Legal
Data Processing Agreement
14chats — Data Processing Agreement
Between the Agency (controller) and 14chats (processor)
This Data Processing Agreement ("DPA") forms part of the Subscription Terms (the "Agreement") between [14chats legal entity / sole trader name] ("Processor", "14chats") and the subscribing agency ("Controller", "Agency"). It applies to the processing of personal data that 14chats carries out on the Agency's behalf when providing the platform at app.14chats.com.
This DPA does not apply to agencies using the Russian version of the platform. Those agencies contract with a separate provider under a separate offer, which contains its own data processing terms.
1. Definitions and roles
1.1. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in applicable data protection law, including the UK GDPR and the Data Protection Act 2018 and, where relevant, the EU GDPR (together, "Data Protection Law").
1.2. In respect of personal data the Agency enters into or generates through the platform ("Agency Personal Data"), the Agency is the controller and 14chats is the processor. Where the Agency is itself a processor for a third party, 14chats acts as sub-processor and this DPA applies accordingly.
1.3. This DPA does not cover personal data for which 14chats acts as an independent controller, such as account administration, billing, website and marketing data. That processing is described in the 14chats Privacy Policy.
1.4. If there is a conflict between this DPA and the rest of the Agreement on matters of data protection, this DPA prevails.
2. Processing on documented instructions
2.1. 14chats processes Agency Personal Data only on the Agency's documented instructions, including as set out in the Agreement, this DPA and Annex 1, unless required to do so by law. In that case 14chats will inform the Agency of the legal requirement before processing, unless the law prohibits this.
2.2. 14chats will immediately inform the Agency if, in its opinion, an instruction infringes Data Protection Law. 14chats may suspend the relevant processing until the Agency confirms or amends the instruction.
2.3. The Agency is responsible for ensuring that it has a lawful basis for the processing, that it has provided any required information to data subjects, and that its instructions comply with Data Protection Law.
3. Confidentiality
3.1. 14chats ensures that persons authorised to process Agency Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access the data only as needed to provide the platform.
4. Security
4.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to data subjects, 14chats implements appropriate technical and organisational measures to protect Agency Personal Data, as described in Annex 2.
4.2. 14chats may update these measures over time, provided the overall level of protection is not reduced.
5. Sub-processors
5.1. The Agency gives general authorisation for 14chats to engage sub-processors to process Agency Personal Data. Current sub-processors are listed in Annex 3.
5.2. 14chats engages each sub-processor under a written contract that imposes data protection obligations no less protective than those in this DPA. 14chats remains fully liable to the Agency for the performance of its sub-processors.
5.3. 14chats will notify the Agency of any intended addition or replacement of a sub-processor at least [30] days in advance, by email or in the platform.
5.4. The Agency may object to the change on reasonable data protection grounds within that period. The parties will then discuss the objection in good faith. If no solution is found, the Agency may terminate the affected part of the Agreement and receive a refund of prepaid fees for the remaining period.
6. Assistance to the Agency
6.1. Taking into account the nature of processing, 14chats provides reasonable assistance to the Agency, by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights. If 14chats receives such a request directly, it will forward it to the Agency without undue delay and will not respond itself, except to direct the data subject to the Agency.
6.2. 14chats provides reasonable assistance to the Agency with its obligations relating to security, personal data breach notification, data protection impact assessments and prior consultation with supervisory authorities, taking into account the information available to 14chats.
7. Personal data breach
7.1. 14chats notifies the Agency without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting Agency Personal Data.
7.2. The notification includes, to the extent then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not available at first is provided in phases as it becomes available.
7.3. 14chats takes reasonable steps to contain the breach and mitigate its effects. Notification of a breach is not an acknowledgement of fault or liability.
8. International transfers
8.1. 14chats and its sub-processors may transfer Agency Personal Data outside the UK or EEA only where an appropriate safeguard under Data Protection Law is in place, such as an adequacy decision or adequacy regulations, the EU standard contractual clauses, or the UK International Data Transfer Agreement or Addendum. The Agency authorises such transfers on this basis.
