Medley Data Processing Agreement
Version 2026-09-28.5. Applies when accepted with the order.
How this DPA works
This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at https://commonpaper.com/standards/data-processing-agreement/1.1 (“DPA Standard Terms”), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be “none” or “not applicable” and the correlating clause, sentence, or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.
Key Terms
The key legal terms of the DPA are as follows:
Agreement
The Medley Early Access Agreement accepted by Customer at signup, including its Order Form, Key Terms and Addendum. The accepted version controls. The public terms location is https://www.medley.fm/terms; a later website update does not automatically replace Customer’s accepted terms.
Approved Subprocessors
The list at https://www.medley.fm/subprocessors, as supplied or made available to Customer at acceptance, subject to the notice and objection procedure in this DPA. Each entry identifies the legal entity, processing task and processing location. See Supplement section 4.
Provider Security Contact
hello@medley.fm
Security Policy
The Security Policy at https://www.medley.fm/security, as incorporated at acceptance, together with the minimum measures in Supplement section 7. Changes must not materially reduce the agreed protection.
Changes to the Agreement
Service Provider Relationship
To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq (“CCPA”) applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.
Restricted Transfers
Governing Member State
For any applicable EEA SCCs: Estonia. For any applicable UK Addendum: England and Wales as provided by its mandatory provisions. These choices apply only where the relevant transfer mechanism is required and legally applicable; see Supplement section 3.
Annex I(A) List of Parties
Data Exporter
Customer is the business agency identified by legal name, business address and notice email in the accepted signup/order record. Its contact is the recorded authorised representative. Activities: the use of Medley described in Annex I(B). Role: Controller, or Processor where it lawfully acts for another controller. The electronic acceptance and date are recorded with the Agreement.
Data Importer
Medley Technologies OÜ, registry code 17468055; Tornimäe tn 5, 10145 Tallinn, Estonia. Contact: Leon von dem Berge, Founder, hello@medley.fm. Activities: providing the service described in Annex I(B). Role: Processor, or Subprocessor where Customer is a Processor. Acceptance is under the accompanying Agreement.
Annex I(B) Description of Transfer and Processing Activities
Service
The Service is:
Medley - a business software platform for music booking agencies, including connected email, AI-assisted booking workflows, AI chat, artist/contact/booking management, imports and onboarding support.
Categories of Data Subjects
Customer's end users or customers
Customer's employees
Artists and their representatives; booking agents and agency contractors; promoters, venue and festival personnel; business contacts, correspondents and other individuals whose information the Customer lawfully includes in connected mailboxes, bookings, imports, files or support submissions.
Categories of Personal Data
Name
Contact information such as email, phone number, or address
Financial information such as bank account numbers
Professional or biographic information such as resume or CV
Transactional information such as account information or purchases
User activity and analysis such as device information or IP address
Location information
Business email content, headers and attachments; artist and booking records, dates, availability, fees and deal terms; company/contact relationships and notes; imported files; AI prompts, conversation history, suggested actions, supporting evidence, corrections and feedback; mailbox connection identifiers and authorisation credentials. Financial information means ordinary business payment details occurring in Customer content, not payment-card credentials collected by Medley. Location means business and event locations, not continuous device tracking.
Special Category Data
Incidental special-category data may occur in Customer-controlled correspondence or files, subject to the restrictions below. Systematic special-category processing is outside the agreed scope.
Special Category Data Restrictions or Safeguards
See Security Policy
The Service is not designed for systematic processing of special-category or criminal-offence data. Such data may occur incidentally in Customer-controlled business correspondence or files. Customer must establish the necessary lawful basis and limit inclusion to what is necessary for its instructed booking workflow. Processing is subject to the Security Policy and the Medley DPA Supplement, including restricted authorised access, confidentiality, purpose limitation, data minimisation and deletion controls. No general permission for profiling or model training on such data is granted. Incidental presence is not represented as automatic compliance: Customer must identify an applicable Article 9 condition for special-category data and satisfy Article 10 where criminal-offence data is concerned. Acceptance of this DPA is not consent from the affected individuals. Any deliberate or systematic sensitive-data use requires a separate written assessment and agreement before processing.
