Data Processing Terms

1. Scope and roles

For fan data, your label is the controller (the organisation that decides why and how it's processed) and we're your processor. Under Australian privacy law this is equivalent to us providing a service to you. Where the GDPR or UK GDPR applies, these terms are intended to meet Article 28.

This DPA doesn't cover customer account and billing data. We're responsible for that data under our Privacy Policy.

2. Details of the processing

3. Your instructions

We process fan data only to provide the service as you configure it, and on your other documented instructions. Your settings and actions in the dashboard are instructions. We'll tell you if we believe an instruction breaks the law. We won't use fan data for our own purposes, sell it, or combine it with other labels' data, except in aggregated, de-identified form to secure and improve the service, and to describe how much the service is used overall. That last one means counts and nothing else — how many links, fans and accounts there are across droplr.fm — and no address, name or any other individual detail ever leaves in that form, nor is any label identified.

4. Your responsibilities

• You have a lawful basis for the processing and give fans any privacy notice the law requires, including telling them how your label will use their information.
• You only use exported fan data lawfully and keep it secure.
• You follow the anti-spam, pixel and consent requirements in the Terms and Cookie Policy.
• Where you import a list, everything in Lists you import applies.

5. Remix contest entries

When someone enters a remix contest on your page, what they give us is collected for your account, on the same footing as a pre-save: you are the controller, we process it for you, and everything in these terms applies to it.

Two things are specific to entries:

• The declaration is part of the record. We store the exact wording an entrant ticked and the time they ticked it, and we keep old versions rather than overwriting them, because the point of the record is what that person agreed to on the day. It is evidence of a claim they made, not a check we carried out.
• An entry is not a subscription. We never add an entrant to your fan list, and an entrant's address is not available to any send. Their email is there so you can contact them about the contest they entered. If you want them on your list, ask them separately and record that consent the normal way.

We act on your instructions for entries as for anything else: delete a contest or a release and its entries and votes go with it. An entrant can also withdraw an entry themselves from the link in their confirmation, which removes it from your contest and from the public page — we'll action a deletion request from an entrant directly and tell you it happened.

6. Lists you import

You can upload a list of fan email addresses you collected before you used droplr.fm. When you do, you are the controller of that list and you warrant that:

• the people on it gave you their address directly, and you have not bought, rented, scraped, harvested or swapped it;
• you have consent, or another lawful basis, to send them the kind of email you intend to send — and that consent was given to you, so you can still rely on it after moving the record here;
• the source, date and description of consent you give us at import are accurate, and you can evidence them if asked;
• you have removed anyone who has withdrawn consent or asked you to stop.

You remain responsible for the lawfulness of every message you send to an imported contact. We are your processor for storing and sending, not a check on your consent, and we do not verify it.

What we do enforce: an imported address is never added to a release-day email; a list you tell us was collected only in exchange for a download is marked unconfirmed and cannot be emailed until the person confirms; any address that has already unsubscribed from you through droplr.fm is skipped and not re-added; and every news email carries a working one-click unsubscribe.

Because all droplr.fm email is sent from shared infrastructure, a list that generates significant spam complaints or bounces harms deliverability for every customer. We may suspend sending for an account, require a list to be re-confirmed, or delete an imported list, where we reasonably believe it breaches this section, our Acceptable Use Policy, or our email provider's rules. Where practical we'll tell you first.

You indemnify us for claims, penalties and costs arising from a list you imported without the consent you warranted.

7. Confidentiality and security

People authorised to access fan data are bound by confidentiality. We maintain appropriate technical and organisational measures, including HTTPS for all traffic, encryption of platform tokens and credentials at rest, hashed IP addresses and passwords, separation of each label's data, least-privilege access to production systems, and use of reputable infrastructure providers. We may update these measures as long as protection isn't reduced.

8. Sub-processors

You authorise us to use the sub-processors listed in the Privacy Policy (currently Netlify, Neon, Resend, and Spotify, Deezer or SoundCloud when a fan connects). Stripe processes billing data only, not fan data. We impose data protection obligations on sub-processors at least as protective as this DPA and remain responsible for them.

If you connect your own email service (such as Mailchimp), you instruct us to send the fan email addresses you have collected to that account. In that case the provider is your processor, not ours: your own agreement with them governs it, and you are responsible for the consent and suppression state of the audience you sync to. droplr only ever sends addresses already marked mailable, and never re-subscribes anyone who has unsubscribed.

We'll give account owners at least 30 days' notice by email before adding or replacing a sub-processor that handles fan data. If you object on reasonable data protection grounds, we'll work with you on an alternative. If none is possible, you can cancel and we'll refund the unused part of any prepaid period.

9. Requests from fans

You can view fan data and delete it (by deleting a release) from the dashboard on every plan, and export pre-saves as CSV on plans that include it. On any plan, email privacy@droplr.fm and we'll provide an export of your fan data within 30 days. If a fan contacts us directly, we'll pass the request to you without undue delay and won't respond ourselves except to redirect them, unless the law requires otherwise. We'll give you reasonable help with requests you can't handle in the dashboard, and with privacy impact assessments or consultations with regulators.

We also keep the consent record for you: when a fan ticked the box and the wording they saw, when they unsubscribed, and when they restored release emails themselves. Unsubscribes are enforced across your whole account, and we don't provide any way for you or us to re-subscribe a fan.

10. Data breaches

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to fan data, we'll notify you without undue delay, and where feasible within 72 hours. We'll describe what happened, the data and people likely affected, and what we're doing about it, and we'll help you meet your own notification obligations, including under the Notifiable Data Breaches scheme and the GDPR.

11. International transfers

Fan data is stored in Australia and processed by providers in the United States and other countries. Where the GDPR or UK GDPR applies and a transfer outside the EEA or UK isn't covered by an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Module 2, controller to processor), and for the UK the International Data Transfer Addendum, are incorporated by reference, with you as data exporter and us as data importer. The details in section 2 and the measures in section 5 complete their annexes. The governing law and courts for the Clauses are those of Ireland.

12. Deletion and return

When your account closes, you can request an export of fan data during the first 30 days. We delete fan data within 90 days of closure, apart from copies in backups that are overwritten in the normal cycle and anything the law requires us to keep. Deleting a release deletes its fan data straight away.

13. Information and audits

On reasonable written request, and no more than once a year unless a regulator requires it or there's been a breach, we'll give you the information you reasonably need to show compliance with this DPA, such as answers to a security questionnaire and our providers' certifications. Audits beyond that are by agreement, at your cost, with reasonable notice and confidentiality.

14. Order of precedence

If this DPA conflicts with the Terms, this DPA wins for fan data. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win. Limits on liability in the Terms apply to this DPA to the extent the law allows.