Data Processing Agreement

Last updated: 2 November 2026

ClonifyLab is a service of DecodeIT OÜ (registry code 16593048, Tallinn, Estonia).

Summary

This summary helps you read the agreement. The numbered sections and the annexes are what count.

• This data processing agreement (DPA) is part of our Business service agreement. It covers the personal data we process to make and post your videos. You are the controller and we are your processor: we process the data only on your instructions.
• It contains, word for word, the EU's standard contractual clauses between controllers and processors, with their four annexes filled in for our service.
• We store data in the EU by default. Some of our AI vendors are in the US. Transfers to them rely on the EU Standard Contractual Clauses and, where the vendor is certified, the EU-US Data Privacy Framework. Annex IV lists every sub-processor.
• We tell you at least 30 days before we add or replace a sub-processor, and you can object.
• We tell you about a personal data breach affecting your data within 48 hours of becoming aware of it.
• Annex II sets how long we keep each kind of data. When the agreement ends, you can export your approved videos for 30 days. Then we delete your data and confirm it in writing.
• For some data we decide about ourselves, such as presenters' consent records and billing, we are a separate controller (section 2).

The clauses and the options chosen. Section 5 contains the standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (Official Journal L 199, 7.6.2021, p. 18). They are copied word for word from the official English text on EUR-Lex. We filled in only the options and the blank that the decision provides:

• Clause 1(a), Clause 8(c)(4), Clause 9.1(b) and (c) and the last paragraph of Clause 9.2: Option 1, Regulation (EU) 2016/679 (GDPR).
• Clause 5 (docking clause, optional): included.
• Clause 7.7(a): Option 2, general written authorisation, with 30 days' notice. Annex IV is the agreed list of sub-processors.

As Clauses 8(d) and 9.2 ask, Annex III sets out our assistance, including breach notice within 48 hours. We left out the decision's explanatory notes on how to fill in the annexes. Sections 1 to 4 add terms, as Clause 2(b) allows. If they ever contradict the clauses, the clauses prevail (Clause 4).

1. How this agreement works

1.1 This data processing agreement (the "DPA") is part of our Business service agreement (the "agreement"). It applies whenever we process personal data for you to provide the service.

1.2 The parties are you, the client, as controller, and DecodeIT OÜ, trading as ClonifyLab, as processor. Annex I gives the details.

1.3 Your contact person accepts this DPA online together with the agreement. They give their name, role and company and tick a box. We save the date, time and IP address and email them a PDF copy. That acceptance is your signature of Annex I, and we are bound from the same moment.

1.4 Your documented instructions (Clause 7.1) are: this DPA, including the retention rules in Annex II; the agreement and your order; the settings, topics and approvals you give through the service; and any other instruction you send us by email.

1.5 If the UK GDPR applies to you, this DPA is also the contract that its Article 28 requires, and references to Regulation (EU) 2016/679 include the UK GDPR where needed.

1.6 This DPA applies for as long as we process personal data for you, including the 30 days after the agreement ends and any deletion still to be done.

2. Where we are a controller, not your processor

2.1 DecodeIT OÜ is an independent controller, not your processor, for:

• each presenter's consent record and licence acceptance: the consent part of their recording (about 20 seconds: the consent sentence and the random phrase) and its transcript, their confirmation that they are 18 or over, their acceptance of the Likeness & Voice Licence, any withdrawal and, for an account we flag, an identity check through Stripe Identity. This is the evidence we must keep. We keep it while the clone exists and for 3 years after it is deleted, and after that only as hashes;
• your account, billing and contact details, and payment records (kept 7 years under accounting law);
• sanctions screening of you and your owners;
• security logs, such as sign-in logs (IP address and device, kept 7 days) and our audit log (kept 3 years);
• approval, post and audit records (who approved or did what, when, and on which file), kept 3 years as evidence;
• reports and takedown requests about content, which we handle as a hosting service under Regulation (EU) 2022/2065 (Digital Services Act); and
• our own duties as the provider of the AI system, such as marking every file under Article 50(2) of Regulation (EU) 2024/1689 (AI Act).

2.2 The clauses in section 5 don't cover this data (Clause 1(c) and Annex II). Our Privacy Policy does, and we answer people's requests about it ourselves.

2.3 A presenter's recorded consent is also the consent you rely on to have videos made with their face and voice. We keep the record so that both of us can show that the consent was given. On request, we confirm a presenter's consent status to you.

