EFFECTIVE OCTOBER 8, 2026
Data Processing Agreement
This DPA describes how 360 Rights processes personal data for business customers when acting as a processor.
1. Scope and roles
This Data Processing Agreement (DPA) applies when 360 Rights processes personal data on a customer’s behalf in providing the services. For that processing, the customer may act as Controller and 360 Rights may act as Processor. 360 Rights may also act as an independent Controller for its own account administration, security, billing, legal compliance, and similar operational purposes.
2. Subject matter, duration, and purpose
Processing relates to the provision, support, security, and administration of 360 Rights services. It begins when the customer provides or authorizes processing of personal data and continues for the duration of the applicable services, subject to lawful retention obligations after termination. The purpose is to host, organize, display, process, support, and secure the customer’s account and catalog information in accordance with documented customer instructions and the applicable agreement.
3. Data subjects and personal data
Data subjects may include customer users, artists, writers, rightsholders, representatives, and support contacts. Personal data may include names, email addresses, phone numbers, account identifiers, artist, writer, or rightsholder data that identifies a natural person, professional identifiers such as IPI or CAE where legally considered personal data, ownership and split information, support communications, account activity, and billing-related account information. Music metadata is not automatically personal data merely because it is processed through the service.
4. Customer instructions and responsibilities
360 Rights will process personal data only on documented customer instructions, including use of the service and applicable agreement, unless required to do otherwise by applicable law. The customer is responsible for ensuring that it has a lawful basis to provide personal data and for its instructions. Customers should not intentionally provide sensitive or special-category personal data unless specifically agreed in writing.
5. Confidentiality and security
360 Rights will ensure that personnel authorized to process personal data are subject to appropriate confidentiality obligations and will implement reasonable technical and organizational measures designed to protect personal data. No service can guarantee absolute security, and each party will take reasonable steps appropriate to its role.
6. Service providers and subprocessors
360 Rights may use appropriate third-party service providers, including OVH for infrastructure, to support the services. Subprocessors will be subject to suitable contractual or data-protection obligations. Current subprocessor details may be made available where required by applicable law or the applicable agreement.
7. International transfers
Where processing involves a transfer of personal data across borders, 360 Rights will use legally appropriate safeguards where applicable. This DPA does not represent that all processing occurs in any one country or region.
8. Assistance and incident notification
Taking into account the nature of processing, 360 Rights will provide reasonable assistance to help the customer respond to applicable data-subject requests and meet relevant security, breach-notification, and data-protection obligations. 360 Rights will notify the customer without undue delay after becoming aware of a qualifying personal-data breach affecting personal data processed on the customer’s behalf.
9. Return, deletion, and retention
Following termination of the applicable services, 360 Rights will delete or return personal data where required by the applicable agreement or law, unless retention is necessary for backups, legal obligations, tax or accounting purposes, disputes, fraud prevention, security, or compliance. Retained information remains subject to appropriate protections.
10. Information rights and audits
360 Rights will make information reasonably necessary to demonstrate compliance with this DPA available to the customer, subject to confidentiality, security, and operational safeguards. Where an audit is required by applicable law or the applicable agreement, the parties will cooperate in good faith to agree a reasonable scope, timing, and method that does not unreasonably disrupt operations or compromise other customers’ information.
11. Legal compliance and contact
Each party will comply with data-protection obligations applicable to it. If a provision of this DPA conflicts with the applicable agreement on data-processing obligations, the more specific data-processing provision controls to the extent of that conflict. Questions about this DPA can be submitted through the 360 Rights contact page.