Tonight, where's the jazz?
Our standard DPA for venue, brand, and enterprise customers whose engagement involves JazzNode processing personal data on their behalf.
This page is the current standard DPA text. By entering into a paid subscription with JazzNode, you agree to this DPA in its current form where it applies to your engagement. For a signed counterpart, a redlined version, or an enterprise-specific variant, email security@jazznode.com with subject line "DPA execution" and include your legal entity name, jurisdiction, and any modifications you're requesting.
Draft version — legal review recommended before countersigning
Terms used in this DPA have the meanings assigned in the GDPR, UK GDPR, or equivalent local data-protection law. For clarity:
Subject matter: JazzNode's processing of personal data in connection with providing the Services to the Controller.
Duration: For the term of the Controller's JazzNode subscription, plus any retention period required by law (e.g., tax records for ticket revenue).
Nature and purpose: Hosting, authenticating, displaying, delivering, and supporting the Controller's use of the JazzNode platform. Includes ticket issuance, payment settlement via Stripe, transactional email via Resend, and analytics on platform usage.
Categories of data subjects: End users of the Services, including fans/ticket buyers, musicians/artist profile owners, venue operators, brand operators, and their invited staff.
Categories of personal data:
JazzNode does not intentionally process special categories of personal data (GDPR Art. 9). Controllers must not submit such data through the Services.
JazzNode will:
The Controller authorizes JazzNode to engage the following sub-processors, each of whom has signed a written agreement imposing data-protection terms at least as protective as this DPA:
JazzNode will notify Controllers of any intended additions or replacements of sub-processors with at least 30 days' notice via /trust and email. Controllers may object on reasonable data-protection grounds; if the objection cannot be resolved, either party may terminate the subscription.
JazzNode operates across multiple jurisdictions. When personal data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, JazzNode relies on the EU Standard Contractual Clauses (2021/914) and equivalent UK IDTA/Addendum as incorporated by reference.
Sub-processors that operate outside the EEA self-certify to SCC-equivalent protections or operate under adequacy frameworks. Current jurisdictions: United States (JazzNode Inc., Vercel, Stripe, AWS, Google), Taiwan (娛興喂), Japan (Resend Tokyo region where elected).
JazzNode implements and maintains technical and organizational measures appropriate to the risk, as described at /trust and /legal/security. These include, at minimum:
Measures are reviewed annually and updated as the platform evolves. Material changes are reflected at /trust.
JazzNode will provide reasonable assistance, at the Controller's cost where such assistance is disproportionate, to help the Controller respond to data-subject requests under Chapter III of GDPR (access, rectification, erasure, restriction, portability, objection).
Where data subjects contact JazzNode directly about data originating from a Controller (for example, a fan emailing about their profile on a venue's event page), JazzNode will inform the data subject of the relevant Controller and, where appropriate, notify the Controller.
JazzNode will notify the Controller without undue delay, and in any event within 72 hours of confirmation, of any personal-data breach affecting the Controller's data.
Notifications will include, to the extent then known: the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed to address the breach and mitigate adverse effects.
JazzNode will document all personal-data breaches and make records available to the Controller on request.
The Controller may verify JazzNode's compliance with this DPA by reviewing:
On-site inspections are reserved for cases where the above is demonstrably insufficient, or where required by a supervisory authority. In such cases the Controller gives 30 days' written notice, bears its own costs, and conducts the audit under mutually agreed scope and confidentiality terms during normal business hours.
On termination of the Controller's subscription, JazzNode will, at the Controller's written choice within 30 days of termination: (a) delete all personal data processed on the Controller's behalf, or (b) return such data in a structured, commonly used, machine-readable format.
Absent a timely choice, JazzNode will delete the Controller's personal data after 90 days, subject to retention required by law (for example, tax records of ticket transactions under US and Taiwan tax law). Data in backup systems will be overwritten in the normal backup rotation.
Liability arising under this DPA is subject to the liability caps and exclusions of the underlying JazzNode subscription agreement. Nothing in this DPA excludes liability that cannot lawfully be excluded.
This DPA is governed by the law of the JazzNode subscription agreement that incorporates it.
In case of conflict between this DPA and the underlying subscription agreement with respect to data-protection obligations, this DPA prevails. The EU Standard Contractual Clauses, where applicable, prevail over this DPA.
Data-protection and DPA questions: security@jazznode.com.
General contact through JazzNode HQ: .
JazzNode operating entities: JazzNode Inc. (Delaware, USA) and 娛興喂有限公司 (Taiwan, R.O.C.).