3. Agencies

3.1 If you are an agency acting for your own clients ("end clients", Schedule 2 of the agreement), you may be your end client's processor. Then we are your sub-processor, and you confirm that:

• each end client has authorised in writing the use of sub-processors, including us and those in Annex IV (Article 28(2) GDPR);
• your contract with each end client imposes data protection obligations that match this DPA (Article 28(4) GDPR); and
• your instructions to us match your end client's.

3.2 You pass our sub-processor notices on to your end clients, and their objections on to us.

3.3 Where you decide the purposes of the processing yourself, you are the controller.

3.4 If you and we agree, an end client may join these clauses under Clause 5 by signing Annex I. Online acceptance or an electronic signature is enough.

4. Practical terms

4.1 Sub-processors. We tell you by email, and on this page, at least 30 days before we add or replace a sub-processor (Clause 7.7(a)). If you object on reasonable data protection grounds within those 30 days, we look for a solution with you, such as not using that sub-processor for your data. If we can't find one, you may end the agreement, or the part of the service concerned, before the change applies, without any fee for ending early. We refund what you paid for the time after the end. Some of our sub-processors announce changes to their own sub-processors at shorter notice; we pass such notices on to you as soon as we get them.

4.2 Audits (Clause 7.6). We first answer audit questions in writing and with documents, including our sub-processors' audit reports and certificates. For an inspection, give us 30 days' notice, or less after a personal data breach or when a supervisory authority asks. Inspections take place in business hours, without disrupting the service and under a duty of confidentiality. They normally happen at most once a year, unless there are signs of non-compliance. Each of us pays its own costs.

4.3 Our assistance under Clauses 8 and 9 is included in your fees.

4.4 Each party's liability under this DPA follows the liability section of the agreement, except where Regulation (EU) 2016/679 doesn't allow it to be limited, for example towards data subjects under its Article 82.

4.5 Estonian law applies to this DPA, and disputes go to Harju County Court (Harju Maakohus) in Tallinn. This doesn't affect the rights of data subjects or the powers of supervisory authorities.

4.6 Contact for everything in this DPA: info@clonifylab.com. We have not appointed a data protection officer. Our supervisory authority is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee.

5. Standard contractual clauses

SECTION I

Clause 1

Purpose and scope

(a) The purpose of these Standard Contractual Clauses (the Clauses) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

(b) The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or Article 29(3) and (4) of Regulation (EU) 2018/1725.

(c) These Clauses apply to the processing of personal data as specified in Annex II.

(d) Annexes I to IV are an integral part of the Clauses.

(e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

(f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

Clause 2

Invariability of the Clauses

(a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.

(b) This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Clause 3

Interpretation

(a) Where these Clauses use the terms defined in Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively.

(c) These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 5 - Optional

Docking clause

(a) Any entity that is not a Party to these Clauses may, with the agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I.

(b) Once the Annexes in (a) are completed and signed, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I.

(c) The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party.

SECTION II

OBLIGATIONS OF THE PARTIES

Clause 6

Description of processing(s)

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause 7

Obligations of the Parties

7.1. Instructions

(a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.

(b) The processor shall immediately inform the controller if, in the processor’s opinion, instructions given by the controller infringe Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or the applicable Union or Member State data protection provisions.

7.2. Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

7.3. Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Annex II.

7.4. Security of processing

(a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.

(b) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.5. Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.

7.6. Documentation and compliance

(a) The Parties shall be able to demonstrate compliance with these Clauses.

(b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses.

(c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. At the controller’s request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.

(d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.

(e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

7.7. Use of sub-processors

(a) The processor has the controller’s general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.

(b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

(c) At the controller’s request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy.

(d) The processor shall remain fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfil its contractual obligations.

(e) The processor shall agree a third party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

7.8. International transfers

(a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725.

(b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 8

Assistance to the controller

(a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.

(b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller’s instructions

(c) In addition to the processor’s obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

• (1) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a ‘data protection impact assessment’) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;
• (2) the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;
• (3) the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated;
• (4) the obligations in Article 32 of Regulation (EU) 2016/679.

(d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

Clause 9

Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 of Regulation (EU) 2016/679 or under Articles 34 and 35 of Regulation (EU) 2018/1725, where applicable, taking into account the nature of processing and the information available to the processor.