Frequency of Transfer
Continuous
Nature and Purpose of Processing
Provider will Process Customer Personal Data as instructed in Section 2.2 of the DPA Standard Terms. The nature of processing includes:
Receiving data, including collection, accessing, retrieval, recording, and data entry
Holding data, including storage, organization, and structuring
Protecting data, including restricting, encrypting, and security testing
Returning data to the data exporter or data subject
Providing the Customer-instructed Medley service: email sync, display, search and authorised sending/actions; AI analysis, extraction, contextual chat and record operations within Customer-authorised manual, assisted or automated workflows; imports, booking/contact management and public entity matching; support, troubleshooting, security, service-quality measurement and authorised review under the DPA Supplement. Access is limited to Customer-authorised recipients, authorised confidential staff and approved subprocessors for these purposes. Medley does not make Customer workspace content available to another customer organisation through workspace access or the shared directory. This does not prevent Customer-instructed sending or sharing with a recipient chosen by Customer, including a recipient who separately uses Medley. Public directory profiles contain independently researched public facts. This scope does not authorise solely automated decisions with legal or similarly significant effects, unrelated profiling, or unrestricted reuse of Customer Personal Data for shared model training or market intelligence.
Processing also includes Customer-instructed updating, correction, alignment and combination, and erasure or destruction under the retention and deletion schedule.
Duration of Processing
For the active service, any Customer-instructed recoverable archive and the applicable deletion period in Supplement section 6. Diagnostic and support copies have the separate periods stated there. Processing ends earlier where Customer validly instructs deletion, except for legally required retention. This replaces the general Duration of Processing formulation.
Annex I(C)
Competent Supervisory Authority
The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.
Annex II
Technical and Organizational Security Measures
The incorporated Security Policy and Supplement section 7 describe the agreed measures. No SOC 2, ISO certification, independent audit programme or insurance coverage is represented unless separately expressly documented.
Other Changes to the DPA Standard Terms
The Medley DPA Supplement below forms part of this Cover Page and overrides inconsistent DPA Standard Terms, subject to mandatory transfer clauses. It applies to all covered processing, including processing entirely within the EEA.
This DPA is accepted electronically with the Medley Early Access Agreement. The agency, authorised representative, version and acceptance date are recorded in the order confirmation. The Medley DPA Supplement below expressly modifies the Common Paper DPA Standard Terms. No separate handwritten signature is required.
Medley DPA Supplement
This Supplement forms part of the Cover Page and modifies the Common Paper DPA Standard Terms version 1.1. It specifies Customer’s instructions, confidentiality boundaries, retention and the obligations needed for Medley’s service. Mandatory applicable transfer clauses take precedence; otherwise this Supplement controls over inconsistent Cover Page text, DPA Standard Terms and the service Agreement.
1. Scope and processor duties
This DPA applies to all Customer Personal Data processed on Customer’s behalf, whether or not processing involves an international transfer. Customer determines the purposes and essential means of its agency workflow. Medley acts as Processor or, where Customer is a Processor, as its Subprocessor. Customer shall identify its controller and any additional lawful instructions where necessary.
Customer instructs Medley to perform the described service, maintain and secure it, troubleshoot errors and measure and improve the quality of the service provided on Customer’s behalf, within the bounds of this DPA and the Agreement. Medley shall process Customer Personal Data only on documented instructions, including regarding transfers, unless Union or Member State law applicable to Medley requires otherwise; Medley shall inform Customer of that legal requirement before processing unless the law prohibits that notice on important public-interest grounds. Medley shall immediately notify Customer if, in its opinion, an instruction infringes applicable data-protection law.
Medley shall ensure that authorised persons are bound by confidentiality or an appropriate statutory duty, implement measures required by Article 32 GDPR, and assist Customer through appropriate technical and organisational measures with data-subject requests. Taking account of the nature of processing and information available, Medley shall assist Customer with security, breach notifications, impact assessments and prior consultation obligations under Articles 32-36 GDPR. Requests and incidents are directed to hello@medley.fm. These duties supplement Sections 2 and 6 of the DPA Standard Terms.
Customer Personal Data includes personal data in email, imports, booking records, model inputs and outputs, suggestions, source evidence, corrections, conversations and retained diagnostic copies; the same protections follow copies and derived data that remain personal data. Medley’s limited independent-controller processing for its own account and business contact management, billing, service security and legal compliance, and its independently researched public business directory, is described separately in its Privacy Notice. This directory role concerns independently obtained public facts, not the Customer’s private research triggers, mailbox contents or relationship history. That role does not create an independent-purpose licence over Customer’s mailbox or booking content.
