Data Processing Agreement

1. Definitions

"Controller" means the entity that determines the purposes and means of processing personal data (the Client). "Processor" means Falhen Media, which processes personal data on behalf of the Controller. "Data Subject" means any identified or identifiable natural person whose personal data is processed. "Personal Data," "Processing," "Supervisory Authority," and "Data Breach" have the meanings given in the GDPR. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council. "Services" means the media production and related services provided by Falhen Media under the main service agreement.

2. Subject Matter & Duration

This Data Processing Agreement ("DPA") governs the processing of personal data by Falhen Media (Processor) on behalf of the Client (Controller) in connection with the provision of Services under the main service agreement between the parties.

This DPA is effective from the date the main service agreement is signed and remains in force for the duration of the Services. Upon termination or expiry of the main service agreement, this DPA shall automatically terminate, subject to the data deletion and return obligations in Section 9.

3. Nature & Purpose of Processing

Falhen Media processes personal data solely to the extent necessary to deliver the agreed Services, which may include: storing and managing client contact information; processing talent, crew, and vendor personal data for production purposes; managing client gallery access and authentication; and communicating project updates and deliverables.

Falhen Media shall process personal data only for the specific purposes set out in this DPA and the main service agreement, and for no other purpose, unless required by applicable law. Falhen Media shall promptly notify the Controller if, in its opinion, an instruction from the Controller infringes applicable data protection law.

4. Types of Personal Data & Data Subjects

The personal data processed under this DPA may include: identification data (name, job title, company); contact data (email address, phone number, postal address); authentication data (usernames, hashed passwords, access tokens); project-related data (creative briefs, feedback, approvals); financial data (billing address, invoice records); and any other personal data contained in materials provided by the Controller.

Data subjects include: Controller's employees, representatives, and contractors; talent and actors engaged in media productions; and end-users accessing client video content or proofing galleries.

5. Processor Obligations

Falhen Media shall ensure that all personnel authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Falhen Media shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption in transit and at rest, access controls, vulnerability management, and regular security assessments.

6. Sub-Processors

The Controller provides general authorization for Falhen Media to engage third-party sub-processors to assist in delivering the Services. Current sub-processors include cloud hosting providers (AWS, Google Cloud), media asset management systems, and payment processors.

Falhen Media shall impose data protection terms on any sub-processor it engages that provide at least the same level of protection as those set out in this DPA.

7. International Data Transfers

Where personal data originating in the European Economic Area (EEA), the UK, or Switzerland is transferred outside these regions, Falhen Media shall rely on valid transfer mechanisms, such as the EU Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum (IDTA).

8. Personal Data Breach Notification

Falhen Media shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's personal data.

9. Data Return & Deletion

Upon termination of the Services, Falhen Media shall, at the choice of the Controller, delete or return all personal data to the Controller, unless applicable law requires continued storage.

10. Audit Rights

Falhen Media shall make available to the Controller all information necessary to demonstrate compliance with GDPR Article 28 and allow for and contribute to audits conducted by the Controller or an independent auditor.

11. Liability & Indemnification

Each party's liability under this DPA shall be subject to the limitations of liability set out in the main service agreement.

12. Governing Law & Jurisdiction

This DPA shall be governed by the law governing the main service agreement, or where GDPR compliance mandates, the laws of an EU Member State.

13. How to Execute This DPA

Enterprise clients requiring a countersigned DPA for their compliance records should contact legal@falhen.com with the subject line "DPA Request — [Company Name]". We will provide a countersigned copy within 5 business days. This page constitutes the standard terms of our DPA; individual enterprise agreements may include additional or modified terms by mutual written agreement.

This DPA is effective as of the date the main service agreement between the parties is signed, or the date the Client first engages Falhen Media's services, whichever is earlier.