Paywall data processing agreement

Version 2026-11-06.

This data processing agreement ("DPA") applies when a Customer uses the Paywall or DRM of a Server Room video streaming plan, and personal data about its Viewers is subject to the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection or a US state privacy law. It is made between Data Room, Inc., operating as Server Room ("Server Room", "we", "us"), and the Customer that accepts it in its dashboard. It forms part of the Terms of Service between them (the "Agreement"), and section 20 of the Terms of Service gives its background.

1. Definitions

1.1 Words defined in the GDPR, such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority", have the GDPR's meaning. Paywall, DRM, Viewer, Sale, Credentials, Your Payment Account and Your DRM Accounts have the meaning given in section 20 of the Terms of Service.

1.2 In this DPA:

• Customer means the Server Room customer that turns on the Paywall or DRM and accepts this DPA.
• Viewer Data means personal data about Viewers that Server Room processes for the Customer to provide the Paywall and DRM, as Annex I describes. It includes Viewer Data in:
  • the records of requests to the Paywall;
  • the access logs of Server Room's video servers and edges;
  • the emails the Paywall sends to Viewers.

  It does not include Customer Account Data.

• Customer Account Data means personal data about the Customer and its users that Server Room processes as a controller to run its own services: the account, billing, support, and the record of who connected or changed Credentials and when. The Privacy Policy covers Customer Account Data; this DPA does not.
• Customer's Providers means Stripe, Apple, Google, a Widevine provider, and any other provider that the Customer engages under its own agreement for payments or DRM.
• Data Protection Law means the GDPR, the UK GDPR with the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the privacy laws of US states (such as the California Consumer Privacy Act), each where it applies to the processing.
• Sub-processor means a processor that Server Room engages to process Viewer Data, as listed in Annex III.
• SCCs means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

2.1 The Customer is the controller of Viewer Data, or a processor acting for its own controller. Server Room is its processor, or a sub-processor where the Customer is a processor.

2.2 Server Room processes Viewer Data only to provide the Paywall and DRM to the Customer, as Annex I describes. It does not use Viewer Data for any purpose of its own. In particular, it does not:

• market to Viewers;
• sell or share Viewer Data;
• build profiles of Viewers;
• combine Viewer Data with the viewer data of its other customers.

2.3 The Customer's Providers are not Server Room's Sub-processors. The Customer engages them under its own agreements, which say in what role each of them processes personal data. On the Customer's instructions, Server Room sends them only what the Paywall needs:

• Stripe. When a Viewer starts a checkout, Server Room sends the Customer's Stripe account the Viewer's email address, the offer and its price, and the Paywall's references for the purchase. Stripe then collects the payment details directly from the Viewer, and tells the Paywall that the payment, renewal, refund or cancellation happened.
• Google, or the Customer's Widevine provider. Server Room passes on the license request a Viewer's device makes, signed with the Customer's credentials. That request comes from the DRM module of the Viewer's device and identifies that module; it carries no email address or name. The request reaches Google from Server Room's server, not from the Viewer's network address.
• Apple receives nothing from the Paywall during playback. FairPlay license requests are answered on Server Room's servers.

What a Customer's Provider does with that data is governed by the Customer's agreement with it.

2.4 Server Room processes Customer Account Data as a controller, under its Privacy Policy.

2.5 Where the Customer is a processor, it confirms two things: its controller has authorized this DPA and the Sub-processors in Annex III, and it passes on to its controller anything this DPA says Server Room will tell the Customer.

3. Instructions

3.1 Server Room processes Viewer Data only on the Customer's documented instructions. Those instructions are:

• this DPA and the Agreement;
• the Customer's settings and actions in its dashboard: offers, prices, device limit, branding, consent wording, access codes, refunds, and deleting Viewers;
• the Paywall processes the Customer turns on: sign-up, the confirmation and password-reset emails, sign-in, checkout, granting and ending access on Stripe's notices, device limits, play authorization and license requests;
• protecting the Paywall against fraud, card testing and abuse, as section 20.6 of the Terms of Service describes;
• any further written instruction the Customer sends to support@serverroom.net that the Paywall can carry out.

Server Room may decline an instruction that the Paywall cannot carry out. The Customer may then stop using the Paywall.

3.2 Server Room tells the Customer promptly if, in its opinion, an instruction infringes Data Protection Law.

3.3 Server Room processes Viewer Data otherwise only where European Union or Member State law requires it. It then tells the Customer before doing so, unless that law forbids it on important grounds of public interest. A request under the law of any other country is handled under section 12.

