This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service between ReadyForm B.V. ("ReadyForm", "Processor", "we", "us", or "our") and the customer that has created an account to use the ReadyForm platform and related services (the "Customer", "Controller", "you", or "your") (together, the "Agreement").
This DPA reflects the parties' agreement with regard to the processing of Personal Data in accordance with the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and other applicable data protection law, including the UK GDPR and, where relevant, the Swiss Federal Act on Data Protection ("FADP").
This DPA is intended to be comprehensive and self-contained in respect of the processing of Customer Personal Data. In the event of any conflict between the terms of this DPA and the Terms of Service in relation to the processing of Personal Data, this DPA prevails. In all other respects, the Terms of Service continue to apply, including its provisions on liability, which apply to this DPA as described in Section 15.
1. DEFINITIONS AND INTERPRETATION
1.1 In this DPA, the following terms have the meanings given below, and other capitalised terms not defined in this DPA have the meanings given to them in the GDPR or in the Terms of Service, as applicable.
"Adequate Country" means a country, territory, or sector recognised by the European Commission, or, in respect of the UK GDPR, the UK Government, as providing an adequate level of protection for Personal Data under Article 45 GDPR or the equivalent UK provision.
"Applicable Data Protection Law" means, to the extent applicable to the processing of Customer Personal Data under this DPA: the GDPR; the UK GDPR and the UK Data Protection Act 2018; the Swiss FADP; and any other data protection or privacy law applicable to the parties in connection with the Agreement.
"Customer Personal Data" means any Personal Data contained within the Material that Customer, or its authorised users, upload to or otherwise process through the Service, and any Personal Data generated as Output from that Material, which ReadyForm processes on behalf of Customer under this DPA.
"EU SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission (Commission Implementing Decision (EU) 2021/914 of 4 June 2021), as amended, replaced, or superseded from time to time.
"Instruction" means a direction, issued by Customer to ReadyForm in accordance with Section 3.2, and directing ReadyForm to perform a specific or general action with regard to Customer Personal Data, including, without limitation, depersonalising, blocking, deleting, or making available Customer Personal Data.
"Restricted Transfer" means a transfer of Customer Personal Data from Customer to ReadyForm, or from ReadyForm to a Sub-processor, that is subject to the restrictions on international transfers set out in Chapter V of the GDPR, the UK GDPR, or the Swiss FADP, as applicable.
"Sub-processor" means any third party engaged by ReadyForm to process Customer Personal Data on ReadyForm's behalf, in order to provide the Service.
"UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office under Section 119A of the UK Data Protection Act 2018, as amended, replaced, or superseded from time to time.
1.2 Terms such as "Personal Data", "Special Categories of Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Personal Data Breach", and "Supervisory Authority" have the meanings given to them in the GDPR, and, where relevant to the context, the equivalent meanings given to them under the UK GDPR or the Swiss FADP.
1.3 The Section headings in this DPA are for convenience only and do not affect its interpretation. References to "Sections" are references to Sections of this DPA, unless stated otherwise.
2. SUBJECT MATTER, DURATION, AND ROLES
2.1 Subject Matter and Duration. This DPA applies to ReadyForm's processing of Customer Personal Data in connection with the provision of the Service. It takes effect on the date the Customer accepts the Terms of Service (the "Effective Date") and continues for as long as ReadyForm processes Customer Personal Data on the Customer's behalf, including any period necessary to complete deletion obligations under Section 10.
2.2 Roles of the Parties. As between the parties, Customer is the Controller, or a Processor authorised by its Controller to engage ReadyForm as a further Processor, and ReadyForm is the Processor. Customer determines the content-processing purposes as Controller, or conveys its Controller's authorised instructions as Processor, including what Material it uploads to the Service, and is responsible for ensuring it has a valid legal basis to do so, as required under Section 13 of the Terms of Service. ReadyForm processes Customer Personal Data only as a Processor acting on Customer's behalf and does not determine the purposes or means of that processing, except to the limited extent necessary to provide, secure, and support the Service in accordance with this DPA.
2.3 Details of Processing. The subject matter, duration, nature, and purpose of the processing, the categories of Data Subjects, and the types of Personal Data processed under this DPA are described in Annex I.
