Data Processing Agreement (DPA) — Vixdeo

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Synaxis Systems LLC (https://synaxis.systems/), operator of the Vixdeo service ("Synaxis," the "Processor"), and the customer accepting the Terms (the "Customer," the "Controller"). Vixdeo is a service of Synaxis Systems LLC.

This DPA applies where the Customer, in its use of the Platform, processes personal data of third parties for which the Customer is the data controller (for example: images, voice, or footage of people in its organization or of its own customers, uploaded to produce pieces). For the Customer's own account data, Synaxis acts as controller under the Privacy Policy.

This DPA is incorporated by reference into the Terms and applies without a signature. A Customer that needs a signed copy may request one at legal@vixdeo.com.

1. Definitions

The terms "personal data," "processing," "controller," "processor," "data subject," "personal data breach," and "supervisory authority" have the meanings given in Regulation (EU) 2016/679 ("GDPR"). "Data Protection Law" means all law applicable to processing under this DPA, including GDPR, UK GDPR, and equivalent rules.

2. Subject matter, duration, and roles

2.1. Synaxis will process the Customer Data described in Annex A solely as a processor, on the Customer's behalf, for the duration of the Terms.

2.2. The Customer is the controller and warrants that it has a legal basis and the necessary consents and authorizations for the data it enters into the Platform — in particular, for the image and voice of real people intended to create digital replicas (Terms, §6).

2.3. Each party will comply with the Data Protection Law applicable to it.

3. Documented instructions

3.1. Synaxis will process Customer Data only on the Customer's documented instructions, consisting of: (a) the Terms and this DPA; (b) the Customer's use and configuration of the Platform (each operation the Customer executes is an instruction, including those performed by an AI agent with a credential issued by the Customer); and (c) other reasonable written instructions as agreed.

3.2. Synaxis will inform the Customer if, in its opinion, an instruction infringes Data Protection Law, without this implying any obligation to provide legal advice.

3.3. Synaxis will not process Customer Data for its own purposes. In particular, it will not use it to train its own AI models without the Customer's express consent. Under their standard terms, ElevenLabs, HeyGen and Stability AI may use the data they receive to improve their models except on their enterprise plans or if that option is turned off; for as long as they last, these are exceptions to this §3.3, and they are described in §5.3 of the Terms.

4. Confidentiality

Synaxis ensures that its personnel and its subprocessors are bound, by contract or by law, to keep Customer Data confidential, and that access to that data is limited to the persons who need it to provide the service.

5. Security

Synaxis will implement and maintain the technical and organizational measures in Annex B, appropriate to the risk pursuant to GDPR Art. 32. Synaxis may update those measures provided they do not materially reduce the level of protection.

6. Subprocessors

6.1. General authorization. The Customer grants general authorization for the use of the subprocessors by category and named list in Annex C.

6.2. Changes. Synaxis will notify the Customer by email of intended changes (addition or replacement of subprocessors) at least 30 days in advance, and the Annex C page reflects them when they take effect.

6.3. Right to object. The Customer may object on reasonable, documented data-protection grounds within the notice period. If no reasonable solution is found, the Customer may terminate the affected part of the service, and Synaxis will refund the paid balance the Customer has not consumed, as when closing the account (Terms §11).

6.4. Back-to-back contracts. Synaxis will impose on each subprocessor data-protection obligations substantially equivalent to those in this DPA and will remain liable to the Customer for the subprocessor's performance.

7. Assistance to the Controller

7.1. Data subject rights. Taking into account the nature of the processing, Synaxis will assist the Customer with appropriate technical and organizational measures to respond to data subject requests (access, rectification, erasure, portability, objection, restriction). If a data subject contacts Synaxis directly, Synaxis will redirect them to the Customer without responding on the merits, except where legally required.

7.2. DPIAs and prior consultation. Synaxis will reasonably assist the Customer with data protection impact assessments (Art. 35) and prior consultations (Art. 36), insofar as the information is available to Synaxis.

8. Personal data breach notification

Synaxis will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and in any event within 48 hours. The notification will include, to the extent available: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Synaxis will document breaches and reasonably cooperate with the Customer in its obligations under GDPR Arts. 33 and 34. Notification is not an acknowledgment of fault or liability.

9. Deletion and return

Upon termination of the service, Synaxis will, at the Customer's choice, delete or return Customer Data and delete existing copies, unless retention is required by law. When the Customer closes its account, it may request a copy of its data within the 14-day grace period that follows the closure; at the end of that period, Synaxis deletes Customer Data as described in Privacy Policy §7: the content and its copies are deleted, including at the avatar and payment subprocessors, and the accounting and acceptance records required by law are kept, unlinked from the Customer's identity. Database backups renew within 30 days. What falls outside that deletion, and its periods, are set out in Privacy Policy §6 and §7.

10. Audits

Synaxis will make available to the Customer the information necessary to demonstrate compliance with this DPA and will allow audits, including inspections, by the Customer or a mandated auditor, subject to reasonable conditions: at least 30 days' written notice, at most once per year except after a breach or upon a supervisory authority's demand, during business hours, without access to other customers' data, under confidentiality, and at the Customer's expense. In the first instance, audits will be satisfied through available documentation and reports.

