days in advance, no more than once a year, unless the audit results from an identified breach.

An audit may not breach the confidentiality of the data of other Clients of the Service Provider or its trade secrets. The audit is carried out on business days, in a proportionate manner and with the least disruption to the Service Provider's activity. Audits and inspections will be conducted to a proportionate extent and each time using the least invasive methods. An external auditor may not be an entity conducting business competing with the Service Provider and undertakes in writing to maintain confidentiality before the audit. If the manner of conducting the audit breaches the above rules, the Service Provider may object; the Parties then agree another way of conducting the audit.

In the first place, the obligation in section 1 is fulfilled by the security page and the list of subprocessors.

The costs of the audit are borne by the Client, unless the audit results from an identified breach.

The Service Provider is liable to the Client for damage caused by a culpable breach of this Annex or of data protection provisions, on general terms, subject to sections 2–3 below.

The Service Provider's liability towards the Client in respect of personal data protection is limited to actual damage and to PLN 20,000.00. The limitation does not apply to damage caused intentionally.

The Service Provider is not liable for damage resulting from processing data in accordance with the Client's instructions, from entering into the Service the data referred to in § 7(2) of the Terms, from the Client granting access to the Service and entering data contrary to the authorisations to process personal data granted in the Client's organisation, or from the Client's breach of the obligations or declarations referred to in § 2(4)–(8) or § 6.

The Client undertakes to indemnify the Service Provider against liability towards third parties, including the Original Controller and data subjects, and to remedy the Service Provider's damage, including covering awarded compensation and reasonable defence costs, if they result from the circumstances referred to in section 3.

The provisions of this paragraph do not limit the rights of data subjects under Article 82 GDPR.

All terms not expressly defined otherwise in this Data Processing Agreement have the meaning given to them in the GDPR and the Terms.

The Service Provider is not entitled to remuneration for performing the obligations under this Data Processing Agreement.

This Data Processing Agreement is governed by Polish law and the jurisdiction of Polish courts.

This Data Processing Agreement has been drawn up in Polish and the Polish version is binding. Versions in other languages are for information purposes; in case of discrepancies, the Polish version prevails.

Matters not regulated by this Data Processing Agreement are governed by the relevant provisions of generally applicable law, in particular those concerning personal data protection.

If any provision of this Data Processing Agreement is or becomes invalid, this does not affect the validity of the remaining provisions. In place of invalid provisions of the Data Processing Agreement, the Parties will promptly agree provisions corresponding to the meaning and purpose of the invalid provisions.

All disputes arising from this Data Processing Agreement will be resolved by the court competent for the Service Provider's registered office.

This Data Processing Agreement will be amended in the manner provided for in the Terms.