2.4 Customer Warranties. Customer represents and warrants that: (a) it has, and will maintain throughout the term of the Agreement, all necessary rights, consents, and legal bases required under Applicable Data Protection Law to enable ReadyForm to lawfully process Customer Personal Data as contemplated by the Agreement; and (b) its Instructions to ReadyForm, including its configuration and use of the Service, comply with Applicable Data Protection Law.
2.5 Special Categories of Personal Data. Customer must not upload Material containing Special Categories of Personal Data (such as data revealing racial or ethnic origin, health data, or biometric data used for identification purposes) unless it has an independent, lawful basis under Article 9 GDPR for doing so, and has notified ReadyForm in advance so that appropriate additional safeguards, if any, can be discussed and put in place.
3. RELATIONSHIP WITH THE GDPR AND SCOPE OF INSTRUCTIONS
3.1 Scope of Processing. ReadyForm will process Customer Personal Data only to the extent, and in a manner, necessary to provide the Service, perform its obligations under the Agreement, and comply with Customer's Instructions, and for no other purpose, except as required by applicable law.
3.2 Instructions. The Terms of Service, this DPA, and Customer's configuration and use of the Service constitute Customer's documented Instructions to ReadyForm regarding the processing of Customer Personal Data, unless otherwise agreed in writing between the parties. Customer may issue additional written Instructions consistent with the terms of the Agreement, and ReadyForm will comply with such Instructions unless doing so would require action inconsistent with the Agreement or applicable law, in which case ReadyForm will notify Customer.
3.3 Notification of Non-Compliant Instructions. If ReadyForm considers that an Instruction infringes the GDPR or other Applicable Data Protection Law, ReadyForm will promptly inform Customer, and may suspend performance of that Instruction until Customer confirms or modifies it, without liability for any resulting delay.
3.4 No Sale or Independent Use. ReadyForm will not sell Customer Personal Data or use it for independent purposes, including marketing to Data Subjects or training general-purpose AI models on identifiable Customer Personal Data, as further described in Section 12.5 of the Terms. Any promotional use under Section 12.2 of the Terms requires separate, affirmative, documented prior opt-in identifying the material and approved purpose, together with a specifically established legal basis and all necessary permissions for affected individuals and upstream rights holders. This DPA does not grant promotional authorisation. Acceptance of the Agreement or silence does not authorise reuse of processor-held Customer Personal Data for marketing. Withdrawal and removal are governed by the Terms and applicable data protection law.
4. READYFORM'S OBLIGATIONS AS PROCESSOR
4.1 Processing on Instructions. ReadyForm will process Customer Personal Data only on the documented Instructions of Customer, including with regard to Restricted Transfers, unless required to do otherwise by Union or Member State law to which ReadyForm is subject, in which case ReadyForm will inform Customer of that legal requirement before processing, unless that law prohibits such notification on important grounds of public interest.
4.2 Confidentiality of Personnel. ReadyForm ensures that persons authorised to process Customer Personal Data: (a) have committed themselves to confidentiality, whether under a contractual or statutory obligation of confidentiality; (b) receive appropriate training on their responsibilities regarding the protection of Personal Data; and (c) access Customer Personal Data only to the extent necessary to perform their role in providing the Service.
4.3 Security of Processing. ReadyForm implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to the rights and freedoms of Data Subjects, and will regularly test, assess, and evaluate the effectiveness of those measures.
4.4 Assistance with Data Subject Requests. Taking into account the nature of the processing, ReadyForm will, to the extent legally permitted, provide reasonable assistance to Customer, by appropriate technical and organisational measures, to fulfil Customer's obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR. Where ReadyForm receives a request directly from a Data Subject concerning Customer Personal Data, it will, without undue delay, inform the Data Subject that the request has been forwarded and will forward that request to Customer, without itself responding to the request unless authorised to do so by Customer or required by law.
4.5 Assistance with Compliance Obligations. Taking into account the nature of processing and the information available to ReadyForm, ReadyForm will provide reasonable assistance to Customer with: (a) ensuring compliance with security obligations under Article 32 GDPR; (b) Personal Data Breach notification obligations under Articles 33 and 34 GDPR, as further described in Section 9; (c) data protection impact assessments under Article 35 GDPR, where the processing is likely to result in a high risk, as further described in Section 5; and (d) prior consultation with a Supervisory Authority under Article 36 GDPR, where required.
