Data processing agreement

The Agency is the controller. Spotcast is the processor, and processes personal data on the Agency’s behalf under this agreement. This agreement is an annex to the Terms of Service and is accepted together with them.

Spotcast displays a brand’s advertising on live streams run by the Agency’s streamers, and records evidence that each display took place. Personal data is processed only as far as that requires.

Processing continues for as long as the Agency uses the platform, and for 30 days after that.

A streamer’s channel name and profile picture, and a record of the ads shown on their channel. The email address of each of the Agency’s own operator accounts, and the record of their acceptance of these terms, which includes when they accepted, which version they were shown, and the network address it came from. While a streamer has the voice page open, their microphone audio, which is transcribed by the speech service and not retained by Spotcast.

Viewers who take part in a chat vote are not recorded. Their names appear on the stream overlay while a vote is running and are not stored.

Streamers the Agency adds to the platform, and the Agency’s own operators.

Spotcast processes personal data only on the Agency’s documented instructions, including the instructions contained in these terms, unless required otherwise by law.

Everyone Spotcast authorises to process personal data under this agreement is bound to confidentiality.

Spotcast maintains the following measures.

• Panel reads are scoped by the database itself. Row-level security is applied to each table, so a read that omits its agency filter returns nothing rather than another agency’s data. Writes are made by the backend, which scopes every statement to the agency the request was authenticated as.
• Credentials and secrets are encrypted and held server-side. They never reach the browser.
• Traffic is encrypted in transit.
• Access to production data is limited to personnel who need it to operate or support the platform, and is used only for those purposes.
• The platform holds little personal data by design: a streamer’s channel name and profile picture, and operator email addresses. Viewers who take part in a chat vote are not recorded, and no analytics or tracking software is used.
• Report share links are random, revocable at any time, and may be password-protected.

Spotcast uses the sub-processors named in the sub-processor list. The Agency authorises them by accepting this agreement.

Spotcast gives the Agency 30 days’ notice before a new sub-processor begins processing. The Agency may object within that period. If the objection cannot be resolved, the Agency may stop using the platform and clause 11 applies.

Spotcast assists the Agency in responding to requests from data subjects exercising their rights, and in meeting the Agency’s own obligations on security, breach notification and impact assessments.

Spotcast notifies the Agency of a personal data breach without undue delay, and in any event within 48 hours of becoming aware of it.

For 30 days after the Agency stops using the platform, the Agency may ask Spotcast for a copy of its campaign data. At the end of those 30 days Spotcast deletes the personal data it holds on the Agency’s behalf.

Two things are treated differently. Spotcast keeps the record of the Agency’s acceptance of these terms for as long as a claim under them could be brought, because that record is the evidence of what was agreed. And figures that identify nobody, such as how many ads were shown and how many streamers took part, are not personal data and are not deleted.

A brand may hold a link to its own report. Because the brand is not a party to these terms, the Agency chooses at the end of the 30 days whether those links are revoked or left to expire with the rest of the data.

Spotcast makes available the information needed to show that these obligations are met.

The Agency may verify that compliance once a year, on 30 days’ notice and at its own cost, and more often where a supervisory authority requires it. Verification is by information and documentation, and does not extend to access to production data or to testing infrastructure operated by a sub-processor.