Data Processing Agreement

Between Colson Studio Ltd ("Processor") and you, the account holder ("Controller"), together the "Parties."

This DPA forms part of the Terms of Service for Silo and applies automatically to your use of the service — you don't need to sign anything separately unless you specifically need a countersigned copy for your own compliance records (email [email protected]).

1. Roles

You are the Controller for personal data you input into or generate through Silo relating to your clients, crew contacts, and productions ("Job Data"). Colson Studio is the Processor, acting only on your instructions as set out in this DPA and the Terms of Service.

2. Scope and nature of processing

3. Processor obligations

Colson Studio will:

• Process Job Data only on your documented instructions (as embodied in the service's normal functionality), except where required by law
• Ensure anyone with access to Job Data (currently: Colson Studio's sole operator) is bound by confidentiality
• Implement appropriate technical and organisational measures, including: per-account query scoping that fails closed (unauthorised requests return a not-found response, not an access-denied one), encryption at rest for third-party access tokens and financial figures (day rates, invoice amounts, client names), and CSRF/CORS restrictions pinned to the production domain
• Keep no "browse your data" tool: the internal admin/support console surfaces only account status, connection health, error states, and record counts — never the content of your Job Data (job names, client details, rates, kit, call sheets or expenses)
• Log every direct human access to the production database. Statement-level audit logging is enabled on the database for all sessions except the application's own automated service role, so any hands-on access by the operator leaves a record
• Access the content of your Job Data directly only where you have raised a support request that requires it, or to investigate a security incident — and, absent an active security incident, tell you in the support thread first
• Not engage a new sub-processor without giving you the opportunity to object (see Section 4)
• Assist you, so far as reasonably possible, in responding to data subject requests and in meeting your own breach-notification obligations
• Notify you without undue delay after becoming aware of a personal data breach affecting Job Data
• Delete all Job Data on termination of your account, as described in the Privacy Policy, and not retain copies except where legally required

No self-dealing. Colson Studio never uses platform data for its own freelance work, rate-setting, or client acquisition, and never produces cross-user analyses of rates, clients, or bookings.

4. Sub-processors

Current sub-processors are listed in the Privacy Policy, Section 4. This is a shorter list than it might first appear, because Google Drive, Microsoft OneDrive, Dropbox, Xero, and FreeAgent are accessed under your own account and your own OAuth authorisation — Colson Studio is not the party contracting with those providers on your behalf for storage of your data; you already have that relationship directly. Colson Studio's actual sub-processors are limited to infrastructure and LLM-processing vendors it contracts with directly: Hetzner (hosting), Cloudflare (traffic security), Google Gemini API (reading call sheets, receipts, serial photos and WhatsApp messages; filing call sheets and calendar events to jobs; matching clients to accounting contacts; invoice-history import; and small text-parsing helpers — Privacy Policy Section 5 lists what each sends), Meta (WhatsApp Business Platform — receiving and replying to paperwork, job details and receipts sent to Silo's WhatsApp number), Resend (email), Sentry (error monitoring), Stripe (subscription billing), and Apple (iCloud Mail, which hosts the mailbox behind our support address).

We'll give you at least 14 days' notice by email before adding a new sub-processor that will process Job Data, so you can raise any objection.

5. International transfers

Where a sub-processor is located outside the UK, transfers are made under that provider's standard contractual safeguards, consistent with the UK's international transfer framework. Details available on request.

6. Audit

You may request reasonable information to demonstrate compliance with this DPA. Given the scale of the service, this is provided by written response rather than on-site audit, unless otherwise agreed.

7. Liability

Liability under this DPA is subject to the limitations set out in the Terms of Service, Section 9.