Legal

Data processing agreement

Version 1.0 · effective from 18 October 2026

This is a translation of the Dutch data processing agreement. If the two versions differ, the Dutch version prevails. Read the Dutch version

Do you use PLAYTHIS for business, for example as a DJ company, venue, agency or event organiser? Then we process the data of the guests at your events on your behalf. This data processing agreement sets out how we handle it, as required by Article 28 of the GDPR. It forms part of the terms and conditions and applies for as long as you have a PLAYTHIS account. Would you like a signed copy for your records? Email [email protected].

1. Parties and roles

Controller: you, the business customer with a PLAYTHIS account ("the customer"). Processor: PLAYTHIS.eu, Zwaanwijk 9, 3334 GS Zwijndrecht, the Netherlands, Chamber of Commerce no. 24340296 ("PLAYTHIS"). PLAYTHIS is itself the controller for the data of your own account and billing; the privacy statement applies to that.

2. Which data and why

  • Data subjects: guests at the customer's events.
  • Data: a random device ID, requests and votes, a first name if the guest enters one, photos with captions (without metadata), messages and shout-outs, reviews, and technical data such as the IP address.
  • Purpose: providing the service: requests, the screen, photos, messages and reviews at the event.
  • No special categories: PLAYTHIS does not ask for special categories of personal data. The customer ensures the service is not used for that.

3. Only on your instructions

PLAYTHIS only processes the data to provide the service, according to the settings the customer chooses (for example which photos appear on the screen). PLAYTHIS does not use the data for its own purposes, except to prevent abuse, to secure the service and where the law requires it. If PLAYTHIS considers an instruction to be in breach of the GDPR, it will say so immediately.

4. Confidentiality

Everyone at PLAYTHIS with access to the data is bound by confidentiality.

5. Security

PLAYTHIS takes appropriate technical and organisational measures, including:

  • all connections over https;
  • admin access only with two-step verification, and a log of admin actions;
  • passwords stored only as hashes, sensitive keys encrypted;
  • photos without location or other metadata;
  • no tracking or advertising cookies;
  • automatic clean-up of logs;
  • hosting in the Netherlands.

6. Sub-processors

The customer consents to these sub-processors:

  • Mijndomein (the Netherlands): hosting of the website, database and photos.
  • Cloudflare: security and routing of traffic to the website (IP addresses).

Spotify and Apple only receive search terms, without personal data. PLAYTHIS imposes the same obligations on sub-processors as in this agreement. PLAYTHIS announces a new sub-processor by email at least 30 days in advance. The customer may object and, in that case, cancel the account.

7. Outside the EU

The data is stored in the Netherlands. Only Cloudflare may also process IP addresses outside the European Economic Area, on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses.

8. Guests' rights

The customer can delete photos, messages, events and the whole account themselves. If PLAYTHIS receives a request from a guest, it forwards it to the customer or handles it in consultation. PLAYTHIS reasonably assists the customer in responding to requests.

9. Data breaches

PLAYTHIS reports a data breach affecting the customer's data without undue delay, and no later than 48 hours after discovery. The report states what happened, which data and how many guests are affected, the likely consequences and the measures taken. This allows the customer to report to the Dutch Data Protection Authority within 72 hours if required.

10. Information and audits

On request, PLAYTHIS gives the customer the information needed to demonstrate compliance with these arrangements. An audit is possible at most once a year, announced 30 days in advance, at the customer's expense, and without compromising the confidentiality of other customers.

11. End and deletion

If the customer deletes an event or the account, PLAYTHIS erases the guests' data immediately. It disappears from backups within 30 days. If the customer wants to keep an event's photos, they can download them as a zip beforehand.

12. Liability and law

The terms and conditions apply to liability. This agreement is governed by Dutch law.

See also: Terms and conditions · Privacy statement · Privacy & security · Questions? [email protected]