9.1 Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

(a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant/(unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);

(b) in obtaining the following information which, pursuant to Article 33(3) of Regulation (EU) 2016/679, shall be stated in the controller’s notification, and must at least include:

• (1) the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
• (2) the likely consequences of the personal data breach;
• (3) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

(c) in complying, pursuant to Article 34 of Regulation (EU) 2016/679, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2 Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least:

(a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

(b) the details of a contact point where more information concerning the personal data breach can be obtained;

(c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 33 and 34 of Regulation (EU) 2016/679.

SECTION III

FINAL PROVISIONS

Clause 10

Non-compliance with the Clauses and termination

(a) Without prejudice to any provisions of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

(b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

• (1) the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;
• (2) the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725;
• (3) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

(c) The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions.

(d) Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

ANNEX I

List of parties

Controller(s):

1. The client
   • Name: the company named in the online acceptance of the agreement, with its registry code and VAT number, if any, as recorded there.
   • Address: the client's registered address, as recorded in the acceptance.
   • Contact person's name, position and contact details: the person who accepted the agreement for the client (name, role and work email, as recorded), or another contact the client names by email; and the client's data protection officer, if it has one.
   • Signature and accession date: accepted online by ticking the acceptance box. The date and time are saved in the acceptance record and shown in the PDF copy emailed to the client.
2. Any entity that accedes under Clause 5, for example an agency's end client
   • Name, address, contact person, and signature and accession date: as given in its accession.

Processor(s):

1. DecodeIT OÜ, trading as ClonifyLab
   • Name: DecodeIT OÜ (registry code 16593048, VAT number EE102552621), trading as ClonifyLab.
   • Address: Tallinn, Estonia; the registered address is in the Estonian e-Business Register (registry code 16593048).
   • Contact person's name, position and contact details: our privacy and security contact, info@clonifylab.com. We have not appointed a data protection officer.
   • Signature and accession date: DecodeIT OÜ agrees to these clauses with each client that accepts them online, on the date of that acceptance.

ANNEX II

Description of the processing

Categories of data subjects whose personal data is processed

• The client's presenters: people whose face and voice appear as clones in the client's videos, after they recorded their own consent.
• The client's approvers and contact people.
• The client's staff, presenters and other people shown or heard in the client's real clips, screen recordings, own-video takes, voice notes, pictures and style example videos, or named in its topics, brand facts and stories.
• People who comment a keyword on the client's Instagram posts (comment→DM, on Standard and Premium).
• For an agency: the same groups for each of its end clients.

Categories of personal data processed

• Presenters' clone data: their face and voice recording (one continuous take of 3 to 5 minutes) and the clips cut from it, the voice model, and the clone made from them (trimmed clips and voice). We treat all of this as special-category biometric data. Also: the transcript of the recording, the presenter's name, and the videos made with their clone, including what they say in them.
• Approvers and contact people: name, role, work email, Telegram user ID and the name and username Telegram shows, the messages and voice notes they send in the approval group (topics and feedback), and their approvals.
• Own-video takes: the image and voice of the person filmed (the uploader, or the client's presenter, who agreed), the sound of the take, and its transcript. The uploader confirms that nobody else can be recognised in the take and that nobody in it is under 18.
• Other material from the client: the image and voice of people in its real clips, screen recordings and pictures; transcripts of voice notes; and anything about people in its topics, brand facts and stories. Whoever adds real clips or screen recordings confirms that they are their own or the client's recordings and that everyone recognisable in them is 18 or over and agreed to appear.
• Style examples: example videos the client sends, which may show other people. We keep only notes on the format, never who appears.
• Posting data: the client's social account names, post texts, posting times and post numbers, such as views and likes.
• Comment→DM: Upload-Post processes commenters' usernames and comments only to send the reply. We store only the number of replies.

Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Sensitive data: presenters' face and voice recordings, voice models and clones. They are biometric data where they allow a person to be uniquely identified (Article 4(14) GDPR). We treat them as special-category data under Article 9 GDPR in every case. Restrictions and safeguards:

• Consent from each presenter. Through a personal link, the presenter records their own consent (the consent sentence and a random 4-word phrase, valid 10 minutes, spoken at the start of one continuous take and checked automatically from the transcript), confirms they are 18 or over and accepts the licence. The client never consents for them. The database checks for a valid consent before every face or voice job. A withdrawal stops new jobs at once and blocks downloads and exports.
• Strict purpose limitation. The data is used only to make the client's videos of that presenter, which the client's approvers approve. It is never used for anyone else, and we never use it to train AI models.
• No ID documents and no face matching, except a Stripe Identity check of an account we flag (section 2.1).
• Clone videos only for clients established in the EU, of presenters who live in the EU.
• Access restrictions. Private storage only, reached through row-level security and short-lived signed links. Only the founder can open raw recordings; anyone added later gets only the access they need and commits to confidentiality.
• A record of access. Every job and every download is logged with who, when and which file.
• Restricted onward transfers. Besides storage and hosting (Supabase, Cloudflare R2, Hetzner) and posting (Upload-Post; previews in your Telegram approval group), face and voice data goes only to the vendors that make clone videos: ElevenLabs (voice), fal (lip-sync, with no request history and its files deleted within 1 hour) and Google Cloud (renders in an EU region), each only after we saved its data processing terms. Sync only after its data-protection check and 30 days' notice.
• Additional security. Encryption in transit and at rest at our storage vendors, previews in approval groups with Telegram's "Restrict saving content", and the measures in Annex III.
• Short retention. The original recording is deleted 30 days after its clips are cut. The clone, including the ElevenLabs voice, is deleted at the vendors within 30 days of the end or of a withdrawal.

Nature of the processing

Collection (uploads straight to private storage, messages and voice notes in the approval group, and the web app), storage, transcription, AI generation (scripts, voices, lip-sync, pictures, music and moving shots), editing and rendering, marking (C2PA and a watermark), safety checks, previews to approvers, posting through Upload-Post after approval, automatic private replies to commenters, collecting post numbers, monthly reports, export and deletion. For own videos, ElevenLabs Speech to Text transcribes the takes, OpenAI moderation and our safety rules check the words that are kept, and Claude (Anthropic) reads them to cut the video. A take's picture isn't sent for moderation. There is no automated decision-making with legal or similarly significant effects.

Purpose(s) for which the personal data is processed on behalf of the controller

Making, editing, marking and posting the client's short videos, including versions in other languages; previews and approvals; the monthly report; comment→DM replies (Standard and Premium); file export; and support for the client.

Duration of the processing

For the term of the agreement, and after it until the deletion steps below are done: normally within 30 days of the end, and longer only under a legal hold.

The controller's instructions on retention

• Unapproved videos: deleted 90 days after they are made.
• Approved videos: kept until 30 days after the agreement ends.
• Clone and presenter data: the presenter's recording and the clips cut from it, the voice model (including the ElevenLabs voice) and every video that uses the clone are deleted, at the vendors too, within 30 days of the end of the agreement or of the presenter's withdrawal. A withdrawal blocks their download and export at once. The original recording is deleted 30 days after its clips are cut.
• The client's own clips, screen recordings and own-video takes: deleted, at the vendors too, when the client deletes them or 30 days after the end. We delete ElevenLabs' Speech to Text copy as soon as the transcript is saved. A take's transcript is deleted with the take.
• Style example uploads: deleted as soon as the format notes are saved, at most 24 hours after upload. We send Google (Gemini API) a link, never the file; Google may log the request and the video it reads for a limited time, to detect abuse and for disclosures the law requires, under its paid Gemini API terms.
• Approvers: an approver's details are removed when the client removes them (on the day an approver leaves), and at the latest 30 days after the end.
• At the end: during the 30 days after the agreement ends, the client can export its approved finals with their C2PA data. Then we delete the client's personal data and confirm the deletion in writing. Under Clause 10(d), this is the client's choice to have the data returned first and then deleted.
• After a pilot without a package: the same 30 days, counted from the end of the pilot.
• Backups: deleted data leaves our backups as they roll over: n8n database backups after 30 days and Supabase backups after 7 days.
• Legal holds: deletion pauses while a takedown, a report, a payment dispute, a consent dispute or an authority's request is open. Held files are deleted 30 days after the hold is released.
• Deletion removes files, not the approval, post and audit records we keep as a controller (section 2).

