1. Application
This Data Processing Addendum ("DPA") applies where you use Deepacal to process personal data of third parties — for example uploading a colleague's or client's likeness — and forms part of the Terms. For that data, you are the controller and Deepacal is the processor. For account, billing, security and platform-improvement data, Deepacal is the controller and its Privacy Policy applies.
2. Processing details
- Subject matter — provision of AI media generation, storage and delivery services.
- Duration — for the term of your account and any retention period stated in the Data Retention & Deletion Policy.
- Nature and purpose — hosting, transmission, inference, transcoding, storage and deletion.
- Categories of data — images, video, audio, biometric identifiers, scripts, contact identifiers and usage metadata.
- Data subjects — you, your personnel, your clients and individuals depicted in your content.
3. Deepacal's obligations
- Process personal data only on your documented instructions, which include your use of the Services, unless required by law.
- Ensure personnel are bound by confidentiality.
- Implement appropriate technical and organisational measures as described in the Security Policy.
- Assist you, taking into account the nature of processing, with data subject requests, DPIAs and regulator engagement.
- Notify you without undue delay after becoming aware of a personal data breach affecting your data.
- Delete or return personal data at the end of the relationship, subject to legal retention.
- Make available information necessary to demonstrate compliance and allow audits limited to once annually, on reasonable notice, subject to confidentiality and proportionality.
4. Subprocessors
You authorise Deepacal to engage the subprocessors listed in the Subprocessors & Third-Party Providers Notice, and to add or replace subprocessors with prior notice by email or in-app announcement. You may object on reasonable data-protection grounds, in which case you may terminate the affected service. Deepacal remains liable for its subprocessors' performance.
5. International transfers
Where personal data is transferred out of the EEA, UK, Switzerland or Nigeria, the EU Standard Contractual Clauses (Module Two, controller to processor) are incorporated by reference, together with the UK International Data Transfer Addendum where applicable, with Deepacal as data importer and you as data exporter, and with the governing law and forum specified in the Terms unless mandatory law requires otherwise.
6. Your obligations
You warrant that you have a lawful basis, including explicit consent for biometric data, for every individual whose data you upload, that you have provided required notices, and that your instructions do not require Deepacal to breach applicable law.