Data Processing Agreement — Fan Mail

1. Definitions

"Controller" means the artist who collects and owns their fan subscriber list and determines the purposes and means of processing that subscriber data.

"Processor" means Guild SPP SL (CIF B72486293), trading as WAVjunkie, which processes personal data on behalf of the Controller in connection with the Fan Mail service.

"Personal Data" means any information relating to an identified or identifiable natural person, including email addresses and any other data collected via the Fan Mail subscriber signup process.

"Processing" means any operation performed on Personal Data, including storing, organising, transmitting, and deleting subscriber data in connection with Fan Mail campaigns.

"Sub-processor" means any third party engaged by the Processor to carry out specific processing activities on behalf of the Controller.

"GDPR" means the EU General Data Protection Regulation 2016/679.

2. Scope and purpose

This DPA applies where an artist uses WAVjunkie Fan Mail to collect fan subscribers and send email campaigns to those subscribers. In this context:

• The artist is the Controller — they determine who is contacted, what is sent, and when campaigns are delivered.
• WAVjunkie is the Processor — it stores subscriber data on the artist's behalf and delivers campaigns at the artist's instruction.

WAVjunkie processes subscriber Personal Data solely for the purpose of providing the Fan Mail service. WAVjunkie does not use artist subscriber data for its own marketing purposes, does not sell subscriber data, and does not share it with third parties other than the sub-processors listed in Section 6.

3. Nature of processing

WAVjunkie processes the following Personal Data on behalf of artists using Fan Mail:

• Fan subscriber email addresses
• Subscriber consent records and signup timestamps
• Campaign engagement data (opens, clicks, unsubscribes) where applicable to the artist's FM tier
• Import batch records where a CSV import has been performed (Pro tier only)

Processing activities carried out by WAVjunkie include:

• Storing subscriber records in a secure database
• Sending email campaigns at the artist's instruction via a verified sending domain
• Processing unsubscribe requests received from subscribers
• Suppressing hard-bounced email addresses automatically
• Providing campaign analytics to the artist via their dashboard

4. Artist obligations as Controller

By using WAVjunkie Fan Mail, the artist confirms that they:

• Have a lawful basis for processing their subscribers' personal data under GDPR or applicable law
• Have obtained valid consent from all subscribers, or can demonstrate another lawful basis for contacting them
• Have directed all imported contacts through the WAVjunkie re-permission flow before sending any campaign, where contacts were not collected via organic WAVjunkie signup
• Will not use Fan Mail to send unsolicited communications, spam, or content that violates WAVjunkie's Terms of Service or applicable law
• Will respond promptly to any data subject requests received from their subscribers relating to access, erasure, or portability

WAVjunkie accepts no liability for unlawful processing carried out by an artist acting as Controller, including where the artist cannot demonstrate a valid lawful basis for contacting subscribers.

5. WAVjunkie obligations as Processor

WAVjunkie agrees to:

• Process subscriber Personal Data only on the documented instructions of the artist — specifically, delivering the campaigns the artist authorises and maintaining the subscriber list on the artist's behalf
• Ensure that personnel with access to subscriber data are bound by appropriate confidentiality obligations
• Implement appropriate technical and organisational security measures to protect subscriber data, including encrypted storage and secure transmission
• Notify the artist without undue delay if WAVjunkie becomes aware of a personal data breach affecting their subscriber data
• Assist the artist in responding to data subject requests where the request relates to data held by WAVjunkie as Processor, to the extent reasonably practicable
• Delete or return subscriber Personal Data on termination of the artist's account, within 30 days of account closure
• Make available to the artist on reasonable request the information necessary to demonstrate compliance with this DPA

6. Sub-processors

WAVjunkie engages the following sub-processors in connection with the Fan Mail service:

WAVjunkie will notify artists of any intended changes to this sub-processor list — including additions or replacements — by updating this DPA and providing reasonable notice via the WAVjunkie platform or email. Artists who object to a new sub-processor on reasonable grounds should contact [email protected]. If the objection cannot be resolved, the artist may terminate their use of Fan Mail without penalty.

7. International data transfers

WAVjunkie's sub-processors may process Personal Data outside the European Economic Area. Where this occurs, WAVjunkie ensures that appropriate safeguards are in place in accordance with GDPR Chapter V, including Standard Contractual Clauses or reliance on an applicable adequacy decision.

8. Data retention

WAVjunkie retains artist subscriber data for the duration of the artist's active account. On account closure, subscriber Personal Data is deleted within 30 days unless retention is required by law.

Artists may export their subscriber list at any time from their Fan Mail dashboard.

9. Data subject rights

Where a subscriber exercises a right under GDPR — including the right to erasure, access, or portability — and that request is directed to the artist as Controller, the artist is responsible for responding. WAVjunkie will assist where the processing is within WAVjunkie's control, for example by providing a data export or deleting a specific subscriber record on the artist's instruction.

Subscribers may unsubscribe from an artist's Fan Mail list at any time via the unsubscribe link included in every campaign. WAVjunkie processes unsubscribe requests automatically and immediately marks the relevant subscriber as inactive.

10. Liability

Each party is responsible for its own compliance with applicable data protection law. WAVjunkie's liability under this DPA is subject to the limitations set out in the WAVjunkie Terms of Service.

11. Governing law

This DPA is governed by the laws of Spain, consistent with the registered entity of Guild SPP SL (CIF B72486293). Disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of Spain, without prejudice to any rights of data subjects under applicable EU law.

12. Updates

WAVjunkie may update this DPA from time to time to reflect changes in the Fan Mail service, applicable law, or sub-processor arrangements. Material changes will be communicated to artists via the platform or by email. Continued use of Fan Mail following notification of a change constitutes acceptance of the updated DPA.