# Independent Controller Data-Sharing Schedule

Separately approved controller-to-controller sharing.

Draft preview · No effective date

[Read as Markdown](https://jolts.xyz/legal/controller-sharing-schedule.md)

**DRAFT — NOT EFFECTIVE. Use only for specifically approved controller-to-controller flows. This is not consent, a transfer instrument or permission for new data uses.**

This schedule applies between Jolts Inc. (“Operator”) and the party identified in the signed order (“Counterparty”). Each is a “Party”. It supplements the Platform Services Agreement for the identified disclosures only. This schedule must be expressly incorporated by version in the signed order. It controls conflicting commercial provisions only for the controller disclosures it covers; mandatory transfer instruments prevail within their scope. Processor activities remain governed by the applicable DPA and cannot be converted to independent reuse simply by referencing this schedule.

## 1. Confirm roles before sharing

Complete a separate record for each disclosure: disclosing and receiving legal entities; data-subject categories; precise fields; origin; purpose; frequency; recipient access; locations; retention; applicable lawful basis; notices and choices; and owner. Each Party determines its own approved purpose and means only where the facts support independent-controller status.

If the Parties jointly determine relevant purposes and means, stop and document the required joint-controller arrangement, allocation of notices/rights duties and information available to individuals. An “independent controller” label does not resolve that question. Neither Party acts as the other's agent or may make privacy representations on its behalf without authorization.

## 2. Permitted purposes and minimum data

The recipient may use disclosed information only for the expressly recorded purpose and lawful compatible uses identified in the record. **[DECISION: enumerate any independent fraud, accounting or campaign measurement purpose; specify whether identifiable user data is actually necessary.]** Do not use broad labels such as “optimization” to authorize unspecified profiling or new recipients.

No raw conversation disclosure, cross-property audience building, model training, re-identification of aggregate reports, data brokerage or sensitive targeting is permitted by silence or an incomplete schedule. Any proposed new activity requires its own legal assessment, changed notices/choices where required, and written agreement before processing. An agreed business purpose does not override a person's applicable opt-out or withdrawal.

Each Party must limit data to what is necessary, maintain appropriate accuracy for the use, and provide a correction/deletion coordination channel. Pseudonymous identifiers are not automatically anonymous information. If reporting is intended to be aggregate, specify suppression thresholds and re-identification safeguards rather than claiming anonymization based only on removal of names.

## 3. Lawful disclosure, transparency and choices

The discloser must have a lawful basis and authority to disclose; the recipient must have a lawful basis for its own use. Each must provide the notices and obtain or honour permissions required for its role, audience and technology. Do not treat acceptance of a publisher's general terms as universal advertising permission.

Document how applicable consent, withdrawal, objection, opt-out and preference signals travel with the disclosure and take effect. Missing or contradictory signals must follow the approved restricted-processing behavior. Neither Party may deliberately circumvent a choice through another identifier or property. Where sale/sharing or other jurisdiction-specific definitions apply, complete the required contract, notice and user-choice provisions before activation; this schedule is not a declaration that the flow qualifies for an exemption.

## 4. Security, recipients and transfers

Each Party must apply appropriate security to its own processing and restrict access to authorized personnel and approved recipients. The signed security schedule and applicable legal obligations control; no certification is implied. A recipient may not disclose the data onward for unrelated purposes. Identify processors and other recipients and put the necessary contracts and safeguards in place before access.

Record processing and access countries. Execute the correct transfer instrument and annexes where required; a controller-to-processor module cannot simply be used for an independent-controller disclosure. Suspend the affected transfer if its required safeguards cannot be maintained.

## 5. Rights, incidents and regulatory cooperation

Each Party remains responsible for rights requests and notices relating to its own processing. Cooperate to identify relevant records, pass requests to the appropriate contact, and propagate valid corrections/deletions or restrictions where required. Do not make a person pursue both Parties unnecessarily when a coordinated response is feasible. Do not promise deletion of another Party's records without a working mechanism and applicable authority.

Promptly notify the other Party of a confirmed incident affecting shared data where necessary for its response, and provide available scope, consequences and mitigation information without waiting for a complete investigation. **[DECISION: contractual timing and escalation appropriate to actual incident capability.]** Each Party handles its own statutory notifications and must not prevent the other from meeting its duties. Preserve evidence and cooperate proportionately while protecting unrelated data and lawful privilege.

## 6. Retention, cessation and accountability

Each Party must apply the documented retention/deletion rules and separate legally required records from data retained for ordinary processing. On termination or an invalidated purpose, stop the affected disclosure/use and delete or restrict data as required; an accounting retention obligation does not authorize continued ad personalization.

Maintain evidence supporting the agreed flow and provide reasonable compliance information to the other Party. If a Party identifies a material defect in lawful basis, permission, security or purpose limitation, promptly investigate and suspend the affected flow where needed. Resolve liability and indemnities explicitly in the order; neither Party may contract away an individual's mandatory rights.

## Required sharing record

**[DECISION: complete and sign before the first disclosure.]** Include the Parties, roles, purpose, fields, subjects, legal bases, collection notices, recipient notices, choice signals, onward recipients, locations/transfer instruments, retention, security controls, incident/rights contacts, audit evidence, effective date and review trigger. No empty entry grants permission. General notices may need a jurisdiction-specific supplement after launch markets are selected.