4.6 Records of Processing. ReadyForm maintains records of its processing activities carried out on behalf of its customers, as required under Article 30(2) GDPR, and will make relevant information available to Customer upon reasonable request, to the extent necessary for Customer to comply with its own obligations under Article 30(1) GDPR.
4.7 Government and Law Enforcement Requests. If ReadyForm receives a legally binding request from a public or judicial authority for disclosure of Customer Personal Data, ReadyForm will, unless legally prohibited from doing so, notify Customer promptly and provide reasonable information about the request, so that Customer may seek a protective order or other appropriate remedy. Where ReadyForm is legally prohibited from notifying Customer, it will use reasonable efforts to obtain a waiver of that prohibition to allow it to make as much of the disclosure described above as possible, as soon as reasonably possible.
4.8 Data Protection Officer. ReadyForm has assessed that, given the nature, scope, and current scale of its processing activities, it is not required to appoint a Data Protection Officer under Article 37 GDPR. ReadyForm will reassess this position if its processing activities change in a way that would trigger that requirement. In the meantime, privacy-related inquiries, including those that would ordinarily be directed to a Data Protection Officer, can be sent to the contact described in Section 16.
5. DATA PROTECTION IMPACT ASSESSMENTS
5.1 Where Customer reasonably determines that a data protection impact assessment, or prior consultation with a Supervisory Authority, is required under Article 35 or 36 GDPR in connection with its use of the Service, ReadyForm will, upon Customer's reasonable request, provide such information about the nature of the processing, the security measures applied, and other relevant matters within ReadyForm's knowledge and control, as Customer reasonably requires to complete that assessment or consultation, subject to ReadyForm's legitimate interest in protecting its own confidential and proprietary information.
6. SUB-PROCESSORS
6.1 General Authorisation. Customer provides ReadyForm with a general authorisation to engage Sub-processors to process Customer Personal Data in connection with the provision of the Service, subject to the conditions of this Section 6.
6.2 Current Sub-processors. ReadyForm's current Sub-processors, and the purpose for which each is engaged, are listed in Annex III. This list is also made available, and kept up to date, on ReadyForm's website or on request.
6.3 Notification of New Sub-processors. ReadyForm will provide Customer with reasonable advance notice, of at least fourteen (14) days where reasonably practicable, before engaging a new Sub-processor to process Customer Personal Data, by direct email or in-app notice to Customer's designated contact, together with an update to Annex III or the published list. Notice must allow Customer a meaningful opportunity to object before processing starts.
6.4 Right to Object. If Customer has a reasonable, documented objection to a new Sub-processor based on data protection grounds, Customer may notify ReadyForm within fourteen (14) days of the notice described in Section 6.3. The parties will discuss the objection in good faith, including consideration of alternative arrangements that would avoid the need to use that Sub-processor for Customer's account. If the parties cannot reach a resolution within a reasonable time, Customer may, as its sole remedy, terminate the Agreement in respect of the affected Service by providing written notice, without further liability to either party for that termination, other than payment for Services already provided.
6.5 Sub-processor Obligations. Before disclosing Customer Personal Data to a Sub-processor, ReadyForm enters into a written contract with that Sub-processor imposing data protection obligations substantially equivalent to those set out in this DPA, including the appropriate transfer mechanism described in Section 8 where relevant, and requiring a level of security appropriate to the risk. ReadyForm remains liable to Customer for the performance of each Sub-processor's obligations, to the same extent ReadyForm would be liable if performing the services of that Sub-processor directly, subject to the limitations of liability set out in Section 15.
6.6 Sub-processor Oversight. ReadyForm periodically reviews the data protection and security practices of its Sub-processors, taking into account the nature of the Customer Personal Data each Sub-processor processes and the role it plays in providing the Service.
7. CONFIDENTIALITY
7.1 ReadyForm treats Customer Personal Data as confidential information of Customer and will not disclose it to any third party except: (a) to Sub-processors in accordance with Section 6; (b) to its own personnel and professional advisors on a need-to-know basis, subject to confidentiality obligations; (c) as instructed by Customer; or (d) as required by applicable law, in which case Section 4.7 applies.
8. INTERNATIONAL DATA TRANSFERS
8.1 Transfers From Customer to ReadyForm. ReadyForm is established in the Netherlands. A customer's location outside the EEA does not by itself make a transfer to ReadyForm a GDPR Restricted Transfer. Where an actual transfer requires safeguards, the parties must identify the exporter, importer, destination, and applicable law and complete an appropriate legally valid instrument before that transfer. The EU SCCs are not treated as automatically applicable solely because a customer is established outside the EEA.