11. International transfers

Synaxis and its subprocessors may process data outside the EEA/UK (see Annex C). For those transfers, the parties rely on adequacy decisions where available (including the EU-U.S. Data Privacy Framework for certified entities) and otherwise on the European Commission's Standard Contractual Clauses (SCCs, Decision 2021/914), which are deemed incorporated by reference into this DPA: Module 2 (controller to processor) where the Customer acts as controller, and Module 3 (processor to processor) where it acts as a processor on behalf of third parties. Their annexes are populated with Annexes A, B and C of this DPA; for the purposes of their Clause 9(a) the general authorization of §6 applies, with the notice period of §6.2; and for the purposes of their Clauses 13, 17 and 18 Ireland is chosen: the competent supervisory authority is Ireland's Data Protection Commission, the SCCs are governed by Irish law, and disputes arising from them are submitted to the courts of Ireland. For transfers subject to the UK GDPR, the Information Commissioner's International Data Transfer Addendum (UK Addendum) also applies. For those subject to the Swiss Federal Act on Data Protection, the SCCs apply with the adaptations that act requires: the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), references to the GDPR are understood as references to the Swiss act, and data subjects residing in Switzerland may exercise their rights before the courts of their place of residence.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations of liability in the Terms, except to the extent Data Protection Law does not permit limitation. In case of conflict: (1) the SCCs, (2) this DPA, (3) the Terms.

13. Governing law

This DPA is governed by the same law as the Terms: the laws of the State of Florida (USA), without prejudice to mandatory provisions of Data Protection Law and the law governing the SCCs.

Annex A — Details of processing

• Subject matter and nature: hosting, processing, and transformation of content provided by the Customer to produce AI-assisted video pieces (script, direction, voices, avatars, music, rendering), their storage, delivery, and — where instructed by the Customer — publication to external destinations or exhibition in the gallery.
• Duration: the term of the Terms, plus the deletion periods in §9.
• Purpose: provision of the Service under the Terms.
• Categories of data subjects: persons whose images, voice, footage, or data appear in the material the Customer uploads or in the instructions it enters (e.g., employees, collaborators, the Customer's own customers, persons who consent to the creation of their digital replica).
• Categories of data: images and video of persons; voice recordings and replicas; names and contact details contained in scripts or instructions; any other personal data the Customer chooses to include in its material.
• Special categories: only biometric data, where the Customer creates digital replicas of real people (avatars, voices), with the explicit consent of the person depicted, which the Customer obtains and declares in the creation flow.
• Processing operations: collection, storage, transformation via proprietary and subprocessor AI models, transmission to the subprocessors in Annex C, delivery to the Customer, delivery to the AI agent or host that the Customer connects, at the Customer's request, publication on the Customer's instruction, deletion.

Annex B — Technical and organizational measures

Measures verified against the service's infrastructure as of the date of this version:

• Encryption in transit (TLS) on the service's public surfaces, with HSTS, and toward object storage.
• Encryption at rest of the database (Neon, by Databricks) and of object storage (Cloudflare R2), according to each provider's documentation. The Google and YouTube access tokens that Vixdeo keeps to publish on the user's behalf are also stored encrypted in the database.
• Authentication and credentials: federated authentication with Google; the API keys and tokens Vixdeo issues to agents are stored only as hashes, and passwords with bcrypt; credential revocation when an account is closed.
• Anti-abuse limits: rate limits per IP and per key.
• Recovery: database history to restore to any point in the last 24 hours.
• Monitoring: operational alerts on backups and providers.
• Data lifecycle: deletion of content when an account is closed, including at the avatar and payment subprocessors, and retention of accounting and acceptance records unlinked from the identity (Privacy Policy §7); removal of public copies upon unpublishing.

Annex C — Authorized subprocessors

Providers that receive data to produce, charge, store or publish the piece. The current named list, with what each provider receives, is published at vixdeo.com/legal/subprocessors and forms part of this Annex. It is derived from the Platform's provider registry, so it reflects what is connected at any given time. It covers language and vision models (OpenAI, Anthropic and Google), voice (ElevenLabs), avatars (HeyGen, which includes its own subject-consent flow), image, video and music generation depending on the piece (among others, fal, Leonardo and Stability AI), payments (Stripe, which also acts as an independent controller for its regulatory purposes), publishing to YouTube (Google) and object storage (Cloudflare R2).

Infrastructure (not listed on that page):

Content libraries (stock and archive) — Pexels, Pixabay, Unsplash, Coverr, Freesound, Wikimedia Commons, Internet Archive, Europeana, and equivalent public archives, and the proxy through which they are queried, receive only search queries derived from the piece; they do not process the Customer's personal data on Synaxis's behalf and are therefore not considered subprocessors.

AI agent hosts. The AI agent hosts that the Customer connects to Vixdeo (for example, Claude, ChatGPT or Cursor) are not subprocessors of Synaxis: the Customer chooses and contracts them, and disclosing data to them is an instruction of the Customer. That the same provider appears in this Annex as a generative AI provider does not change that characterization.

This document is also available in Spanish (Acuerdo de Tratamiento de Datos). In case of divergence, the English version prevails.