This agreement is between Stagent B.V., trading as TAP (The Artist Passport), registered in the Netherlands under Chamber of Commerce number 75826216, at Keizersgracht 520H, 1017 EK Amsterdam ("we", "us"), and the company registering an application ("you").
You accept it when you register an application. We record which version you accepted, when, and from where. It applies alongside the API conditions of use, which bind everyone who reads from the register. Where the two differ, this agreement wins for registered applications.
Approval is approval of one purpose
Before we approve your application, you tell us in its description what it does with register data. We review the app when you register it and may review changes. The description on file is what binds you, whether or not we re-read every edit.
The description you registered is recorded against your application and shown to holders on the consent screen. Using register data for something that description does not cover is a breach of this agreement, and we do not need to argue about whether the other use is reasonable. Come back and ask; changing the description is free and usually quick.
Where your application reads the passport we issued a person, that person authorises the read. Their authorisation reaches no further than the description you registered, and it ends the moment they withdraw it.
We may refuse an application, and we may withdraw approval. Tokens issued to an application that loses approval stop working.
Who is responsible for what
You decide why and how you use register data once you have it. That makes you an independent controller under the GDPR, not our processor, and this agreement is a controller-to-controller arrangement rather than a data processing agreement.
Practically, that means:
- You need your own legal ground for what you do with the data. Ours covers disclosing it to you; it does not cover your use.
- You tell your own users where the data came from, naming us.
- You answer requests from people about what you hold. We answer for the register.
- You tell us without delay if you suffer a breach involving register data.
An application acting purely on a holder's instruction, syncing one artist's own profile and nothing else, is a different arrangement. Ask us and we will put a processing agreement in place instead.
What you may not do
- Sell, rent, sublicense or otherwise pass register data to anyone else, including companies in your own group.
- Use register data to train or fine-tune a machine learning model.
- Build a directory, a mailing list, or any standing collection of artists or their representatives that works without us.
- Retrieve in bulk without the scope that allows it, or at a rate we have not agreed.
- Use contact details to sell anything to the people listed.
- Combine register data with other sources to enrich profiles of the people in it.
- Present register data as your own, or imply we endorse you.
Each of these applies equally if you instruct someone else to do it, or give someone else the means to do it.
What you may keep, and for how long
You may cache what you retrieve, within the limits in the API conditions of use: 24 hours for contact details, rider metadata and a holder's passport, 30 days for the artist's name, handle, biography, intro, facts, images, channels and verification status.
When we send you a change or a deletion, you apply it within 24 hours, including to anything you have already shown or published.
On termination you delete everything you hold, stop using it immediately, and confirm in writing within 14 days that you have done so.
Keeping it safe
Encrypt register data in transit and at rest. Limit access to people who need it. Keep your client secret secret, rotate it if it leaks, and tell us the same day. Keep access logs for at least 12 months.
Once a year we may ask you to confirm in writing that you still meet this agreement and are still using the data for the approved purpose. We may also ask, with reasonable notice, for evidence. Refusing is grounds for withdrawing approval.
What a breach costs
Because the damage caused by a copied register cannot be calculated, breach of the resale, copying or purpose-limitation clauses carries an immediately payable penalty of €25,000 per breach, plus €2,500 for each day it continues, under article 6:91 of the Dutch Civil Code. This penalty does not replace our right to claim damages or an injunction, and both may be pursued alongside it.
For any other breach we may suspend or withdraw access, with or without notice depending on the risk.
The register is a database, and it is ours
We invest continuously in obtaining, checking and presenting the records in the register, including a manual review of every verification and of every passport we issue. That gives us a database right under the Dutch Databases Act, alongside the rights in this agreement.
That right runs against anyone who extracts or reuses a substantial part of the register, whether or not they have an agreement with us.
Attribution
Where you show register data to your users, name The Artist Passport as the source and link to the artist it came from. You may use our name factually. You may not use our logo or suggest a partnership without our written agreement.
Ending it
Either of us may end this agreement at any time. Ours takes effect immediately where there is a breach or a risk, and otherwise with 30 days' notice.
Ending it ends your access, triggers the deletion and confirmation above, and leaves the confidentiality, penalty, database right and liability clauses standing.
Liability
You cover us for claims by third parties, and for any action by a supervisory authority, arising from what you did with register data.
Our own liability to you is limited to €500. We do not warrant that the register is accurate, complete or current: artists maintain their own profiles and we do not check what they enter.
Changes
We may change this agreement. Material changes are announced by email to the address on your application at least 30 days beforehand, and we will ask you to accept the new version. Changes to the register's structure that break your integration get the same notice.
The dull but necessary part
Dutch law. The court in Amsterdam. English prevails over any translation.