Data Processing Agreement

Acceptance

This Data Processing Agreement is accepted electronically when Customer accepts the Clueso Terms of Service or enables a paid plan. No signature is required and no field is left blank. A record of acceptance, including the accepting account and timestamp, is retained and available to Customer on request.

1. Key terms

2. Service provider relationship — CCPA

To the extent the California Consumer Privacy Act, as amended (the “CCPA”), applies, the parties agree that Provider is a service provider receiving Personal Data from Customer to provide the Service, which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer, and will not retain, use or disclose it except as necessary to provide the Service or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions in this Section and will comply with them. Provider will notify Customer if it can no longer meet its obligations under the CCPA.

3. Processor and sub-processor relationships

• Provider as Processor. Where Customer is a Controller of the Customer Personal Data, Provider is a Processor Processing on Customer’s behalf.
• Provider as Sub-processor. Where Customer is a Processor of the Customer Personal Data, Provider is a Sub-processor.

4. Processing

• Processing details. Annex I(B) describes the subject matter, nature, purpose and duration of Processing, the categories of Personal Data and the categories of data subjects.
• Processing instructions. Customer instructs Provider to Process Customer Personal Data: (a) to provide and maintain the Service; (b) as further specified through Customer’s use of the Service; (c) as documented in the Agreement; and (d) as documented in any other written instructions given by Customer and acknowledged by Provider. Provider will abide by these instructions unless prohibited by Applicable Laws, and will immediately inform Customer if unable to follow them.
• Processing by Provider. Provider will Process Customer Personal Data only in accordance with this DPA. If Provider updates the Service to include new products, features or functionality, Provider may change the details in Annex I(B) as needed to reflect those updates, by notifying Customer.
• Customer Processing. Where Customer is a Processor and Provider a Sub-processor, Customer will comply with all Applicable Laws governing its own Processing.
• Consent to Processing. Customer has made all disclosures, obtained all consents and implemented all safeguards required under Applicable Data Protection Laws.

5. Sub-processors

• Provider will not transfer Customer Personal Data to a Sub-processor unless Customer has approved that Sub-processor. The current list of Approved Sub-processors — their identities, countries of location and anticipated Processing tasks — is maintained in the published sub-processor list and is incorporated into this DPA by reference.
• Provider gives notice of any intended addition or replacement of a Sub-processor by updating the published sub-processor list at least ten (10) business days in advance, together with the information necessary for Customer to exercise its right to object. Customer may subscribe at that page to be notified of changes. Customer may object within ten (10) business days of the update; if Customer does not object within that period, Customer will be deemed to accept the change. If Customer objects, the parties will cooperate in good faith to resolve the concern.
• When engaging a Sub-processor, Provider will have a written agreement ensuring the Sub-processor accesses and uses Customer Personal Data only to the extent required to perform the subcontracted obligations and consistent with this DPA.
• Where the GDPR applies, the obligations in this DPA under Article 28(3) are imposed on the Sub-processor. Provider will share, at Customer’s request, a copy of its agreements with Sub-processors, redacted as necessary to protect confidential information.
• Provider remains fully liable for all obligations subcontracted to its Sub-processors, including their acts and omissions.
• Customer-connected integrations are not Sub-processors. Where Customer connects a third-party platform, such as a documentation or help-centre platform, Customer directs Provider to write generated content into Customer’s own tenant on that platform, under Customer’s own agreement with that provider. Provider does not appoint those providers, does not determine their security, retention or sub-processing practices, and is not responsible for their Processing. Connecting or disconnecting such a platform is within Customer’s control and is not a Sub-processor change under this Section.

