Data Processing Addendum (DPA)

Between CLIPr Co. ("Processor") and the Enterprise Customer ("Controller")
Effective Date: As of the effective date of the governing Master Services Agreement (MSA) between the parties.

1. Definitions

"Applicable Data Protection Laws" means all applicable laws relating to data processing, including the GDPR, UK DPA 2018, CCPA/CPRA, and any other applicable US state privacy laws.
"Controller" means the entity that determines the purposes and means of Processing (i.e., the Customer).
"Customer Data" means any Personal Data submitted to or collected by the CLIPr platform in delivering the Services, including video recordings, audio files, transcripts, AI-generated recaps, clips, reports, and metadata.
"Data Subject" means an identified or identifiable natural person whose Personal Data is Processed.
"Personal Data" has the meaning given under Applicable Data Protection Laws.
"Processing" means any operation performed on Personal Data, whether by automated means.
"Processor" means CLIPr, which Processes Personal Data on behalf of the Controller.
"Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data.
"Services" means the AI-powered video analysis, transcription, and interview room services provided by CLIPr under the MSA.
"Sub-processor" means any third party engaged by CLIPr to Process Customer Data on behalf of the Customer.
"Standard Contractual Clauses (SCCs)" means the standard contractual clauses approved by the European Commission (Decision 2021/914) or UK International Data Transfer Addendum.

2. Scope and Purpose of Processing

2.1 This DPA applies to all Processing of Customer Data by CLIPr in connection with the Services provided under the governing MSA.
2.2 CLIPr shall Process Customer Data solely for the purpose of providing the Services. CLIPr shall not Process Customer Data for any other purpose, including:
  • Marketing or promotional activities
  • Product advertising
  • Profiling of Data Subjects for purposes unrelated to the Services
  • Sale or licensing to third parties
  • Training AI models on Customer Data without explicit written authorization
2.3 The subject matter, duration, nature, and purpose of Processing, the types of Personal Data, and the categories of Data Subjects are described in Annex 1.

3. Obligations of the Processor

2.1 This DPA applies to all Processing of Customer Data by CLIPr in connection with the Services provided under the governing MSA.

3.1 Instructions

CLIPr shall Process Customer Data only on documented instructions from the Customer, unless required by applicable law. CLIPr shall immediately inform the Customer if an instruction infringes Applicable Data Protection Laws.

3.2 Confidentiality

CLIPr shall ensure that all persons authorized to Process Customer Data have committed to confidentiality obligations or are under an appropriate statutory obligation.

3.3 Security

CLIPr shall implement and maintain appropriate technical and organizational measures as described in Annex 2, including:
  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Role-based access controls with principle of least privilege
  • Multi-factor authentication for administrative access
  • Regular vulnerability scanning and penetration testing
  • Continuous security monitoring and intrusion detection
  • Employee background checks and security awareness training

3.4 Sub-processing

(a) The Customer provides general authorization for CLIPr to engage Sub-processors.
(b) CLIPr shall maintain an up-to-date list of Sub-processors, available upon request.
(c) CLIPr shall notify the Customer in writing at least 30 days prior to engaging any new Sub-processor.
(d) The Customer may reasonably object within 14 days. If unresolved, either party may terminate the affected Services without penalty.
(e) CLIPr shall impose equivalent data protection obligations on each Sub-processor and remains fully liable for their performance.

3.5 Data Subject Rights Assistance

CLIPr shall assist the Customer by appropriate measures to fulfill obligations to respond to Data Subject rights requests (access, rectification, erasure, restriction, portability, objection).

3.6 Deletion and Return

Upon termination of the MSA, CLIPr shall, at the Customer's election:
(a) Return all Customer Data in a commonly used format; or
(b) Delete all Customer Data within 30 days, unless retention is required by law.
CLIPr shall provide written certification of deletion upon request.

