1. Roles
Where the business client determines the purposes and means for customer or workforce data, it generally acts as controller and the studio as processor under documented instructions. The studio may act as an independent controller for accounts, billing, security and legal duties.
2. Scope and instructions
Data subjects, categories, operations, purpose and duration are stated in the agreement, specification or addendum. Processing outside instructions requires new approval or a legal ground.
3. Confidentiality and security
Role-based access, protected sessions, logs, backups and organisational controls are used. Project participants are subject to confidentiality.
4. Assistance
Within reasonable limits, the studio assists with data-subject requests, incidents and information about processing safeguards, taking account of the service.
5. Subprocessors and transfers
Necessary providers are engaged with contractual and organisational safeguards. International transfers follow applicable law and project requirements.
6. Completion
At service completion, data is returned, deleted or anonymised under the agreement and instructions, except where law or rights defence requires retention.