6. Restricted transfers

• Authorisation. Customer agrees Provider may transfer Customer Personal Data outside the EEA, the United Kingdom or other relevant territory as necessary to provide the Service, implementing appropriate safeguards where no adequacy decision applies.
• Ex-EEA transfers. Where the GDPR protects the transfer, the parties are deemed to have signed the EEA SCCs, incorporated by reference, completed as follows: Module Two (Controller to Processor) applies where Customer is a Controller; Module Three (Processor to Processor) applies where Customer is a Processor. The docking clause in Clause 7 does not apply. In Clause 9, Option 2 applies, and the minimum time period for prior notice of Sub-processor changes is ten (10) business days. In Clause 11 the optional language does not apply. All square brackets in Clause 13 are removed. In Clause 17 (Option 1) the EEA SCCs are governed by the law of the Governing Member State, and under Clause 18(b) disputes are resolved in its courts. This document contains the information required by Annexes I, II and III.
• Ex-UK transfers. Where the UK GDPR protects the transfer, the parties are deemed to have signed the UK Addendum. Neither party may end the UK Addendum under its Section 19. A revised Approved Addendum issued under Section 18 of the UK Addendum applies from its start date, and the parties will revise this DPA in good faith where needed.
• Swiss transfers. Where the Swiss Federal Act on Data Protection (“FADP”) applies to the transfer, the EEA SCCs apply with these adaptations: references to the GDPR are to be understood as references to the FADP insofar as the transfer is subject to the FADP; the competent supervisory authority in Annex I(C) is the Swiss Federal Data Protection and Information Commissioner insofar as the transfer is governed by the FADP; and the term “member state” is not to be interpreted so as to exclude data subjects in Switzerland from bringing proceedings in their place of habitual residence under Clause 18(c).

7. Security incident response

Upon becoming aware of any Security Incident, Provider will: (a) notify Customer without undue delay and no later than seventy-two (72) hours after becoming aware; (b) provide timely information as it becomes known or is reasonably requested; and (c) promptly take reasonable steps to contain and investigate. Notification is not an acknowledgement of fault or liability.

Notifications made under this Section will, to the extent then known: (i) describe the nature of the Security Incident, including where possible the categories and approximate number of data subjects and Customer Personal Data records concerned; (ii) provide the name and contact details of a point of contact at Provider; (iii) describe the likely consequences of the Security Incident; and (iv) describe the measures taken or proposed to address it and mitigate its effects.

Notification to third parties

Except to the extent required by Applicable Data Protection Laws, Provider will not notify any third party or supervisory authority of a Security Incident involving Customer Personal Data without Customer’s prior written consent, other than notice to law enforcement, to Provider’s affected Sub-processors, or to Provider’s insurers and professional advisers.

8. Audit and reports

• Audit rights. Provider will give Customer the information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits. Provider may restrict access where it would compromise intellectual property, confidentiality obligations or other legal obligations. Customer will exercise audit rights by instructing Provider to comply with the reporting and due-diligence requirements below. Provider will maintain compliance records for three (3) years after this DPA ends.
• Security reports. Provider is audited annually by independent third-party auditors against SOC 2 Type II and ISO/IEC 27001. On written request Provider will provide, on a confidential basis, a summary copy of its then-current report.
• Security due diligence. Provider will respond to reasonable written requests for information confirming compliance, made to the Provider security contact, no more than once per year.

9. Coordination and cooperation

• Response to inquiries. If Provider receives an inquiry or request from a third party about the Processing of Customer Personal Data — including a data-subject request or a judicial, administrative or regulatory order — Provider will notify Customer where not legally prohibited and will not respond without Customer’s prior consent. Provider will assist Customer in fulfilling valid data-subject requests.
• DPIAs and DTIAs. Where required by Applicable Data Protection Laws, Provider will reasonably assist Customer in conducting data protection impact assessments and data transfer impact assessments, and in consultations with supervisory authorities.

10. Deletion of customer personal data

• Deletion by Customer. Provider will enable Customer to delete Customer Personal Data consistent with the functionality of the Service, and will comply as soon as reasonably practicable except where further storage is required by Applicable Laws.
• Deletion at expiration. Within thirty (30) days of the expiration or termination of the Agreement, Provider will delete or return Customer Personal Data from its systems, without requiring a separate request from Customer, unless further storage is required or authorised by Applicable Laws. On Customer’s request, Provider will provide written certification of that deletion. Where return or destruction is impracticable or prohibited, Provider will prevent further Processing and continue to protect the data.
• Certification under the SCCs. Where the EEA SCCs or UK Addendum apply, Provider will provide the certification of deletion described in Clauses 8.5 and 16(d) of the EEA SCCs if Customer asks for one.