8.2 Transfers From ReadyForm to Sub-processors. Where ReadyForm or a Sub-processor transfers Customer Personal Data outside the EEA in the course of providing the Service (for example, transcript-text processing by Anthropic or GPU workloads by RunPod where performed outside the EEA), ReadyForm ensures that an appropriate safeguard recognised under Chapter V of the GDPR is in place before the transfer occurs, which may include: (a) an Adequate Country determination in respect of the recipient's location; (b) the recipient's certification under the EU-U.S. Data Privacy Framework, where applicable; (c) the EU SCCs, Module Three (Processor to Sub-processor), together with any supplementary technical, contractual, or organisational measures necessary to ensure an essentially equivalent level of protection, having regard to the law and practice of the destination country; or (d) another valid transfer mechanism.
8.3 UK Transfers. Where a Restricted Transfer of Customer Personal Data subject to the UK GDPR is made to ReadyForm or to a Sub-processor located outside the United Kingdom, the UK Addendum is incorporated into, and forms part of, the EU SCCs applicable to that transfer under Section 8.1 or 8.2, as appropriate, and the parties agree to the UK Addendum's applicable terms with respect to that transfer.
8.4 Swiss Transfers. Where a Restricted Transfer of Customer Personal Data subject to the Swiss FADP is made to ReadyForm or to a Sub-processor located outside Switzerland, the EU SCCs applicable to that transfer under Section 8.1 or 8.2 apply with the amendments necessary to reflect the requirements of the Swiss FADP, including recognition of the Swiss Federal Data Protection and Information Commissioner as a competent supervisory authority where applicable. Appropriate adequacy decisions may apply to transfers to the Netherlands; a non-EEA Customer location alone does not trigger an SCC module.
Before reliance on any SCCs or UK Addendum, the applicable parties, module, selections, and mandatory annexes/tables must be completed for the actual transfer. Incorporation by reference alone does not complete an unspecified transfer instrument; SCCs prevail over conflicting contractual provisions.
8.5 Supplementary Measures. ReadyForm has assessed, and will keep under review, whether supplementary measures are necessary to ensure that Restricted Transfers under this Section 8 provide a level of protection essentially equivalent to that guaranteed within the EEA, having regard to the circumstances of the transfer and the law and practice of the destination country, and will implement such supplementary measures, including the technical measures described in Annex II, where reasonably necessary.
8.6 Future Changes. If the European Commission, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner issues a new or amended version of the EU SCCs, the UK Addendum, or an equivalent transfer mechanism, or if a new transfer mechanism becomes available or required under Applicable Data Protection Law, the parties agree to cooperate in good faith to implement any updated documentation reasonably necessary to maintain a lawful basis for the relevant transfer, and such updated documentation will apply automatically to the extent legally required, without further amendment of this DPA.
9. PERSONAL DATA BREACH NOTIFICATION
9.1 Notification Timeline. ReadyForm will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. An initial notice will not be postponed until an investigation is complete; further information is supplied in phases under Section 9.3. The controller's separate statutory seventy-two-hour authority-notification deadline does not give ReadyForm a seventy-two-hour waiting period.
9.2 Incident Contact. Suspected security incidents and follow-up questions must be sent to legal@readyform.ai. ReadyForm sends breach notifications to Customer's designated contact under Annex IV.
9.3 Content of Notification. The notification will describe, to the extent then known: (a) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and Personal Data records concerned; (b) the name and contact details of a point of contact within ReadyForm where more information can be obtained; (c) the likely consequences of the Personal Data Breach; and (d) the measures taken or proposed to be taken by ReadyForm to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. Where it is not possible to provide all such information at the same time, it may be provided in phases without undue further delay.
9.4 Cooperation. ReadyForm will provide reasonable cooperation and assistance to Customer as Customer reasonably requires to fulfil its own obligations under Articles 33 and 34 GDPR in respect of the Personal Data Breach, including where relevant to notify affected Data Subjects and the competent Supervisory Authority.
9.5 No Admission. A notification made under this Section 9 is not, and will not be construed as, an acknowledgement by ReadyForm of any fault or liability with respect to the Personal Data Breach.