2. Quality review and improvement
Customer instructs Medley to collect proportionate operational and quality signals, including failures, latency, cost, use counts, correction field types and acceptance/rejection patterns, to maintain, secure and improve the service supplied to Customer. Medley shall minimise content in routine logs and traces, apply the retention schedule, and restrict access by purpose and role. An acceptance or rejection is not treated as conclusive evidence of AI correctness.
Medley personnel may access and confidentially inspect content as necessary for service provision, onboarding, maintenance, support, troubleshooting, security, quality assurance and service improvement on Customer’s behalf. Access must remain within documented Customer instructions, applicable law and binding data-source/provider requirements. Where a specific permission is required, Medley shall obtain and record it for identified material before inspection; otherwise a separate approval for each necessary operational query is not required. A user may share material or authorise a bounded investigation through support correspondence or another suitable process; no particular preview, redaction or reporting interface is prescribed. The scope and any required permission must be clear, and a general rating alone does not grant unrestricted access to a mailbox or conversation. A targeted investigation may use a recorded, time-bounded scope. Mandatory legal or security exceptions may be used only within their actual applicable scope.
Review access shall be limited to named authorised personnel, protected by multi-factor authentication and recorded in access logs. Review through an approved database query or internal tool remains subject to the same authorisation, scope, access records and retention; the tool used does not enlarge the permitted purpose. Concierge access to shared business records does not automatically include private mailbox bodies, chats or diagnostic traces.
The Agreement permits eligible improvement uses, but this DPA does not authorise reuse of Customer Personal Data for Medley’s independent purposes merely by calling it de-identified, aggregated, feedback or evaluation. Customer-specific evaluation and improvement may occur within the service instructions and source rights. Reusable evaluation datasets or shared model/prompt optimisation involving Customer content require a documented eligibility decision covering purpose, source rights, confidentiality, lawful role/basis, any required permission and a defined retention period. A support submission does not itself grant indefinite dataset retention or model-training rights.
Medley may use appropriately licensed public material, synthetic examples and genuinely anonymous statistics where their creation and intended use are lawful and permitted by the source. The restrictions applicable to one data source are not automatically imposed on every other source, but mixed datasets must satisfy all applicable restrictions. A user-confirmed record does not automatically remove restrictions arising from its source. Third-party AI processors must not use Customer content for their own general-purpose model training by default. Private Customer data must not be exposed to other customer organisations through datasets, prompts or outputs.
3. Locations and international transfers
Medley is established in Estonia. Processing between an EEA customer and Medley in Estonia is not, merely for that reason, a Restricted Transfer. A UK transfer covered by a valid adequacy arrangement likewise does not require the UK Addendum solely because Medley is in Estonia. This DPA’s processor obligations apply in either case.
Sections 3.2-3.4 of the DPA Standard Terms apply only when their factual and legal conditions are met and the selected mechanism is legally applicable. Where required, the EEA SCCs use Estonia for their Governing Member State; UK mandatory terms apply as prescribed by the UK Addendum. The parties shall complete any additional required transfer information before the relevant transfer and shall not rely on an inapplicable module.
Downstream hosting, processing and access arrangements are assessed separately. Medley shall use an appropriate lawful transfer mechanism, perform required assessments and supplementary safeguards, and disclose relevant processing countries through the subprocessor information. A customer-to-Medley cover page does not by itself establish safeguards for every downstream vendor. If no valid mechanism is available, the affected Restricted Transfer must not proceed. This Supplement does not promise that every authorised support access or ancillary activity occurs within the EU merely because core storage is EU-hosted.
4. Subprocessors and changes
Customer gives general written authorisation for the disclosed Approved Subprocessors to perform their specified processing tasks. Modifying Section 2.6, Medley shall give written advance notice of additions or replacements at least 30 calendar days before use, and Customer may object on reasonable data-protection grounds during that period. Earlier use requires Customer’s recorded written authorisation for the identified subprocessor. Section 2.6 otherwise applies. Medley shall send the notice to Customer’s recorded notice contact; silently updating a web page is insufficient. The list shall identify vendor legal entities, purposes and relevant processing locations.
Medley shall bind subprocessors to equivalent applicable data-protection obligations and remain responsible as stated in Section 2.6. If Customer raises a reasonable data-protection objection, the parties shall work in good faith on an alternative or safeguard. Medley shall not disregard an unresolved justified objection; if no reasonable solution is available, Customer may terminate the affected service without penalty and receive a prorated refund of unused prepaid fees.
