Download this DPA Subprocessor schedule
1. Parties and scope
This addendum forms part of the agreement between the customer identified in its Wajang account (Controller) and Wajang (Processor) when the customer enters personal data about cast, crew, suppliers, contributors or other production participants. It applies to processing carried out to provide, secure, support and maintain the service.
2. Documented instructions
Wajang processes production personal data only on the Controller’s documented instructions expressed through account configuration, authorised user actions, support requests and the service agreement, unless law requires otherwise. The Controller is responsible for lawful collection, notices, permissions, accuracy and role assignment.
3. Confidentiality and security
Authorised personnel are subject to confidentiality duties. Controls include authenticated access, production-scoped roles, least-privilege field views, transport protection, versioned AES-256-GCM envelopes for high-risk personnel fields, contextual authenticated data, access auditing, backups, incident logging, controlled file delivery, key separation and key rotation.
4. Subject matter, data and people
Processing supports development, pre-production, shooting, post-production, delivery, finance and close-out for the subscription term and configured retention period. People may include account users, cast, crew, applicants, contributors, suppliers, clients, location contacts and audience/review participants. Data may include identity, contact, employment, union, rate, tax/payroll reference, emergency, dietary/allergy, travel, scheduling, contract, usage, security and production records.
5. Subprocessors and transfers
Controller gives general authorisation for the providers in the published schedule. Wajang will maintain that schedule and provide reasonable advance notice of material additions where an objection mechanism is contractually required. International transfers use an applicable adequacy decision, UK Addendum, IDTA or other valid safeguard as appropriate.
6. Assistance, incidents and audits
Taking account of the nature of processing, Wajang will provide reasonable assistance with data-subject requests, impact assessments, consultations and security obligations. Wajang will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller data and provide available information needed for the Controller’s assessment. Audit evidence may be supplied through product logs, security material and proportionate remote review subject to confidentiality and security limits.
7. Return, deletion and legal holds
Exports are available before account or production deletion. Production close-out schedules sensitive-data quarantine and purge under the Controller’s selected policy. Legal holds pause disposal. A short restore window protects against accidental deletion; after that window quarantined data is destroyed. Financial, tax, security and legal evidence follows separate statutory or claims retention and is not silently removed with operational welfare data.
8. Controller details and signing
The Controller is the organisation or person named in the subscribing account. The service description, duration, categories and security measures above form the processing schedule. Acceptance is recorded by document version, account, timestamp and one-way request fingerprints. Customers requiring a countersigned enterprise form should contact Wajang.
Important: this document is implemented as a product and contracting template. It must be approved by qualified counsel before Wajang represents it as final legal advice or a jurisdiction-specific negotiated agreement.