10. CONTENT DELETION, REMOVAL, AND RETURN OF DATA
10.1 Deletion During the Term. Customer may use available project controls or send a documented deletion instruction to legal@readyform.ai. ReadyForm implements valid instructions without undue delay, subject to required legal retention and protected residual backups. Accepted source-video files, exports, and rejected uploads are also subject to the 180-day, 90-day, and 7-day lifecycle periods in Section 10 of the Terms, even while Customer's account is active. Promotional-publication removal under Section 15 of the Terms is a separate process.
10.2 Deletion on Termination. On termination or expiry of the Agreement, or closure of Customer's account, ReadyForm will return or delete Customer Personal Data at Customer's choice under Section 10.4 and delete remaining copies in accordance with Section 17 or Section 18 of the Terms of Service (as applicable), within the timelines specified there, save to the extent applicable law requires ReadyForm to retain some or all of that Customer Personal Data, in which case ReadyForm will isolate and protect that data from further processing except to the extent required by that law, until deletion is permitted.
10.3 Certification of Deletion. Upon Customer's written request following completion of a deletion described in Section 10.2, ReadyForm will provide Customer with written confirmation that the relevant Customer Personal Data has been deleted from ReadyForm's production systems, save for any data retained in accordance with the proviso in Section 10.2 or in encrypted backups pending their scheduled rotation or deletion in the ordinary course.
10.4 Customer's Choice of Return or Deletion. On termination, Customer may choose return or deletion of Customer Personal Data. Customer may export available data before closure or request a copy at legal@readyform.ai. Where return is chosen, ReadyForm provides the data in the format in which it is ordinarily maintained and then deletes remaining copies, except where applicable law requires retention. A timely outstanding return request is coordinated before the relevant data is deleted. Return does not require recovery of files already deleted under a disclosed lifecycle or extension of expired storage. ReadyForm requires relevant Sub-processors to comply with applicable return/deletion obligations. Residual backups remain protected and excluded from ordinary use pending their deletion cycle; deletion instructions are reapplied if a backup is restored.
11. AUDITS
11.1 Information and Audit Rights. ReadyForm will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, and will allow for, and contribute to, audits, including inspections, conducted by Customer or an auditor mandated by Customer, subject to Sections 11.2 and 11.3.
11.2 Conduct of Audits. Customer will provide ReadyForm with reasonable advance written notice, of at least thirty (30) days, of any audit, and audits will be conducted during ReadyForm's normal business hours, no more than once per twelve (12) month period unless required by a Supervisory Authority, in response to a Personal Data Breach or a substantiated compliance concern, or by Applicable Data Protection Law, and in a manner designed to minimise disruption to ReadyForm's business and to protect the confidentiality of ReadyForm's other customers' data and ReadyForm's confidential information, including by requiring any auditor to enter into a confidentiality agreement reasonably acceptable to ReadyForm.
11.3 Third-Party Reports. Where ReadyForm makes available a relevant third-party audit report, penetration test summary, security certification, or summary thereof, Customer may accept that report to avoid duplicative on-site audits where it adequately addresses the relevant requirements. This does not restrict an audit required by law, a competent authority, or a substantiated compliance concern that the report does not adequately resolve.
11.4 Costs. Each party bears its own costs of an audit, save that Customer will reimburse ReadyForm's reasonable costs of providing assistance with an audit that is not initiated as a result of a substantiated compliance concern.
12. INSURANCE
12.1 ReadyForm maintains, and will continue to maintain during the term of the Agreement, insurance coverage appropriate to the nature and scale of its business and the processing carried out under this DPA, taking into account industry practice for a business of ReadyForm's size.
13. NON-COMPLIANCE AND TERMINATION FOR CAUSE
13.1 Without prejudice to Customer's rights under Section 6.4, if either party becomes aware that an Instruction, or the manner in which the Agreement is being performed, infringes Applicable Data Protection Law, that party will notify the other party promptly, and the parties will work together in good faith to remedy the non-compliance.
13.2 If ReadyForm is unable to comply with its obligations under this DPA, or determines that it can no longer meet its obligations under Applicable Data Protection Law, it will notify Customer promptly, and Customer may suspend the transfer of Customer Personal Data, or terminate the Agreement in respect of the affected Service, without liability to ReadyForm other than for Services already properly provided, until such time as compliance is restored.
