Data Processing Agreement

BETWEEN: Customer / Venue ("Data Controller") AND Showrunner ApS, CVR DK46298020, Tornerosevej 106, 2730 Herlev, Denmark ("Data Processor")

1. Scope and Purpose of Processing

The Processor shall process personal data on behalf of the Controller solely to provide the Showrunner venue management software services, including document extraction, contract management, settlement processing, and ticket sales tracking.

2. Categories of Data & Data Subjects

• Data subjects: venue staff, promoters, booking agents, tour managers, artists, and ticket buyers.
• Categories of data: contact details (names, emails, phone numbers), financial settlements, performance contracts, email text metadata, and ticket transaction metadata.

3. Processor Obligations

1. Instructions: the Processor shall process personal data exclusively on documented instructions from the Controller.
2. Confidentiality: the Processor guarantees that staff authorized to process personal data have committed themselves to confidentiality.
3. Security: the Processor shall implement technical and organizational measures in accordance with GDPR Article 32 (encryption in transit and at rest, access restriction, system resilience).
4. Data subject rights: the Processor shall assist the Controller by appropriate technical measures in fulfilling requests under GDPR Chapter III (access, erasure, rectification).

4. Subprocessors & AI Processing Guarantees

1. The Controller grants general authorization for the Processor to engage the subprocessors listed in Showrunner's Privacy Policy.
2. Anthropic AI specific safeguards: where personal data is processed by Anthropic PBC for automated parsing:
   • Data transfers to the United States are governed by EU Standard Contractual Clauses (SCCs).
   • Data processing occurs under enterprise API terms with explicit commitments that Customer input/output data is never used for model training; restricted data-retention arrangements are applied where offered by the subprocessor.