11. Limitation of liability

• Liability caps and damages waiver. To the maximum extent permitted under Applicable Data Protection Laws, each party’s total cumulative liability arising out of or related to this DPA is subject to the waivers, exclusions and limitations of liability stated in the Agreement.
• Related-party claims. Claims arising out of this DPA may only be brought by the Customer entity that is party to the Agreement.
• Exceptions. This DPA does not limit liability to an individual regarding their data protection rights, nor liability between the parties for violations of the EEA SCCs or UK Addendum.

12. Order of precedence

Applies across the whole agreement

Where there is any inconsistency, the part listed earlier controls: (1) the EEA SCCs or UK Addendum, (2) the Order Form, (3) a module annex to this DPA, (4) the Service Level Agreement, (5) this DPA, (6) the Master Services Agreement, (7) the Terms of Service. A module annex may vary scope of service only, and may not vary liability, intellectual property, confidentiality or governing law.

13. Additional modules

If Customer enables an additional module, the module annex for that module in effect at the time of enablement applies from that date, as referenced in an Order Form or by Customer’s written or in-product acceptance, without further amendment of this DPA. Provider will make the applicable module annex available to Customer on or before enablement. Modules not enabled by Customer are not part of this DPA and none of the Processing they describe occurs.

14. Term

This DPA begins when the parties sign or electronically accept it and continues until the Agreement expires or terminates. Both parties remain subject to its obligations until Customer stops transferring Customer Personal Data to Provider and Provider stops Processing it.

15. Annex I(A) — List of parties

16. Annex I(B) — Description of transfer and processing

The service

Clueso is a cloud-based platform that converts screen recordings into articles and editable professional videos, and hosts the resulting content.

Categories of data subjects

• Customer’s personnel who use the Service
• End users who view or interact with content Customer hosts through the Service
• Any other individual whose personal data is contained in content Customer records, uploads or submits to the Service

Categories of personal data

• Name and contact information such as email address
• Account and organisation identifiers, including identifiers issued by a federated identity provider where Customer uses single sign-on
• User activity and analysis data, including device information and IP address
• Audio, video, screen-recording and transcript content submitted by Customer, and any personal data contained in it

Special category data

Provider does not require Special Category Data to deliver the Service and does not intentionally Process it. Customer is responsible for ensuring content it submits does not contain Special Category Data unless it has established a lawful basis and notified Provider in writing.

Frequency of transfer

Continuous, for the duration of the Agreement — data is collected when Customer interacts with the Service to create, edit, organise or host content.

Nature and purpose of processing

• Receiving data, including collection, access, retrieval, recording and data entry
• Holding data, including storage, organisation and hosting of content for delivery to viewers
• Using data to generate articles, videos, voiceovers and translations, including transmission to the AI sub-processors in the published sub-processor list
• Erasing data, including destruction and deletion

Duration of processing

Provider will Process Customer Personal Data for as long as required to conduct the Processing instructed in Section 4, or as required by Applicable Laws. Content marked for deletion is securely deleted or anonymised within a maximum of thirty (30) days.

17. Annex I(C) — Competent supervisory authority

The supervisory authority of the data exporter, determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum. For transfers governed by the FADP, the Swiss Federal Data Protection and Information Commissioner.

18. Annex II — Technical and organisational measures

19. Annex III — List of sub-processors

The current list of Approved Sub-processors, including identities, countries of location and anticipated Processing tasks, is maintained in the published sub-processor list and is incorporated into this DPA by reference. Changes are notified in accordance with Section 5.

Why this annex is a reference rather than a fixed table

Incorporating the list by reference, backed by the advance notice and objection right in Section 5, gives Customer the same protection while keeping a single maintained source of truth — rather than requiring the agreement to be re-executed whenever a vendor changes.

20. Definitions