4. The Customer's responsibilities

4.1 The Customer is responsible for:

• having a lawful basis for its processing;
• informing Viewers in its own privacy notice, which names the Customer as controller and Server Room as the host of the Paywall;
• obtaining any consent the law requires (for example, for marketing it sends to Viewers through other means);
• answering Viewers' requests.

4.2 The Customer does not put special categories of personal data (Article 9(1) GDPR) into offer names, access codes or other text the Paywall stores. The titles of the channels and videos a Viewer buys can reveal something sensitive about them, such as a religious, political or health subject. The Customer takes that into account in its own assessment.

4.3 The Paywall is not intended for Viewers under the age set in section 20.4 of the Terms of Service. A Customer that sells to younger Viewers is responsible for parental consent where the law requires it.

4.4 Server Room's records are not the Customer's accounting records. The Customer keeps its own records of Sales; Stripe keeps the payment records in Your Payment Account.

5. Confidentiality

5.1 Server Room gives its staff access to Viewer Data only as far as strictly necessary to provide, secure and support the Paywall. Everyone at Server Room who could have access is bound by confidentiality.

5.2 Support staff may see a Viewer's email address and purchase history in order to help the Customer. Nobody can see a Viewer's password, which is stored only as a one-way hash, or the Customer's Credentials, which are never shown (Terms of Service section 20.8).

6. Security

6.1 Server Room implements the technical and organizational measures in Annex II. It may change them as the Paywall develops, provided the overall level of protection is not reduced.

6.2 The measures take into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risks to Viewers, as Article 32 of the GDPR requires.

7. Sub-processors

7.1 The Customer gives its general authorization for Server Room to engage the Sub-processors listed in Annex III.

7.2 Server Room tells the Customer at least thirty days before it adds or replaces a Sub-processor, by email to the contact in Annex I.A and in the dashboard. The notice gives the Sub-processor's name, where it will process Viewer Data, and what it will do.

• The Customer may object within that time, on reasonable grounds of data protection.
• If the parties cannot resolve the objection, the Customer may stop using the Paywall and end the affected plan without penalty. Server Room then refunds the fees prepaid for the unused part of that plan.

7.3 Server Room engages each Sub-processor under a written contract that imposes, in substance, the obligations of this DPA on it. Server Room remains fully liable to the Customer for each Sub-processor's performance.

8. International transfers

8.1 Where Viewer Data is processed. Viewer Data is processed in:

• the United States: New York, where the Paywall's servers, its database and two video servers are; and Miami and San Francisco, where video edges serve Viewers;
• Romania: Bucharest, where a copy of the database, a video server, the request records and a video edge are;
• the Netherlands: Amsterdam, where a video edge is.

Which edge answers a Viewer is decided by country, from their network address or their DNS resolver's: Viewers in the United States and Canada are served from New York, and Viewers elsewhere from the location assigned to their region, with New York as the fallback. The Customer cannot at present choose to keep Viewer Data in the European Union.

8.2 The SCCs. To the extent the Paywall involves a transfer of Viewer Data from the European Economic Area to a country that is not covered by an adequacy decision, the SCCs are incorporated into this DPA, with these choices:

• Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor; the Customer is the data exporter and Server Room the data importer;
• Clause 7 (docking clause) applies;
• Clause 9(a): Option 2 (general written authorization), with the thirty days of section 7.2;
• Clause 11(a): the optional independent dispute resolution does not apply;
• Clause 13: the supervisory authority shown in Annex I.C;
• Clause 17: Option 2, for both Modules; where the law of the Member State in which the data exporter is established does not allow third-party beneficiary rights, or the data exporter is not established in a Member State, the law of Ireland;
• Clause 18(b): the courts of the Member State whose law governs under Clause 17, which are the courts of Ireland wherever the law of Ireland governs. Clause 18(c) applies as it stands: a data subject may also bring proceedings in the Member State of his or her habitual residence. The choice of courts in the Agreement does not apply to the SCCs;
• Annexes I, II and III of the SCCs are Annexes I, II and III of this DPA.

