Data Processing Agreement (Controller ↔ Processor)

A. Subject Matter; Duration; Nature; Purpose

• Subject matter: hosting/storage/streaming of candidate videos and related metadata.
• Duration: term of the Agreement + deletion intervals.
• Nature/Purpose: provide/support Services; security; limited aggregate/de-identified analytics.
• Data types: names, emails, IPs, device/browser, video/audio (may reveal biometric identifiers), timestamps, view/share logs.
• Data subjects: candidates; Customer personnel.

B. Processor Obligations

Process only on documented instructions; implement appropriate security measures (Annex II); ensure confidentiality; assist with DSRs, DPIAs, consultations; breach notice without undue delay; delete/return data at end of services (subject to backups); maintain records; permit audits (one per 12 months, 30 days' notice, reasonable scope/NDAs; independent third-party reports may satisfy).

C. Sub-processors

General authorisation. Current list: Convex (US), Vercel (global; primary US), Resend (US). Objections on reasonable data-protection grounds; the parties will work in good faith to resolve.

D. International Transfers

For UK/EEA personal data to non-adequate countries, incorporate: EU SCCs (2021/914) – Module 2 (C→P) and the UK Addendum, plus supplementary measures (encryption, access controls, strict retention).

E. Retention & Deletion

Videos → 30 days; metadata → 90 days unless instructed otherwise or required by law. Backups purge on rolling schedule.

F. Liability

Subject to the Agreement's liability cap unless prohibited by law. The parties may adjust allocation for biometric-law risk (e.g., BIPA) in relevant orders.

Annex I – Processing Summary

As above. Controller: Customer. Processor: STARK PROJECTS LTD (t/a "Vidintro"). Contact: info@vidintro.io.

Annex II – Security Measures (summary)

TLS in transit; encryption at rest; RBAC/least-privilege/MFA; secure SDLC; dependency scanning; secrets management; logging/monitoring; anomaly detection; rate-limiting; backups & tested restores; incident response; vendor due diligence; staff training/background checks (as appropriate).

Annex III – Sub-processors

Convex; Vercel; Resend (updated list maintained online or via notice).