Draft document, pending legal review.
Data processing agreement (GDPR article 28)
Parties and purpose
This agreement binds the customer (controller) and [À COMPLÉTER : raison sociale] (processor) for the processing of personal data contained in the customer's videos, transcripts, comments and viewing analytics. It forms part of the terms and applies upon their acceptance.
Instructions
The processor only processes data on the customer's documented instructions, expressed through use of the service and its settings (sharing, retention, requested AI features, strict EU mode).
Confidentiality and security
Staff bound by confidentiality. Encryption in transit and at rest, random share links, hashed passwords, access control on every request, logging, daily database backups.
Sub-processors
The customer authorises the sub-processors listed on the Subprocessors page. Any addition or replacement is announced at least 30 days in advance; the customer may object and terminate without charge.
Assistance
The processor helps the customer answer data subject requests (export, deletion) and carry out impact assessments. Any data breach is notified to the customer within 48 hours of discovery.
End of contract
At the end of the contract, data is deleted within 35 days (backups included), after a 30-day export period.
Audit
The processor makes available the information needed to demonstrate compliance and allows reasonable audits, at the customer's expense, with 30 days' notice.