8.3 UK personal data. To the extent the Paywall involves a transfer of Viewer Data that is subject to the UK GDPR to a country that UK adequacy regulations do not cover, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, version B1.0, in force 21 March 2022 (the "UK Addendum"), is incorporated into this DPA and applies to that transfer. Its Part 2 (the Mandatory Clauses) applies as the Information Commissioner issued it. Part 1 is set out here: the start date is the date the Customer accepts this DPA; the exporter is the Customer and the importer is Server Room, with the details in Annex I.A; the Addendum EU SCCs are the SCCs with the choices in section 8.2 for Modules Two and Three; the Appendix Information is in Annexes I, II and III; and both the Importer and the Exporter may end the UK Addendum as its Section 19 provides.

8.4 Swiss personal data. To the extent the Swiss Federal Act on Data Protection applies to a transfer of Viewer Data, the SCCs apply to that transfer with these adaptations, which have effect only for the purposes of that Act:

• references to the GDPR are read as references to that Act;
• the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority as far as the transfer is subject to that Act;
• where the transfer is subject only to that Act, Swiss law governs the SCCs and the courts of Switzerland apply;
• "Member State" is not read so as to prevent data subjects in Switzerland from bringing proceedings for their rights in Switzerland, where they habitually reside.

8.5 Server Room gives the Customer, on request, the information it holds for a transfer impact assessment for the United States.

8.6 If the SCCs conflict with this DPA, the SCCs prevail. If this DPA conflicts with the Agreement, this DPA prevails.

9. Personal data breaches

9.1 Server Room notifies the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Viewer Data. It notifies the contact in Annex I.A by email, and shows the notice in the dashboard.

9.2 The notice describes, as far as is known:

• the nature of the breach;
• the categories and approximate number of Viewers and records concerned;
• the likely consequences;
• the measures taken or proposed;
• a contact for more information.

Where not everything is known at once, Server Room gives the information in phases, without further undue delay.

9.3 Server Room takes the measures available to it to contain the breach, such as:

• ending Viewer sessions;
• forcing password resets;
• pausing the Paywall;
• deleting exposed Credentials and telling the Customer to replace them.

It helps the Customer meet its obligations under Articles 33 and 34 of the GDPR.

9.4 Server Room also tells the Customer, in the same way, of any incident that exposes or may have exposed the Customer's Credentials, even where no personal data is involved.

9.5 A notice under this section is not an admission of fault.

10. Requests from Viewers

10.1 The Customer's own tools. In its dashboard, the Customer can see its Viewers and their Sales, delete a Viewer and export one Viewer's data. Deleting a Viewer removes their account, sessions and access. That Viewer's purchase records stay for the Customer's books, without the Viewer's email address.

10.2 The Viewer's own tools. Viewers can reset their password, see their purchases in their account page, and stop renewals themselves.

10.3 Forwarding. Server Room forwards to the Customer, within five business days, any request it receives from a Viewer about Viewer Data. It does not answer the request itself unless the Customer authorizes it, except to tell the Viewer that the request has gone to the seller.

10.4 Help. Server Room gives the Customer the information it holds that the Customer reasonably needs to answer a request.

11. Assistance with assessments

Server Room helps the Customer with data protection impact assessments and prior consultations (Articles 35 and 36 of the GDPR). It provides this DPA and Annex II, and answers the Customer's reasonable questions about the processing.

12. Requests from public authorities

If Server Room receives a legally binding request from a public authority for Viewer Data, it:

• tells the Customer promptly, unless the law forbids it, and in that case asks for permission to tell;
• assesses whether the request is lawful, and challenges it where, after careful assessment, there are reasonable grounds to;
• discloses no more than the request requires;
• keeps a record of the request and of its answer.

For transfers under section 8, Clause 15 of the SCCs applies.

13. Return and deletion

13.1 While the Paywall runs. Server Room keeps each category of Viewer Data for the period Annex I.B gives for it, and deletes it automatically after that period. The Customer can delete a Viewer at any time (section 10.1).

13.2 When the Paywall ends for the Customer. This happens when the Customer turns it off and asks for deletion, or when its plan ends.

1. The Customer may download its Viewer Data for 30 days (Terms of Service section 20.9).

2. Server Room then deletes Viewer Data from its live systems within 30 days.

3. It deletes Viewer Data from backups as those backups expire.

Credentials are deleted as section 20.8 of the Terms of Service provides. By accepting this DPA, the Customer chooses return by download, followed by deletion.

13.3 Server Room keeps Viewer Data beyond those periods only where European Union or Member State law requires it, and then only for as long as it requires.

