For businesses that use GambitClip.

1. Parties and roles

This Data Processing Agreement ("DPA") is between the customer accepting our Terms of Service on behalf of an organisation ("Customer", "you") and [COMPANY LEGAL NAME], [STREET ADDRESS, POSTCODE, CITY], Sweden ("GambitClip", "we"). For personal data in the footage and account data you give us, you are the controller and we are the processor under the EU and UK GDPR. Where United States state privacy laws apply, you are the business and we are your service provider or contractor. Nothing in this DPA makes us joint controllers. We process technical and usage data about the operation of the service as an independent controller, as described in our Privacy Policy.

2. Subject matter and instructions

We process personal data only to provide the service described in Annex 1 and on your documented instructions. Using the service is an instruction: uploading footage, starting a run, deleting a run, connecting a publishing platform. We will tell you promptly if we believe an instruction breaks data protection law, and we may pause it until the question is resolved. This DPA lasts as long as you use the service and for as long as we hold your data afterwards.

3. Your obligations

You are responsible for having a lawful basis and any required notices or consents for the footage and data you process through GambitClip, including for the people who appear or speak in it, and for giving us only instructions that comply with the law. Do not upload special categories of data (health, biometrics used for identification, and the like) as the subject of a run; the service is not designed for it.

4. Our obligations

• Confidentiality. Only people who need access to operate the service have it, and each is bound by confidentiality.
• Security. We maintain the technical and organisational measures in Annex 2 and keep them appropriate to the risk.
• Data subject requests. If someone in your footage or on your team contacts us directly about their data, we forward the request to you without undue delay and help you answer it with the tools in the service; self-serve export and deletion are built in.
• Assistance. We give you the information you reasonably need for your own records, impact assessments and consultations with authorities, to the extent it concerns our processing.
• Breach notification. We tell you without undue delay, and in any case within 72 hours of confirming it, about any breach of security that leads to the accidental or unlawful destruction, loss, alteration, disclosure of or access to your personal data, with what we know about its nature, likely consequences and the measures taken, and we keep you updated as we learn more.
• Records and audits. We keep records of our processing. Once a year, on 30 days' written notice, you or an independent auditor bound by confidentiality may verify our compliance with this DPA, first through written answers and documents, and by an on-site or remote audit only where those are not sufficient, at your cost and without disrupting the service.

5. Subprocessors

You authorise the subprocessors on our public list, each bound by a written contract with data protection obligations equivalent to this DPA. We remain responsible for their performance. We add or replace a subprocessor by updating the list and its date at least ten business days before the new subprocessor handles your data; if you have a reasonable, data-protection-related objection, tell us within those ten business days and we will work with you to resolve it. If we cannot, you may end your subscription and we refund any prepaid fees for the remaining period.

6. International transfers

We are established in Sweden. Where personal data from the EU, the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the transfer rests on the EU Standard Contractual Clauses (Commission Decision 2021/914; Module Two where you are a controller, Module Three where you are a processor), which are incorporated into this DPA with you as data exporter and us as data importer, together with the UK International Data Transfer Addendum and the Swiss addendum where those apply, or on the EU-U.S. Data Privacy Framework where a subprocessor is certified. Annex 1 provides the information the Clauses require. If a transfer mechanism is invalidated we will cooperate in good faith to put a lawful alternative in place.

7. Government requests and service data

If an authority asks us for your personal data, we redirect it to you where we can, tell you before we disclose anything unless the law forbids it, disclose only what the request lawfully covers, and challenge requests we believe are unlawful or overbroad. We have not received such a request as of the date of this DPA.

Technical and usage data about the operation of the service (timings, error reports, usage counts) is processed by us as an independent controller for security, billing and improvement. It never includes footage or personal data from footage, and where we aggregate or de-identify it, the result cannot identify you or anyone in your data.

8. Customers in the United States

Where state privacy laws such as the California Consumer Privacy Act apply to our processing for you, we act as your service provider or contractor. We process personal information only for the business purposes in Annex 1; we do not sell it, share it for cross-context behavioural advertising, retain, use or disclose it for any other purpose, or combine it with personal information from other sources except as those laws permit. We will tell you if we can no longer meet these obligations, and you may take reasonable steps to stop and remedy unauthorised use. We certify that we understand these restrictions.

9. Return and deletion

You can delete any run, and your whole account, from inside the service at any time. When you do, or when this DPA ends, we delete the personal data on the schedule in our Privacy Policy: source footage, the transcript and the cut list are deleted 7 days after a run finishes; audio and analysis notes are discarded with the run; finished clips 30 days after the run or on deletion, whichever comes first; the run's record and the account on deletion; backups roll off within 30 days. On request before deletion, we make your data available for download in a common format through the export function. We keep only what the law requires us to keep, such as bookkeeping records, and only for as long as it requires.

10. Liability, law and precedence

Liability under this DPA is governed by the limitation of liability in our Terms of Service, applied to this DPA and the Terms together. Neither party is liable to the other for administrative fines imposed on the other by a supervisory authority. This DPA is governed by the same law as the Terms of Service. If this DPA and the Terms conflict on data protection, this DPA wins; if the Standard Contractual Clauses and this DPA conflict, the Clauses win.

Annex 1. Description of the processing

• Subject matter and purpose: turning the customer's long-form video into short clips: storing the footage, extracting audio, transcribing speech, analysing frames and audio with AI models, selecting and cutting moments, rendering clips with captions, scoring them, and, if the customer chooses, uploading clips to a platform the customer connects.
• Nature of the processing: storage, transmission to subprocessors, automated analysis, transformation, deletion.
• Duration: the term of the customer's use of the service, plus the retention periods in the Privacy Policy.
• Categories of data subjects: the customer's team members who use the service; people who appear, speak or are named in the footage (the customer's streamers, guests, players, chat participants).
• Categories of personal data: account data (name, email, sign-in identifiers); video and audio recordings, including faces, voices and likenesses; transcripts; names and handles that appear on screen or in speech; usage and billing records. Special categories are not intended to be processed; where footage incidentally contains them, they are processed only as part of the footage.
• Frequency: continuous, as the customer uses the service.
• Subprocessors and locations: as listed on the subprocessor page.
• Competent supervisory authority (for the Standard Contractual Clauses): the Swedish Authority for Privacy Protection (IMY), unless the Clauses require otherwise for the exporter.

Annex 2. Technical and organisational measures

• Encryption of data in transit (TLS) between users, our service and every subprocessor; encryption at rest with our storage and database providers.
• Isolated processing: each run executes in its own job with its own working files, which are deleted with the run.
• Access control: production access limited to the people who operate the service, protected by multi-factor authentication, with secrets held in the hosting providers' secret stores rather than in code.
• Automatic deletion: audio and analysis notes live only inside the processing job and are discarded with it; source footage, the transcript and the cut list are deleted 7 days after a run finishes or fails; finished clips 30 days after the run. Both are enforced by a scheduled job, with a storage lifecycle rule as a backstop.
• Logging and monitoring: error monitoring carries account identifiers only, never footage; logs are kept for 90 days.
• AI providers used on terms that prohibit training on customer content, with routing configured to refuse providers that retain or train on inputs.
• Vendor management: subprocessors under written data processing agreements, listed publicly, reviewed before any addition.
• Incident response: a documented procedure for containing an incident, notifying customers and authorities within the legal deadlines, and recording the outcome.
• Backups: encrypted, with deleted data rolling off within 30 days.

Contact

hello@gambitclip.com