8.2. The locations where sub-processors process Agency Personal Data are stated in Annex 3.
9. Return and deletion
9.1. On termination of the Agreement, the Agency may export Agency Personal Data within [30] days. After that period, 14chats deletes Agency Personal Data and existing copies, unless retention is required by law.
9.2. Data in backups is deleted in the ordinary backup rotation cycle, within [90] days. Until then it remains protected under this DPA and is not actively processed.
9.3. On request, 14chats confirms deletion in writing.
10. Audits and information
10.1. 14chats makes available to the Agency information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the UK GDPR and EU GDPR.
10.2. 14chats allows for and contributes to audits, including inspections, conducted by the Agency or an independent auditor it mandates. Audits require at least [30] days' notice, take place no more than once a year unless required by a supervisory authority or following a breach, and are subject to confidentiality and to limits protecting the security and data of 14chats and its other customers.
11. Data of minors
11.1. Agency Personal Data may include data of models under 18. The Agency is solely responsible for ensuring a lawful basis for that processing, including any consent required from a parent or guardian, and for any additional safeguards required by law.
11.2. On request, the Agency will confirm to 14chats that such basis and consent are in place. 14chats may restrict processing of a minor's data until it receives that confirmation.
12. Term
12.1. This DPA takes effect together with the Agreement and continues for as long as 14chats processes Agency Personal Data. Provisions that by their nature should survive termination do so.
13. Governing law
13.1. This DPA is governed by the law stated in the Agreement, being the laws of [England and Wales], and the courts stated there have jurisdiction, without prejudice to the powers of any supervisory authority.
Annex 1 — Details of processing
| Item | Details |
|---|---|
| Subject matter | Provision of the 14chats platform for managing an agency's roster, availability, options, bookings, fees, team and related workflows |
| Duration | The term of the Agreement and the export and deletion periods under section 9 |
| Nature and purpose | Hosting, storage, structuring, retrieval and transmission of operational data to deliver the platform's functionality and support |
| Categories of data subjects | Agency staff and bookers; models, including models under 18; the Agency's clients and their contacts |
| Categories of personal data | Identity and contact details; account and login data; professional and scheduling data (availability, options, bookings); fee-related information; photos and appearance details entered in model profiles; messages and notes; technical and usage data |
| Special category data | Not intended to be processed. The Agency must not enter special category data or criminal offence data except as separately agreed in writing |
| Frequency | Continuous, for the duration of the Agreement |
Annex 2 — Technical and organisational security measures
| Area | Measure |
|---|---|
| Access control | Authentication for all users; role-based access; least-privilege access for 14chats staff; [MFA for administrative access] |
| Separation between agencies | Each agency's data is held in a separate workspace; other agencies see only an anonymised availability layer |
| Model access | Models access only their own calendar and requests through private access links |
| Encryption | TLS encryption of data in transit; [encryption of data at rest by the hosting provider] |
| Hosting | Hosting with [provider] in [region], with physical security certified to [standard, e.g. ISO 27001] |
| Logging and monitoring | Logs of access and administrative actions, retained for [12] months |
| Backup and recovery | [Daily] backups, retained for [90] days; documented recovery process |
| Staff | Confidentiality obligations; access granted only as needed for the role |
| Incident management | Documented process for detecting, assessing, containing and reporting security incidents |
Annex 3 — Approved sub-processors
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| [Cloud hosting provider] | Hosting and storage of platform data | [UK / EU region] | [Not required / SCCs / IDTA] |
| [Transactional email provider] | Sending platform notifications | [region] | [—] |
| [Support tool] | Handling support requests | [region] | [—] |
Paddle is not a sub-processor under this DPA: it processes payment data as an independent controller, under its own terms. This list may be updated in accordance with section 5. The current version is available at [link].