Data processing agreement

1. Roles

You are the controller of the personal data processed in your workspace, and we are your processor. We are a separate controller for account, billing, security and abuse prevention data, and for measuring use of the service. For public page and collection-link analytics, we process event and coarse technical data on your instructions to provide reports to your workspace.

2. Details of the processing

• Subject matter and duration: providing the service under the terms, for as long as your workspace exists and until deletion under section 11.
• Nature and purpose: collecting, storing, transcoding, transcribing, captioning, translating, editing, publishing and deleting testimonials, and sending email to participants, as you instruct through the service.
• Data subjects: participants who record or are invited to record, people visible or named in recordings, visitors to your hosted pages and collection links, and your members.
• Personal data: recordings with image and voice, names, roles, companies, email addresses, transcripts and derived media, consent records, and technical data such as hashed IP addresses and user agents used for consent and security. Public page analytics include the page, link or testimonial viewed, referrer host, country and broad device, browser and operating-system categories. These events do not use cookies or persistent visitor identifiers, and we do not retain visitor IP addresses or full user-agent strings for them.
• Special categories: you must establish an applicable Article 9 GDPR condition before collecting or instructing us to process any such data in a recording. The testimonial notice does not provide explicit consent for sensitive details.

3. Your instructions

We process personal data only on your documented instructions: the terms, this agreement and the settings and actions you use in the service. Where EU or member state law requires other processing, we tell you first unless that law forbids it. We tell you if we believe an instruction breaches data protection law.

4. Confidentiality

Only people who need access to provide the service process the data, and they are bound by confidentiality.

5. Security

We take the technical and organizational measures required by Article 32 GDPR, including:

• Encryption in transit and at rest.
• Private storage for original recordings, served only through short-lived signed links.
• Separation of each workspace's data and access limited to its members.
• Multi-factor authentication and least-privilege access to our provider accounts.
• IP addresses stored in consent records only as one-way hashes.
• Backups, logging, and defined deletion and withdrawal procedures.

6. Subprocessors

You authorize the subprocessors in our subprocessor list. We announce a new or replaced subprocessor at least 30 days in advance on that list and by email to your workspace owners. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection, you may end the affected service and we refund fees you prepaid for it.

We impose the same data protection obligations on each subprocessor by contract and remain responsible to you for its performance.

7. Transfers outside the EU

Where a subprocessor processes personal data outside the European Economic Area, the transfer relies on an adequacy decision, such as the EU-US Data Privacy Framework, or on the European Commission's standard contractual clauses with supplementary measures where needed.

8. Assistance

The service lets you access, export, correct and delete testimonials and handle withdrawals. We forward requests from data subjects about your workspace to you without undue delay and do not answer them ourselves unless you ask us to. We help you with security, breach notifications, data protection impact assessments and prior consultations, taking into account the nature of the processing.

9. Personal data breaches

We notify you without undue delay, and within 48 hours of becoming aware of a breach affecting your data, with the information required by Article 33(3) GDPR as it becomes available.

10. Retention

These defaults apply unless you delete data earlier:

11. End of the service

When your workspace closes, you choose whether we return or delete your personal data. Unless you instruct earlier deletion, export remains available during a wind-down period of up to 90 days. We delete the data and our remaining copies no later than 90 days after closure, except consent records kept under section 10 and data EU or member state law requires us to keep. Backups are overwritten within the period in section 10 and are not used for other purposes.

12. Audits

We give you the information needed to demonstrate compliance with Article 28 GDPR and allow and contribute to audits, including inspections, by you or an independent auditor you appoint. Routine audits take place with 30 days' notice, at your own cost and under confidentiality. We agree shorter notice where needed after a breach, on reasonable grounds to suspect non-compliance or at a supervisory authority's request. These arrangements do not restrict audits required by data protection law.

13. Your responsibilities

You are responsible for the lawfulness of the processing you instruct, including a lawful basis for each purpose and the information you give participants. Our testimonial notice is provided for your use; check that it fits how you use testimonials.

14. Liability, precedence and law

Liability follows the terms of service. If this agreement and the terms conflict on data protection, this agreement prevails; the standard contractual clauses prevail over both. The law of the Republic of Cyprus applies.

Contact for data protection: hello@jlnlabs.com.