Data processing addendum
1. Parties, scope and effect
This Data Processing Addendum ("DPA") is entered into between the business customer using vambel ("Customer", controller) and Qraft Holding B.V., Beeldhouwersdijk 43, 3541 AP Utrecht, Nederland, Chamber of Commerce (KvK) 54873576 ("we", processor). It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).
This DPA forms part of the Terms of Service for business customers and takes effect when the Customer accepts the Terms. If this DPA and the Terms conflict on data protection, this DPA prevails.
2. Details of the processing
| Subject matter | Providing vambel: storing, editing, generating and rendering the Customer's video projects. |
|---|---|
| Duration | For the term of the Customer's account, and afterwards until deletion as set out in section 11. |
| Nature | Hosting, storage, transcription on our own server, transmission to sub-processors and to providers the Customer instructs, rendering, backup and deletion. |
| Purpose | Only to provide vambel to the Customer under the Terms and the Customer's documented instructions. |
| Categories of personal data | Names and contact details of workspace users; content containing personal data such as scripts, uploads, voice recordings, photos and videos of people, consent records for real people; usage records; security logs (IP address, user agent, timestamps). |
| Special categories | Not intended. Photos and voices of people are processed to produce videos, not to identify anyone. If the Customer's content contains special categories of data, the Customer is responsible for having a valid legal basis. |
| Data subjects | The Customer's workspace users; presenters, actors and other people who appear in or are named in the Customer's content; viewers who contact the Customer. |
3. Customer's instructions
We process personal data only on the Customer's documented instructions, which are given by these Terms, this DPA and the Customer's use of vambel's features. If we believe an instruction infringes data protection law, we tell the Customer without delay. If the law requires us to process data otherwise, we tell the Customer first unless the law prohibits that.
The Customer is responsible for the lawfulness of the processing it instructs, including having the documented consent of real people whose face or voice is used, and for informing its data subjects.
4. Confidentiality
Everyone we authorise to process the Customer's personal data is bound by confidentiality, by contract or by law, and only has access where needed for their task.
5. Security measures
We implement appropriate technical and organisational measures under Article 32 GDPR, including:
- encryption at rest of the Customer's AI provider API keys (XChaCha20-Poly1305); keys are never logged;
- passwords stored only as argon2id hashes;
- TLS encryption of all traffic, terminated on our own server in the Netherlands;
- row-level tenant isolation in the database, so one workspace cannot read another's data;
- access control by roles, both in the application and for our own staff;
- security logging (kept 30 days) and throttling of failed sign-in attempts;
- regular backups, rotated within 30 days;
- speech transcription on our own server, without sending audio to third parties.
We may update these measures as long as the overall level of protection does not decrease.
6. Sub-processors
The Customer gives general authorisation for us to use these sub-processors:
| Sub-processor | Service | Location and transfer safeguard |
|---|---|---|
| Tailscale Inc. | Network relay for HTTPS traffic; TLS ends on our own server, so it does not see content | United States; Standard Contractual Clauses (Tailscale's data processing addendum) |
| [e-mail provider] | E-mail delivery | [to be confirmed] |
Hosting is on our own server in the Netherlands. Stripe processes billing data for which we are the controller; it does not process the Customer's workspace content.
We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for them. We give at least 30 days' notice by e-mail before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may end the subscription before the change takes effect, without penalty.
7. Providers connected with the Customer's own keys (BYOK)
ElevenLabs, OpenAI, xAI, BytePlus, OpenRouter, Anthropic and any other provider the Customer connects with its own API key are not our sub-processors. The Customer has its own contract with each of them. When the Customer instructs vambel to use such a provider, we transmit the content on the Customer's instruction, and that provider's processing falls under the Customer's own agreement with it. The Customer is responsible for having appropriate terms, including any data processing agreement and transfer safeguards, with those providers.
8. International transfers
We host and process the Customer's data in the EU. Where a transfer to a country without an adequacy decision takes place through a sub-processor, it is covered by the EU-US Data Privacy Framework where the recipient is certified, or otherwise by the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), module 3 (processor to processor). Where the Customer is established outside the EEA and we return data to it, module 4 (processor to controller) applies where required. The SCCs are incorporated by reference where applicable and prevail over this DPA in case of conflict.
9. Assistance
Taking into account the nature of the processing, we help the Customer:
- respond to data subject requests (access, rectification, erasure, restriction, portability, objection), including through self-service export and deletion; we forward any request we receive directly to the Customer;
- meet its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).
10. Personal data breaches
We notify the Customer of a personal data breach affecting the Customer's data without undue delay and at most 48 hours after becoming aware of it. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. We add information as it becomes available and take reasonable steps to contain the breach.
11. Deletion and return
The Customer can export its content at any time. When the account ends, we delete the content of workspaces the Customer solely owns within 30 days, and backups rotate out within 30 more days, unless EU or Member State law requires us to keep data (for example invoices for 7 years). On request before deletion, we help the Customer return its data in a common format.
12. Audits
We make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR. The Customer may audit our compliance, itself or through an independent auditor bound by confidentiality, once per year with at least 30 days' notice, or sooner after a personal data breach or at the request of a supervisory authority. Audits are carried out during business hours, without disrupting the service and without access to other customers' data. Each party bears its own costs.
13. Liability and term
The liability provisions of the Terms apply to this DPA, except where the GDPR does not allow limitation. This DPA lasts as long as we process personal data for the Customer.