This agreement describes how Showrunner ApS processes personal data on behalf of an organisation using Showrunner HR, as required by Article 28 GDPR.
The organisation is the data controller. Showrunner ApS is the data processor, processing personal data only on the organisation's documented instructions, as set out in these terms and the product's normal operation.
Showrunner processes candidate and employee personal data solely to provide the Showrunner HR service to the organisation: storing, displaying, and transmitting the data the organisation enters or receives through the product's hiring, screening, interview, trial, and onboarding workflows.
Showrunner uses the sub-processors listed in its privacy policy (Supabase EU, Vercel, AWS Bedrock EU, Mailgun EU, GatewayAPI, Stripe), each bound by a data processing agreement providing an equivalent level of protection. Showrunner will notify organisations of any intended change to this list with a reasonable opportunity to object.
Showrunner maintains technical and organisational measures appropriate to the risk, including encryption in transit, role-based access control, and audit logging of data access and changes.
Showrunner will assist the organisation, insofar as reasonably possible, in responding to requests from candidates or employees to exercise their data protection rights, and in meeting its obligations regarding data security, breach notification, and data protection impact assessments.
Personal data is stored in the EU (Supabase EU region, AWS Bedrock EU, Mailgun EU). Where a sub-processor transfers data outside the EEA, that transfer is made under an approved transfer mechanism (such as the EU Standard Contractual Clauses).
This agreement lasts as long as Showrunner processes personal data on the organisation's behalf. On termination, Showrunner will delete or return the organisation's data, subject to any retention required by law.
This is a draft — pending legal review. It is not yet a final, legally binding document.