Effective date: 23 July 2026
This DPA forms part of the Terms of Service between DarkRhino ("Fanduit", processor) and Customer ("controller") and governs Fanduit's processing of Personal Data on Customer's behalf.
When the Service accesses a connected Platform account, it may process personal data of the account's subscribers/fans (names, handles, messages, spend, interactions) and of the creator. For that data, Customer is the controller and Fanduit is the processor. Customer warrants it has a lawful basis and all required consents for this processing.
Fanduit processes Personal Data only to provide the Service and on Customer's documented instructions (these Terms + Customer's API/dashboard actions). Fanduit will not sell Personal Data or use it for its own purposes, and will not process it for advertising.
Fanduit implements appropriate technical and organizational measures, including: encryption of connected credentials and sensitive fields at rest and in transit; access controls and least privilege; audit logging; and a goal that raw credentials are not accessible to engineering staff in plaintext. Fanduit maintains a process to move to KMS-backed envelope encryption and, where offered, a Platform "Link"-style flow that avoids storing passwords.
Fanduit uses sub-processors (e.g. hosting, proxy providers, email, billing) and maintains a current list at /subprocessors. Fanduit imposes data-protection obligations on each and remains responsible for their performance. Customer may object to a new sub-processor on reasonable grounds.
Fanduit provides export and deletion capabilities so Customer can fulfil access, rectification, erasure, and portability requests, and will assist with data protection impact assessments and regulator inquiries.
Where Personal Data is transferred across borders, the parties rely on an appropriate transfer mechanism (e.g. Standard Contractual Clauses). Regional data residency is available where offered.
Fanduit will notify Customer without undue delay after becoming aware of a Personal Data breach affecting Customer data, with information reasonably needed for Customer's own notification obligations.
Fanduit retains Personal Data only as needed to provide the Service. On termination or on Customer request, Fanduit deletes connected credentials and, within 30 days, Customer Personal Data, except where retention is legally required.
For California data, Fanduit acts as a service provider and does not "sell" or "share" Personal Information as defined by the CCPA/CPRA.