14. RELATIONSHIP TO THE TERMS OF SERVICE
14.1 This DPA does not relieve Customer of any of its own obligations under Applicable Data Protection Law as a Controller, including its obligations under Section 13 of the Terms of Service regarding the lawfulness of Material it uploads to the Service.
15. LIABILITY
15.1 Each party's liability arising out of or in connection with this DPA, whether in contract, tort (including negligence), or otherwise, is subject to the limitations and exclusions of liability set out in Sections 19 through 21 of the Terms of Service, which apply to this DPA as if set out in full, save that nothing in this DPA or the Terms of Service limits or excludes either party's liability for infringement of a Data Subject's rights under Applicable Data Protection Law to the extent such limitation or exclusion is not permitted under that law.
16. CONTACT
Privacy and data protection inquiries relating to this DPA, including requests under Section 4.8, can be sent to:
ReadyForm B.V. Newtonlaan 115, 3584 BH Utrecht, the Netherlands Email: legal@readyform.ai
Security incidents affecting Customer Personal Data can be reported to: legal@readyform.ai
17. TERM AND TERMINATION
17.1 This DPA takes effect on the Effective Date and remains in effect for as long as ReadyForm processes Customer Personal Data on Customer's behalf, notwithstanding any termination or expiry of the Agreement, until such processing ends in accordance with Section 10.
18. GENERAL
18.1 Order of Precedence. Where there is a conflict between the terms of this DPA and the Terms of Service in relation to the processing of Personal Data, the terms of this DPA prevail; in all other respects the Terms of Service govern the relationship between the parties. Where there is a conflict between this DPA and the EU SCCs or UK Addendum incorporated under Section 8, the EU SCCs or UK Addendum prevail to the extent required by Applicable Data Protection Law.
18.2 Amendments. ReadyForm may update this DPA from time to time to reflect changes in the Service, its Sub-processors, or Applicable Data Protection Law, in accordance with Section 3 (Changes to These Terms) of the Terms of Service. Where a change to the EU SCCs, the UK Addendum, or an equivalent transfer mechanism is required by law or by a competent authority, that change applies automatically without further amendment of this DPA, as described in Section 8.6.
18.3 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force and effect, and the invalid or unenforceable provision will be replaced by a valid provision that most closely reflects the original intent of the parties, consistent with Applicable Data Protection Law.
18.4 No Third-Party Beneficiaries. Except as expressly provided in the EU SCCs or UK Addendum incorporated under Section 8, this DPA does not confer any rights on any third party.
18.5 Governing Law. This DPA is governed by the laws of the Netherlands, consistent with Section 24 of the Terms of Service, save that the EU SCCs and UK Addendum incorporated under Section 8 are governed by the law specified in those instruments.
18.6 Entire Agreement. This DPA, together with the Terms of Service and its Annexes, constitutes the entire agreement between the parties regarding the processing of Customer Personal Data, and supersedes any prior agreement or understanding on that subject matter.
ANNEX I - DETAILS OF PROCESSING
Subject matter of processing: the provision of the ReadyForm video-editing platform and related services to Customer, as described in the Terms of Service.
Duration of processing: for the duration of the Agreement, plus any additional period required for deletion under Section 10 of this DPA.
Nature and purpose of processing: storage and preparation of customer video/audio; speech-to-text transcription of the audio track by Speechmatics (EU region), with Whisper on ReadyForm-controlled infrastructure as a fallback; interview-mode speaker diarisation using pyannote; face detection for reframing using YuNet; transcript-text analysis and AI-assisted selection of Pexels stock imagery; GPU rendering and export; and support carried out on Customer's instructions. Anthropic receives transcript text and Pexels stock previews, not customer video/audio or customer-footage previews. ReadyForm's independent business account administration, billing, affiliate administration, and consent-based product analytics are described in the Privacy Policy.
Categories of Data Subjects: Customer's authorised users; individuals appearing or heard in Material uploaded by Customer, which may include Customer's employees, contractors, clients, interview subjects, or members of the public, depending on Customer's use of the Service.
Categories of Personal Data: contact and identification data (such as name, email address, and account details) of Customer's authorised users; and, within Material uploaded by Customer, images, video, audio recordings, spoken statements, and any other personal data that Customer chooses to include, which may include the likeness and voice of identifiable individuals, transcript text, speaker grouping labels or derived audio features, and face-detection locations or derived image features used for editing.