Modifying Section 2.3, Medley may notify factual annex changes reflecting existing instructed functionality, but a notice alone does not authorise a materially new incompatible purpose, broader sensitive-data use or reduced protection. Required additional instructions, permissions or lawful arrangements must be in place before such processing starts.
5. Incident response and assurance
Modifying Section 4.1(a), Medley shall notify Customer without undue delay after becoming aware of a Security Incident and in any event within 72 hours. That outer limit does not permit waiting where earlier notification is feasible. Initial information may be supplied in phases as the investigation progresses. Medley shall take reasonable containment and remediation steps, preserve relevant evidence and provide information needed for Customer’s applicable obligations.
Section 5.2 is replaced: Medley shall provide available security documentation and any existing relevant independent assurance reports on a confidential basis. No regular independent audit or certification is represented unless expressly stated in the agreed Security Policy.
Sections 5.1 and 5.3 are modified to preserve all audit rights required by Article 28 GDPR and applicable transfer terms. The parties should first use available documentation and proportionate remote review. If insufficient, Medley shall allow and contribute to a necessary audit or inspection on reasonable notice, with confidentiality and safeguards for other customers and system security. Annual limits do not prevent additional review justified by an incident, material change, reasonable evidence of non-compliance or a regulator’s requirement. Commercial arrangements must not make statutory rights ineffective. The DPA Standard Terms’ three-year retention of compliance records remains, using minimised evidence rather than retaining underlying mailbox content for that purpose.
6. Retention and deletion
Customer instructs Medley to retain the saved workspace during active service and, after paid access expires, unpaid suspension begins, or a trial ends without conversion, for a recoverable archive of 12 months from that event. Where the first post-trial payment is attempted and fails, the Agreement’s payment grace precedes suspension and archive; cancelling a trial before conversion starts the archive at trial expiry. This continuing storage and exit service remains covered by the DPA. Customer may request earlier return or deletion at any time through the authorised request route. For a completed switch, the Agreement’s section 11 retrieval period applies; the 12-month archive is retained after switching only if Customer expressly chooses it as a later agreed storage/retrieval period. The archive includes stored booking/contact/artist records, customer files, retained import originals, stored email history, attachment contents actually retained by Medley, and user-visible chats. A provider identifier or download reference is not a retained copy of attachment contents. Content fetched only from the external provider depends on source availability and any necessary reconnection; this archive is not a backup of the entire external mailbox. Retention of Medley-stored copies does not depend on ongoing sync or ordinary AI processing.
Import originals retained in Customer’s import history follow the workspace policy. Disposable conversion outputs and temporary working copies are deleted within 30 days of import completion or abandonment unless Customer specifically instructs retention as a workspace asset. Routine content-bearing AI diagnostic traces and operational logs are retained for no more than 30 days; minimised error/security records for no more than 90 days; authorised quality-investigation copies for no more than 90 days after case closure, with open cases reviewed at least every 90 days for continuing necessity. Staff content-access records are retained for 12 months. Content-free aggregate quality metrics may be retained for 12 months, subject to source restrictions; they must not contain message text, suggested field values, user identifiers or other information that makes individuals or private customer activity identifiable. A separately eligible and authorised evaluation dataset requires its own documented purpose, source rights, permissions where required, access limits and retention period; it does not inherit indefinite retention.
Where necessary for a specific ongoing security incident, support investigation or legal obligation, Medley may retain the minimum relevant diagnostic or investigation material beyond its ordinary period only where lawful and permitted by applicable source rules. The reason, scope, responsible person, review date and deletion trigger must be recorded, with necessity reviewed at least every 90 days. This exception is not a general extension for product improvement and does not override an authorised deletion instruction or the deletion deadlines unless a lawful exception applies.
After archive expiry, expiry of the applicable post-switch retrieval period, or a verified authorised deletion instruction, Medley shall delete the affected data from live systems without undue delay and within 30 days, subject to mandatory law. Customer may choose return of its data before deletion through the export and switching procedure in Agreement Addendum section 11. Medley shall complete return and deletion in accordance with Customer’s documented choice, without retaining copies merely because return was selected. Deletion applies to subprocessors and detached operational copies within Medley’s control. Backups shall be isolated from ordinary use and expire within 30 days after live deletion; if restored for recovery, outstanding deletion instructions shall be reapplied before normal processing resumes. These periods also replace any longer conflicting ordinary deletion period in the service Agreement.
