Data processing agreement.
1 · Who processes for whom
Your business is the controller of the personal data this agreement covers. Digital Delivery GmbH, Rigiweg 21A, 6343 Holzhäusern ZG, Switzerland, processes it on your behalf. Its registered seat is Risch, canton of Zug, and its company number (UID) is CHE-178.105.720. In this agreement, "we" means Digital Delivery GmbH, which offers YachtMotion. We process the data only on your instructions. Using YachtMotion to make your films is such an instruction.
2 · Whose data, and which
- People in the photographs and clips you supply. Their image, and whether a person is visible.
We record presence only, never who a person is.
- People you ask to review a film through a private link. The name and the address you type for them.
Also their notes, replies, done marks and decision on each version.
- Buyers who send an inquiry through a film's public page, if that page offers an inquiry form.
Their name, an address to answer them at, and an optional phone number. Also their message, the notice version they saw, and when it arrived. Today no film's public page on PROD offers that form, so this group is empty.
3 · What for
We process this data only to make, deliver and show your films. That means reading what a photograph shows, cutting moving scenes from it, and assembling the film. It also means sending review links and their mail, and passing inquiries on to you. We do not use it to train or improve any model. Our page "Your media and model training" says so in full.
4 · Who else processes it
The companies on our subprocessors list process it for us. Each gets only what its step needs. The list says what each one receives, when, and where it processes, and the basis for any transfer outside the European Union and Switzerland.
5 · Where it is held
We hold your data in the European Union, in Microsoft Azure, in Spain (Spain Central). Some companies on the subprocessors list process it outside the European Union and Switzerland. The list names them. For each company that receives data outside the European Union and Switzerland, the transfer goes under that company's own data-processing terms, which contain the EU standard contractual clauses. Google may instead use a transfer solution it has adopted, and tells us which. The list gives the section of each.
6 · How long
Photographs and films are kept until the film is deleted or the account that holds it ends. An inquiry expires 12 months after it arrives. Scheduled cleanup then empties it. Its details can remain until a successful cleanup pass. A copy in a database backup goes with the backup's own period. Our privacy policy, section 6, sets out every period.
7 · A new subprocessor
Before a new company receives any of your data, we add it to the subprocessors list. At least 30 days before that company receives any of it, we email your business's people. Your business may object in writing within 14 days of that email. If the objection is not resolved by good-faith talks within 14 days after the objection, your business may end the account under clause 8. It then owes nothing for the period after the end.
8 · When the contract ends
When your business asks us in writing to end it, we end your business's account. That destroys the stored files of its films, and every live link naming your business stops. Our records keep a reference to your written instruction, and who carried it out.
9 · What else we undertake
We protect your data with the security controls of Microsoft Azure in Spain Central, and with our own access control. The secrets that open the stored data are kept in a key vault with role-based access, not in our code. The staff who handle your data are bound to confidentiality. When a person asks us about their data, we pass the request to your business within 5 working days, and help your business answer it. We notify your business of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it. Once a year, on 30 days' written notice, your business may audit our compliance with this agreement, at its own cost. Instead of an audit, we may share the third-party audit reports of our providers.