Transfers outside the EEA (Clause 7.8)

The controller instructs the processor to use the sub-processors in Annex IV, including those that process data outside the European Economic Area (EEA). We store data in the EU by default: Supabase in Ireland, Cloudflare R2 with EU jurisdiction, Hetzner in Germany and Google Cloud renders in the Netherlands. But several vendors are in the US (the AI vendors Anthropic, OpenAI, ElevenLabs and fal, and Namecheap for our mailbox), Google may process Gemini API requests outside the EU, and some vendors based outside the EEA may access data stored in the EU. Each such transfer relies on the EU Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 in the sub-processor's data processing terms and, where the sub-processor is certified, on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795).

For processing by (sub-) processors, also specify subject matter, nature and duration of the processing

Annex IV gives the subject matter and nature of each sub-processor's processing. Each sub-processor keeps the data only as long as its step needs, and never longer than the retention rules above allow. For example, fal keeps no request history and deletes its files within 1 hour, and ElevenLabs' Speech to Text copy is deleted as soon as the transcript is saved. Google (Gemini API) gets only a link to a style example, never the file, and may log the request and the video it reads for a limited time, to detect abuse and for disclosures the law requires, under its paid Gemini API terms.

ANNEX III

Technical and organisational measures including technical and organisational measures to ensure the security of the data

These are the measures we actually use.

Measures of pseudonymisation and encryption of personal data

• Data travels encrypted (HTTPS with TLS) between people and our services, and between our services and our vendors.
• Our storage vendors encrypt data at rest: Supabase (database and private uploads), Cloudflare R2 (media files) and Google Cloud (renders).
• Database records, file paths and the render jobs' logs use IDs, not names.

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

• Our server at Hetzner in Germany is reachable from the internet only through Cloudflare Tunnel. Its firewall lets nothing else in except SSH, and Cloudflare Access protects its admin pages.
• The render service runs only on the server's internal network and answers only requests that carry a shared secret. n8n's node for running shell commands is switched off.
• Customer renders run as Google Cloud Run jobs in an EU region. Each job gets only short-lived signed links to its inputs and outputs (valid 1 hour), holds no storage keys, and runs under a service account that may only run, read and cancel that job. The job's signing key is readable only by that service account.
• A watchdog checks the workflow engine and the server's control panel every 5 minutes and alerts us in Telegram.
• Every video passes automatic quality checks, including a check of its invisible marks, before anyone can approve it.
• An approval is tied to the SHA-256 hash of the exact file that was approved, so a changed file can't be posted on an old approval.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

• Daily backups of our server's databases to Cloudflare R2 in the EU, kept 30 days, and Supabase's daily backups, kept 7 days.
• Our workflows are kept in a private Git repository, without keys, so that they can be rebuilt.
• If Cloud Run fails, we can switch customer renders to our own server.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

• Automated database tests and workflow code tests run before every change.
• A live workflow is changed only through a copy that is first tested on our own test brand.
• A compliance review before any change to posting, consent, AI labels, vendors or AI models, and a security review before going live.

Measures for user identification and authorisation

• Web app sign-in with Google or with a 6-digit code emailed to the person. The admin login also needs an authenticator app as a second factor.
• Two-factor authentication on every vendor account.
• Only the client's listed approvers can approve: their Telegram ID or work email must be on the client's list. Approval groups use Telegram's "Restrict saving content", invite links need our approval, and only admins can add people.
• Row-level security on every database table, so that each client reaches only its own data. Every write from the web app goes through a server-side check and is logged.

Measures for the protection of data during transmission

• HTTPS with TLS everywhere. Downloads only through signed links valid 15 minutes, and render inputs and outputs through signed links valid 1 hour.
• Large uploads go straight to private storage by resumable signed uploads, never through chat apps or public file hosts.
• fal is always called with no storage (X-Fal-Store-IO: 0) and a 1-hour lifecycle for its files.

Measures for the protection of data during storage

• Private storage buckets. Files open only through short-lived signed links.
• EU storage by default (Annex II).
• Keys live only in the secret stores of n8n, Coolify and our cloud providers, never in code, Git, the database or logs. We store no social media tokens: Upload-Post holds them.

Measures for ensuring physical security of locations at which personal data are processed

• We run no data centre of our own. Our systems run in the data centres of Hetzner (Germany), Amazon Web Services for Supabase (Ireland), Cloudflare, and Google Cloud (Netherlands). Their physical security is described in their own security documents, which we send on request.