Following the end of the instructed processing and the applicable return/deletion process, Medley may retain Customer Personal Data as processor only where Union or Member State law requires storage, with restricted access, use limited to that requirement and deletion when it ends. A possible legal claim does not itself permit Medley to retain processor-held workspace copies contrary to Customer’s deletion instruction. Separately, minimum records that Medley lawfully holds as an independent controller, such as accounting and agreement-acceptance records, follow their independently justified legal retention periods and the Privacy Notice. Any controller retention for a specific legal claim requires its own lawful basis, necessity and applicable safeguards; this is not permission to reclassify or retain the workspace for Medley’s own purposes.
Disconnecting a mailbox stops new provider access, synchronisation and sending through that connection and revokes connection credentials controlled by Medley without undue delay. Stored workspace copies remain subject to the agreed retention, permissions and source requirements and may support Customer-requested use within the agreed service where permitted; disconnection alone is not a deletion instruction. Pending or running work must respect the revoked provider access and any processing restriction or deletion instruction. On full workspace archive, ordinary active-service sync, AI processing and scheduled sending stop, and active mailbox credentials are revoked; reconnecting may be necessary on return. Necessary security, storage/retention, billing and Customer-requested recovery or exit processing may continue under this DPA. Deleting Medley copies never instructs deletion of the original provider mailbox. Workspace deletion requires proper agency authority; requests from individual data subjects are routed and assisted according to law rather than automatically deleting an agency’s whole workspace. Medley shall provide deletion confirmation on reasonable request.
7. Minimum technical and organisational measures
Medley shall maintain measures appropriate to the processing risks, including the incorporated Security Policy and the following minimum commitments. These measures apply to production processing and the authorised support systems that contain Customer Personal Data.
Access and confidentiality: authenticated user access; server-enforced organisation and user permissions; least-privilege access for named staff; multi-factor authentication for privileged staff access; prompt access removal when no longer needed; staff confidentiality duties and records of authorised access to private content. Private email bodies and AI chats shall not become accessible to other organisations or through concierge membership alone.
Encryption and credentials: encryption in transit using current supported transport protection; encryption at rest for managed primary data and file stores; secrets protected from client exposure and ordinary logs; controlled mailbox authorisation and revocation. No particular certification, key-management architecture or end-to-end encryption claim is made by this description.
Reliability and security operations: controlled changes and deployment access, supported dependency/security updates, monitoring and incident handling, backups protected against unauthorised access, and proportionate restore and access-control testing. Hosting providers are responsible for physical facility controls under their agreements; Medley remains responsible for its service configuration and applicable processor duties.
Minimisation and lifecycle: only necessary data sent to each processor; content minimised in routine diagnostics; bounded support-review access; the stated retention and deletion procedures; and measures to prevent deleted data returning through queued jobs, sync or backup restoration. Manual, assisted and automated actions remain within Customer’s instructions, authorised functionality and applicable permissions. Authorised settings or instructions may cover a defined class of ongoing actions without individual confirmation of each action; this does not authorise a materially new purpose or remove any specific permission required by law or a data source.
Public entity research: only necessary entity identity and disambiguation information may initiate research. Shared profiles contain independently sourced public facts; customer source material, lookup origin, deal terms, relationship history and private context remain outside shared profiles. Research diagnostics remain protected Customer data where applicable.
Medley shall periodically evaluate the effectiveness of these measures and update them as needed without materially reducing agreed protection. This Annex specifies contractual measures rather than asserting a third-party audit or certification.
8. Continuing effect and attribution
This DPA remains effective throughout active processing, instructed archive, deletion and any lawful residual retention. No general service-term licence overrides the DPA or applicable transfer clauses. Liability follows Section 8 of the DPA Standard Terms and the underlying Agreement, including the statutory and transfer-clause exceptions. In particular, DPA Standard Terms section 8.3 is unchanged and preserves the liabilities it identifies. No additional DPA indemnity, supercap or monetary floor is introduced here.
Common Paper DPA Standard Terms version 1.1 are incorporated at https://commonpaper.com/standards/data-processing-agreement/1.1 and are available under CC BY 4.0. This Cover Page and Supplement contain Medley-specific modifications. All other DPA Standard Terms remain unchanged. This new version does not automatically replace a separately executed design partner DPA.