This agreement describes how Showrunner ApS processes personal data on behalf of an organisation using Showrunner HR, as required by Article 28 GDPR.
The organisation is the data controller. Showrunner ApS is the data processor, processing personal data only on the organisation's documented instructions, as set out in these terms and the product's normal operation.
Showrunner processes candidate and employee personal data solely to provide the Showrunner HR service to the organisation: storing, displaying, and transmitting the data the organisation enters or receives through the product's hiring, screening, interview, trial, and onboarding workflows.
Processing covers job applicants, trial-shift participants and employees at the organisation's venues. The data are name, contact details, date of birth, CV, photo, answers to application questions, screening and AI assessments, interview notes and scores, employment contracts and, for employees, national ID number and bank details for the organisation's own payroll. National ID numbers and bank details are encrypted, masked in the system, and access is logged. Showrunner HR does not pay wages.
AI-assisted screening is used only as decision support for the organisation's staff. The system does not make decisions with legal effect for the data subject based solely on automated processing, cf. GDPR article 22. Every decision to progress or reject a candidate is made by the organisation.
By accepting this agreement the organisation approves the following sub-processors: Supabase Inc. (database, login and files, EU Frankfurt), Vercel Inc. (hosting, EU Frankfurt), Mailgun Technologies/Sinch (email, EU region), Amazon Web Services EMEA SARL (AI-assisted screening via Bedrock, EU Frankfurt; data is not used for training), Google Ireland Ltd. (sign-in with a Google account where the user chooses it), Stripe Payments Europe Ltd. (payments; only the organisation's own payment and contact details) and GatewayAPI ApS (SMS, Denmark). Each sub-processor is bound by a data processing agreement providing an equivalent level of protection. Showrunner gives at least 30 days' written notice before a new sub-processor is taken into use, so the organisation can object.
Showrunner maintains technical and organisational measures appropriate to the risk, including encryption in transit, role-based access control, and audit logging of data access and changes.
Showrunner gives access to personal data only to persons under Showrunner's authority who have committed to confidentiality, and only to the extent necessary.
Showrunner will assist the organisation, insofar as reasonably possible, in responding to requests from candidates or employees to exercise their data protection rights, and in meeting its obligations regarding data security, breach notification, and data protection impact assessments.
Showrunner notifies the organisation without undue delay and where possible within 48 hours of becoming aware of a personal data breach at Showrunner or a sub-processor. The notification includes at least the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed, so the organisation can meet its notification duty under article 33.
Showrunner makes available the information necessary to demonstrate compliance with article 28 and contributes to audits carried out by the organisation or an auditor mandated by the organisation, with at least 30 days' written notice and at most once a year unless a specific incident justifies otherwise. The organisation bears its own audit costs. Audits may not cover information about Showrunner's other customers.
Personal data is stored in the EU (Supabase EU region, AWS Bedrock EU, Mailgun EU). Where a sub-processor transfers data outside the EEA, that transfer is made under an approved transfer mechanism (such as the EU Standard Contractual Clauses).
This agreement applies for as long as Showrunner processes personal data on the organisation's behalf. Applicants who are not hired are deleted after the period the organisation has set per venue (by default 6 months after the recruitment ends), unless the candidate has consented to continued storage. Employees' data are deleted when the employment ends, unless the organisation instructs longer retention for legal reasons. When this agreement ends, the organisation can export its data for 30 days, after which Showrunner deletes them and confirms the deletion, unless the law requires continued storage.