13.4 On request, Server Room confirms the deletion in writing.

14. Records, information and audits

14.1 Server Room keeps a record of the processing it carries out for the Customer, as Article 30(2) of the GDPR requires. It makes available the information necessary to demonstrate compliance with this DPA: this DPA, Annex II, and written answers to the Customer's reasonable questions. In the ordinary course the Customer sends its questions as one questionnaire a year, and may ask further questions whenever it needs the answers to demonstrate compliance.

14.2 The Customer, or an independent auditor it mandates who is bound by confidentiality, may audit Server Room's processing for the Customer, on reasonable notice.

• Ordinary course: an audit starts from the information in 14.1 and takes place once a year, with thirty days' notice, during business hours.
• When those limits give way: a supervisory authority requires it; after a personal data breach that affects the Customer; where the information given does not demonstrate compliance; or where there are reasonable grounds to believe Server Room is not complying.
• Limits that always apply: an audit never gives access to other customers' data. Where the proposed auditor is a competitor of Server Room, Server Room may ask the Customer to mandate another.
• Cost: the Customer bears the cost, unless the audit reveals a material breach of this DPA by Server Room.

Server Room holds no independent security certification, such as ISO/IEC 27001 or a SOC 2 report.

14.3 Nothing in this section limits Clause 8.9 of the SCCs or the powers of a supervisory authority.

15. Liability

15.1 Server Room's total liability to the Customer for damages under this DPA is limited for each contract year.

• The limit. For each event, the reference amount is what the Customer paid or owes Server Room in the twelve months before that event for the plans on which it used the Paywall or DRM, or USD 5,000 if that is more. The limit for a contract year is the highest reference amount of any event counted in that year.
• What uses it up. What Server Room has paid or owes for damages under this DPA in that year comes off the limit. A higher reference amount raises the limit; it does not create a second one.
• The contract year. A contract year is each twelve months counted from the day the Customer accepted this DPA.
• Counting events. An event is counted on the day it happened. Events with the same cause count as one event, on the day of the first.

15.2 The reasonable, documented cost to the Customer of dealing with a personal data breach that Server Room or a Sub-processor caused is damage under 15.1. It covers finding out what happened and giving the notices the law requires, and it is not excluded as indirect loss.

15.3 Section 12 of the Terms of Service, and section 20.10 there, do not apply to liability under this DPA; this section does.

15.4 Nothing in the Agreement or this DPA limits:

• either party's liability to data subjects under Data Protection Law or the SCCs;
• liability under the SCCs where they do not allow it to be limited;
• the powers of a supervisory authority;
• liability for fraud, gross negligence or willful misconduct;
• any liability that cannot be limited by law.

16. US state privacy laws

Where a US state privacy law applies to Viewer Data, Server Room acts as the Customer's service provider or processor under that law. It:

• processes Viewer Data only for the business purposes in Annex I;
• does not sell or share Viewer Data, as those laws define selling and sharing;
• does not retain, use or disclose Viewer Data outside its direct business relationship with the Customer;
• does not combine Viewer Data with personal information from other sources, except as those laws allow;
• gives Viewer Data the level of protection those laws require.

Server Room tells the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remedy any use of Viewer Data that this DPA does not allow.

17. Term, changes and governing law

17.1 This DPA takes effect when the Customer accepts it, and lasts for as long as Server Room processes Viewer Data for the Customer. Some provisions go on after it ends, by their nature: liability, confidentiality, deletion, and the transfer clauses for as long as data is still held.

17.2 Server Room proposes any change by email to the contact in Annex I.A, at least thirty days before it takes effect, and asks the Customer to accept it in its dashboard. Publishing a new version on this page does not, by itself, change the DPA agreed with a Customer. A change required by law, or by new standard contractual clauses, may take effect sooner, with notice.

17.3 This DPA is governed by the law that governs the Agreement (Terms of Service section 16.13). The SCCs are governed by the law and courts chosen in section 8.

18. Contact

Questions, requests and notices about this DPA: support@serverroom.net.

Annex I. The parties and the processing

A. The parties

Data exporter: the Customer, as recorded when it accepts this DPA:

• legal name, and trading name if different;
• address, and official registration number if any;
• country of establishment, and the Data Protection Law that applies to it;
• contact person's name, position and email (who receives breach and change notices);
• role: controller or processor;
• signature and date: acceptance in the dashboard, recorded with the name of the person accepting, the date and time, and the DPA version.