Special Categories of Personal Data: none is intended to be processed, save to the extent Customer uploads Material containing such data in accordance with Section 2.5 of this DPA and the corresponding provisions of the Terms of Service.
Frequency of transfer: continuous, for as long as Customer uses the Service.
Method of transfer: electronic transmission over encrypted connections, as part of the ordinary operation of the Service.
Competent supervisory authority (for the purposes of the EU SCCs, where applicable): the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or the supervisory authority otherwise applicable to Customer under the EU SCCs.
ANNEX II - TECHNICAL AND ORGANISATIONAL SECURITY MEASURES
ReadyForm implements the following categories of technical and organisational measures, and will maintain measures that are at least as protective as those summarised below, updating them as appropriate to reflect the state of the art:
Pseudonymisation and encryption: Customer Personal Data is encrypted in transit using industry-standard protocols; ReadyForm uses pseudonymisation or aggregation techniques where feasible for analytics and product improvement purposes, as described in the Privacy Policy.
Confidentiality, integrity, availability, and resilience: access to Customer Personal Data is restricted to personnel and systems that require it to provide the Service, based on the principle of least privilege, with authentication controls in place for administrative access, and infrastructure designed for resilience against common failure modes.
Ability to restore availability and access: ReadyForm maintains reasonable backup and recovery procedures designed to protect against accidental loss of Customer Personal Data and to restore availability within a reasonable time following an incident.
Regular testing and evaluation: ReadyForm periodically reviews and tests the effectiveness of its technical and organisational security measures, and updates them as appropriate in light of that review.
Confidentiality of personnel: personnel with access to Customer Personal Data are bound by confidentiality obligations and receive appropriate training, as described in Section 4.2 of this DPA.
Infrastructure security: the Service is hosted on infrastructure that is maintained and secured in accordance with the hosting provider's own security standards, which are reviewed by ReadyForm as part of its Sub-processor management process described in Section 6.6.
Monitoring and incident response: ReadyForm maintains processes to detect, investigate, and respond to security incidents, including the Personal Data Breach notification process described in Section 9 of this DPA, and the single legal, privacy, and incident contact legal@readyform.ai as described in Section 9.2.
Data minimisation and retention: ReadyForm retains Customer Personal Data only in accordance with the retention periods described in the Terms of Service and Privacy Policy, and deletes it in accordance with Section 10 of this DPA.
Certifications and frameworks: ReadyForm has not, as of the date of this DPA, obtained a third-party security certification such as ISO 27001 or SOC 2. ReadyForm's security measures are nonetheless designed with reference to generally accepted security practices for cloud-based services. This Annex will be updated to reference any certification ReadyForm obtains in the future.
ANNEX III - PROVIDERS, DATA FLOWS, AND PROCESSING ROLES
The following schedule distinguishes content-processing Sub-processors from providers used for ReadyForm's independent account, billing, security, communication, analytics, and affiliate activities. A provider falls under the Sub-processor rules in Section 6 only to the extent it processes Customer Personal Data on ReadyForm's behalf. Brand names identify services; the applicable supplier agreement identifies the legal contracting entity. A supplier does not receive all customer content merely because it appears in this schedule.
A. Customer-Content Processing Infrastructure
Hetzner — video-file storage. Processes source videos, exports, and associated stored processing files and identifiers. Retention is governed by the file lifecycles and deletion obligations in Sections 10 of the Terms and this DPA. Storage is distinct from Supabase's database/authentication service. The selected Hetzner location governs physical file storage; no Netherlands-only location is promised.
RunPod — GPU video processing and rendering. Processes customer video/audio and temporary rendering inputs/outputs as required for the requested job. GPU workload locations are separate from Vercel/Supabase Frankfurt settings. No EEA-only RunPod processing commitment is made. Transfers outside applicable adequate jurisdictions are subject to Section 8.
Speechmatics — speech-to-text transcription. Receives the audio track of customer videos and a word list derived from the customer's script and brand terms; does not receive video frames. Processing takes place in Speechmatics' EU region (EU1); Speechmatics is established in the United Kingdom (adequacy decision). Transcription jobs are deleted by ReadyForm immediately after the result is retrieved and are in any event deleted by Speechmatics within 7 days. Not used for model training.
Vercel — website/app hosting and execution. Receives application requests and technical logs, and Customer Personal Data where routed through the application. The configured application execution region is Frankfurt, Germany (fra1). Global delivery, support, logs, and further-provider processing are not represented as confined to that execution region.
