Sep 4
Subject: Agency acting as processor / Tally as subprocessor
Hello,
I operate a German recruiting marketing agency.
Our clients/employers are the GDPR data controllers for applicant data. Levan Media processes applicant data solely on their documented instructions under an Art. 28 GDPR data processing agreement.
We would like to manage multiple client recruitment forms through one central Levan Media Tally account.
In this setup Levan Media would therefore act as a processor, while Tally would need to act as our subprocessor for the form response data.
Does your current DPA cover this processor-to-subprocessor relationship, despite referring to the Tally customer as the “Controller”?
If yes, could you please confirm this in writing or provide the applicable contractual clause/addendum?
Pending
Hi Levan, Thanks for reaching out to us on this request. To clarify the roles here: under our Data Processing Agreement (https://tally.so/help/data-processing-agreement), Tally acts as the Processor, and the party that holds the Tally account — in this case, Levan Media — is treated as the Controller. That's fixed by how our DPA is structured, regardless of your own downstream relationship with your clients. So to answer directly: there's no processor-to-sub-processor arrangement to cover here. Tally isn't acting as anyone's sub-processor in this setup — we're the Processor, and you (Levan Media) are the Controller for the purposes of our agreement. Your own contract with your clients (where you act as processor for them) is a separate matter between you and them, and doesn't change how our DPA applies. A couple of practical notes: Our DPA applies automatically once a professional user creates a Tally account and agrees to our Terms and Conditions — there's no separate document to sign. We don't issue custom or bespoke DPA addenda per customer, so we wouldn't be able to add clause language specific to this setup. Separately from the DPA question — hosting multiple distinct clients' forms under one central Tally account may fall outside our Fair Use Policy (https://tally.so/help/fair-use-policy), which is generally scoped to a single organization's own use. If you're planning to manage several clients from one account, it's worth flagging that with us so we can look at whether a custom plan makes sense for that use case. If you have any further questions, or concerns, please don't hesitate to reach out back to us here; https://tally.so/support.