Measures for ensuring events logging

• An audit log records every change to videos, posts, consents, approvals and credits, with who made it. It is kept 3 years.
• Every approval records who approved, when and the file's hash. Every download records who downloaded it, through which channel and which file.
• Sign-in logs (IP address and device) are kept 7 days.

Measures for ensuring system configuration, including default configuration

• Every new database table gets row-level security, closed access rights and an audit trigger in the same change that creates it.
• No post, schedule or deletion on a real account without an approval record.
• The required platform AI label, C2PA and the watermark have no switch to turn them off.

Measures for internal IT and IT security governance and management

• Written rules for consent, approval, AI labels, secrets, vendors and retention, which every change must keep.
• No face or voice data goes to a vendor until we have saved its data processing terms.
• Access to production data is limited to the founder. Anyone added later gets only the access they need and commits to confidentiality.
• A written procedure for personal data breaches.

Measures for certification/assurance of processes and products

• We hold no certification of our own. Before using a vendor, we check its data processing terms and security documents and keep a copy.

Measures for ensuring data minimisation

• No ID documents and no face matching (except a Stripe Identity check of an account we flag, section 2.1): consent is checked from a spoken random phrase.
• The original clone recording is deleted 30 days after its clips are cut.
• A take's picture is never sent for moderation: only the words kept from it are checked.
• Style examples: we keep only notes on the format, never who appears.
• Comment→DM: we store only the number of replies.

Measures for ensuring data quality

• The client's approvers check every video and text before it is posted, and an approval fits only the exact file they saw.
• Presenters' and approvers' details come from the client or from the people themselves, and the client keeps its approver list up to date.

Measures for ensuring limited data retention

• Automatic deletion jobs apply the rules in Annex II, at the vendors too, for example by deleting a voice at ElevenLabs through its API. A legal hold pauses them. Only the founder can release a hold, and every release is logged.

Measures for ensuring accountability

• A record of processing, a data protection impact assessment for the clone flow, the breach procedure and copies of our vendors' data processing terms. Every change to data is logged, as described above.

Measures for allowing data portability and ensuring erasure

• The video library exports approved finals with their C2PA data. After the end, the client has 30 days to export; then we delete the data and confirm the deletion in writing (Annex II).

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller

• Each sub-processor is bound by data processing terms that cover security, notice of breaches to us, help with data subjects' requests, and deletion at the end. We use vendors that let us delete data through their API or settings, and fal stores nothing.

Description of the specific technical and organisational measures to be taken by the processor to be able to provide assistance to the controller

• Data subjects' requests (Clause 8). We forward any request about the client's data to the client's contact within 2 working days, and we don't answer it ourselves unless the client authorises us. The client authorises us in advance to act at once on a presenter's withdrawal of consent: we stop new videos, cancel pending posts, block downloads and exports, delete the clone within 30 days, confirm this to the presenter and tell the client the same day. We can find, export, correct and delete a person's data in the client's videos, clips, takes and approver list.
• Impact assessments (Clause 8(c)). We give the client the information it needs, including the relevant parts of our own data protection impact assessment for the clone flow and our vendors' data processing terms.
• Personal data breaches (Clause 9). We notify the client without undue delay and at the latest within 48 hours of becoming aware of a personal data breach affecting its data, by email to its contact in Annex I. The notice contains what Clause 9.2 lists, as far as we know it, and we add more as we learn it. We contain the breach, keep a record of it, and help the client notify the supervisory authority and the people affected. Contact point: info@clonifylab.com. For a breach of data we control ourselves (section 2), we notify the Andmekaitse Inspektsioon within 72 hours where Article 33 GDPR requires it.
• Accuracy (Clause 8(c)(3)). We tell the client without delay if we learn that data we process is wrong or out of date, for example that a listed approver has left.

ANNEX IV

List of sub-processors

The controller has authorised the use of the following sub-processors:

Each sub-processor's address and contact details are in its data processing terms. We send them, and a copy of the terms, on request (Clause 7.7(c)).

These are not our sub-processors:

• Telegram runs the approval groups and our bot as an independent controller, under its own terms. If you choose a Telegram approval group, you instruct us to send previews and messages there. If you don't want that, your approvers use the web app instead.
• Instagram, Facebook, YouTube and TikTok process your posts under their own terms once they receive them.
• Stripe (identity checks of accounts we flag, and card payments later) works for us only on data we control ourselves (section 2).