Supabase — database and authentication. Processes account/authentication information and database/project records. The configured primary project region is Frankfurt, Germany. Video-object storage is provided by Hetzner. Primary database location does not by itself guarantee EU-only support, logs, backups, or every associated service.
Anthropic — transcript-text analysis and selection of Pexels stock imagery. Receives transcript text, related text prompts, and previews of Pexels stock images. Does not receive customer video files, audio files, or previews extracted from customer footage. Transcripts may contain identifiable or sensitive data. Processing may involve the United States under applicable commercial data processing terms and Section 8. Identifiable customer content is not used for model training.
Whisper, pyannote, and YuNet identify software/model components, not automatically additional contracted Sub-processors. Whisper, used as a fallback when Speechmatics is unavailable, runs on ReadyForm-controlled infrastructure. Interview-mode diarisation and face detection are described in the Privacy Policy and Annex I; their data-protection classification depends on the actual purpose and derived information.
B. Communication, Diagnostics, and Service Security
Resend — delivery of service emails. Processes recipient addresses and necessary email content/delivery metadata. Where an email contains Customer Personal Data handled on Customer's instructions, the DPA applies to that processing. Customer footage and transcripts are not authorised as routine service-email payloads.
Sentry — error reporting and diagnostics. Processes necessary error, device, and application context. Raw footage, audio, transcript text, authentication secrets, and sensitive project information must be excluded from routine diagnostic payloads. If Customer Personal Data is nonetheless necessarily processed for support on Customer's instructions, it remains subject to the DPA.
Upstash — rate limiting and technical request/security state. Processes identifiers, counters, and other limited technical information needed for the service. Customer video/audio is not a rate-limiting input. DPA obligations apply to any Customer Personal Data processed on Customer's behalf.
The applicable region/endpoint and supplier agreement govern these providers' processing locations. Frankfurt application settings do not establish their locations. Restricted Transfers remain subject to Section 8.
C. Business Providers and User-Requested Integrations
PostHog — consent-based app product analytics and session replay. Processes usage events, identifiers, and recorded interface states/interactions under the Privacy Policy and Cookie Policy for ReadyForm's product improvement. Customer video/audio, transcripts, secrets, and sensitive project content are not authorised for routine analytics/replay. This activity is not an instruction allowing ReadyForm to repurpose Customer Personal Data under the DPA.
FirstPromoter — website affiliate attribution and referral/conversion administration. Processes attribution identifiers and necessary referral, signup, or conversion records. Browser tracking requires prior marketing consent. It is distinct from content rendering and has no authorised need to receive customer footage.
Stripe — payments, billing, subscriptions, and customer portal. Processes billing/payment and subscription records for ReadyForm's business administration. Depending on the payment activity, Stripe acts as processor or independent controller under applicable terms. Customer video/audio is not an ordinary billing input.
Pexels — supply of stock photos/videos and stock-search information. Supplies third-party stock content subject to https://www.pexels.com/license/. Pexels stock previews supplied to Anthropic are not previews of customer footage. Stock supply alone does not appoint Pexels to process customer video content.
Google Drive — user-requested file imports. Google operates the connected Drive account under its applicable user/service terms. ReadyForm accesses the selected files and permissions needed to perform the requested import. After import, Customer Personal Data is processed under this DPA. The integration alone does not mean Google is ReadyForm's contracted content Sub-processor for the user's existing Drive storage.
These business providers and integration providers are disclosed as relevant recipients. Their applicable agreements and operations may involve international processing. ReadyForm does not represent that all listed suppliers or all support personnel are located in the EEA. Section 8 and the Privacy Policy describe applicable safeguards. Customers can obtain relevant provider/location and transfer information at legal@readyform.ai.
ReadyForm maintains this schedule and gives advance notice of new content Sub-processors under Section 6. Provider-wide documentation does not convert global provider operations into a Frankfurt-only commitment.
ANNEX IV - CUSTOMER CONTACT FOR DATA PROTECTION MATTERS
Customer should designate a contact point for the purposes of this DPA, including receipt of Sub-processor notifications under Section 6.3 and Personal Data Breach notifications under Section 9.1, through the contact details associated with Customer's account, or such other contact details as Customer notifies to ReadyForm in writing from time to time.