3.7 Audit Rights

(a) CLIPr shall make available all information necessary to demonstrate compliance.
(b) CLIPr shall allow audits conducted by the Customer or a qualified third-party auditor, subject to 30 days advance notice, during normal business hours, no more than once per 12-month period.
(c) CLIPr may satisfy audit requests by providing SOC 2 reports, certifications, or third-party assessment results.

4. Security Incident Notification

4.1 CLIPr shall notify the Customer of any Security Incident without undue delay and within 72 hours of becoming aware.
4.2 Notification shall include: nature of the incident, contact details, likely consequences, and mitigation measures.
4.3 CLIPr shall cooperate in investigation, mitigation, and remediation.
4.4 Notification shall not be construed as acknowledgement of fault or liability.

5. International Data Transfers

5.1 CLIPr shall not transfer Customer Data outside the EEA/UK unless:
(a) The destination has adequate protection (adequacy decision); or
(b) Appropriate safeguards are implemented (EU SCCs Module Two, UK IDTA); or
(c) A derogation under Article 49 GDPR applies.
5.2 Where SCCs apply, Module Two (Controller to Processor) applies with general authorization and 30-day notice for sub-processors.
5.3 CLIPr offers data residency in EU/Ireland (AWS eu-west-1) for customers requiring European data processing.

6. Obligations of the Controller

The Customer warrants that it has obtained all necessary consents/lawful bases, that its instructions comply with Applicable Data Protection Laws, and that it has conducted any required data protection impact assessments.

7. Term and Termination

This DPA is effective from the MSA effective date and remains in force for as long as CLIPr Processes Customer Data. Upon termination, Section 3.6 (Deletion and Return) applies.

8. Liability

Each party's liability is subject to the limitations in the MSA. Nothing limits liability for breaches of Applicable Data Protection Laws where limitation would not be permitted.

9. General

9.1 Precedence: DPA prevails over MSA for data processing matters. SCCs prevail over DPA if conflicting.
9.2 Amendments: Only in writing signed by both parties.
9.3 Governing Law: As per the MSA, unless otherwise required by Applicable Data Protection Laws.
Element
Description
Subject Matter
Processing of Customer Data in connection with CLIPr AI-powered video analysis, transcription, and interview room services
Duration
Term of the MSA plus any post-termination retention period
Nature of Processing
Collection, storage, AI/ML analysis, transcription, summarization, retrieval, and deletion of audio/video content
Purpose
Provide contracted Services: transcription, AI-generated recaps, clips, summaries, search indexing
Types of Personal Data
Names, voices, images (video), spoken words, user account data (email, name)
Data Subject Categories
Customer employees, contractors, clients, and individuals in recordings; authorized platform users

ANNEX 2: Technical and Organizational Measures

Infrastructure & Hosting

  • Amazon Web Services (AWS) — SOC 2 Type 1 certified
  • Data residency: US (us-east-1) and EU/Ireland (eu-west-1)
  • Network segmentation, DDoS protection, and WAF

Encryption

  • In transit: TLS 1.2+ for all communications
  • At rest: AES-256 via AWS Key Management Service (KMS)

Access Controls

  • Role-based access control (RBAC) with least privilege
  • MFA required for administrative access
  • Quarterly access reviews; automated deprovisioning

Monitoring & Logging

  • Centralized audit logging with 12-month retention
  • Intrusion detection systems (IDS)

Vulnerability Management

  • Monthly vulnerability scanning; annual penetration testing
  • Secure SDLC practices

Personnel Security

  • Background checks; confidentiality agreements
  • Annual security awareness training

Business Continuity

  • Automated backups with geographic redundancy
  • RPO: 24 hours; RTO: 4 hours
  • Annual DR testing

Incident Response

  • Documented plan; designated response team
  • Customer notification within 72 hours

ANNEX 3: List of Sub-Processors

Sub-Processor
Location
Purpose
Amazon Web Services (AWS)
US / EU (Ireland)
Cloud infrastructure, compute, and storage
The current sub-processor list is maintained and available upon request from legal@clipr.ai.