Data importer:

• Data Room, Inc., operating as Server Room; 34-18 Northern Blvd #408, Long Island City, NY 11101, United States;
• contact: support@serverroom.net;
• activities: hosting and operating the Paywall and DRM for the Customer's video streaming plan;
• role: processor, or sub-processor where the Customer is a processor;
• signature and date: by acceptance, as above.

Representative in the European Union (Article 27 GDPR): DATA ROOM SRL, Bd. Dimitrie Pompeiu 8, Sector 2, 020337 Bucharest, Romania; support@serverroom.net.

B. Description of the processing

• Data subjects: the Customer's Viewers: people who sign up with the Customer through the Paywall, buy or try to buy access, redeem an access code, or watch content the Customer protects.
• Nature of the processing:
  • storing Viewer accounts and Sales;
  • signing Viewers in;
  • checking their access and device limits;
  • issuing short-lived playback tokens;
  • answering or passing on DRM license requests;
  • sending the Paywall's emails;
  • passing checkout details to the Customer's Stripe account and receiving its notices;
  • logging requests to operate and secure the service.
• Purpose: providing the Paywall and DRM the Customer turns on.
• Frequency: continuous, while the Paywall is on.
• Location: section 8.1.
• Sensitive data: none intended (section 4.2).

Categories of personal data and how long each is kept:

C. Competent supervisory authority

Determined under Clause 13 of the SCCs and recorded when the Customer accepts, as in the Marketplace DPA Annex I.C.

Annex II. Technical and organizational measures

1. Credentials are encrypted at rest, each kind with its own key.

• The Customer's Stripe key and webhook signing secret are encrypted with a key used for nothing else, held only on the two API servers that need it.
• DRM credentials are sealed with public-key encryption. The private key that opens them exists only on the streaming servers that use them, so the API servers that receive them cannot read them back.
• The secret behind Viewer playback tokens is derived when needed, not stored.
• Key files are readable by the system administrator only.

2. Credentials are never shown back. The dashboard shows only the last four characters of a key, the account it belongs to, a certificate's fingerprint and its expiry.

• Only the account owner can set or replace Credentials.
• Each change is recorded without the value.

3. Viewer passwords and sessions.

• Passwords are stored only as bcrypt hashes.
• Session tokens are stored only as SHA-256 hashes, and expire after 30 days.
• Playback tokens last ten minutes.
• Sign-up, sign-in and checkout are rate-limited per address.

4. No card data. Viewers enter payment details on Stripe's hosted page. They never reach Server Room's systems.

• Stripe's notices to the Paywall are accepted only with a valid signature made with the Customer's webhook secret.

5. Logging hygiene.

• Credential fields, PEM blocks and playback tokens are masked in Server Room's request records.
• The Paywall's payment-notice, token and play-authorization requests are kept out of those records altogether.

6. Access control.

• Staff reach Server Room's systems through personal accounts, and only as their role requires.
• Records are looked up by their identifier; a secret is never used as a search key.

7. Availability.

• The Paywall's API runs on two servers.
• Its database is a replica set in two data centers (New York and Bucharest).
• When the Paywall cannot be reached, new playback is refused rather than allowed.

8. Transport.

• The Paywall's API is reached over HTTPS only.
• DRM playback works over HTTPS only.
• Paid and protected channels are handed out with HTTPS addresses only.

9. Testing. Automated tests cover the token format, Stripe signatures, the credential vault and the masking of secrets in records.

10. What these measures do not do.

• Viewer email addresses and purchase records are not encrypted field by field. Access control protects them.
• Edge logs hold Viewers' IP addresses and the addresses they requested.

Annex III. Sub-processors

1. Affiliated companies that operate the servers with Server Room:

• Primcast LLC, 34-18 Northern Blvd #408, Long Island City, NY 11101, United States;
• DATA ROOM SRL, Bd. Dimitrie Pompeiu 8, Sector 2, 020337 Bucharest, Romania;
• PRIMCAST EUROPE SRL, the same address.

  Each operates, together with Server Room, the servers, network and database the Paywall runs on.

2. The provider that delivers the Paywall's emails to Viewers: Google LLC, United States. Where the Customer sets its own mail server, that server delivers them instead.

3. No other Sub-processors.

Not Sub-processors (for information):

• Stripe, Apple, Google and any other Customer's Provider: the Customer engages them under its own agreements (section 2.3).
• Data center operators and network carriers (including Cogent Communications and Pilot Fiber): they house and connect Server Room's own equipment and carry traffic, and do not process Viewer Data for Server Room.