Data Processing Addendum

01What this addendum is

This Data Processing Addendum is part of the Terms & Conditions between DAAB INC ("Daab", "we") and the customer ("you"). It applies automatically to every customer, on every plan. Nobody needs to sign it. If you need a signed copy for your records, write to us.

It covers personal information contained in the content that you and the people you invite put into Daab ("customer personal data"). Words used here have the meaning given to them in the data protection law that applies to you, including the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection and United States state privacy laws.

If this addendum and the Terms conflict about customer personal data, this addendum applies.

02Roles

For customer personal data, you are the controller (or a processor acting for your own client) and Daab is your processor. Under United States state privacy laws, you are the business and Daab is your service provider.

You are responsible for having the right to put customer personal data into Daab, including any notice to or permission from the people it is about.

Daab is a controller in its own right for account, billing, usage and website information, as described in the Privacy Policy. This addendum does not cover that information.

Daab does not use customer personal data to train AI models.

03What we process

• Subject matter and purpose: providing the Daab video review service to you: storing, encoding and playing video, collecting comments, running AI review, sending notifications, and support.
• Duration: for as long as you use Daab, and then until deletion as set out in section 10.
• Kinds of personal data: whatever your content contains. Typically images and voices of people who appear in video, names and other details mentioned in video, comments, brand documents and attachments, and the names and email addresses of guest reviewers.
• People it is about: people who appear in or are mentioned in your content, your staff, your clients and their staff, and guest reviewers.
• Sensitive data: Daab is not designed for special categories of personal data. Do not upload content whose purpose is to hold such data.

04Our obligations

We will:

• process customer personal data only on your documented instructions. Your instructions are the Terms, this addendum and the way you and your users use the features of the service. We will tell you if we believe an instruction breaks data protection law;
• not sell customer personal data, not share it for cross-context behavioural advertising, and not keep, use or disclose it for any purpose other than providing the service to you, except as the law requires;
• not combine customer personal data with personal data we receive from other sources, except where the law allows a service provider to do so;
• make sure that everyone we authorise to handle customer personal data is bound to keep it confidential;
• tell you if we decide we can no longer meet our obligations under the data protection law that applies.

05Security

We maintain technical and organisational measures to protect customer personal data against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access. The measures in place are listed in section 13. We may change them as long as the overall level of protection does not fall.

06Sub-processors

You give us general permission to use other companies to process customer personal data for us. The current list is on our Sub-processors page.

We have a written contract with each sub-processor that requires it to protect customer personal data to at least the standard of this addendum, and we remain responsible to you for what it does.

We will tell org owners by email, or in the app, at least 30 days before a new sub-processor starts to process customer personal data. If you object on reasonable data protection grounds within those 30 days, we will discuss it with you in good faith. If we cannot resolve it, you may cancel the affected plan and we will refund the fees you paid for the unused part of the period.

07Requests from individuals

If someone asks us to access, correct, delete or otherwise act on personal data that is in your content, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to or the law requires it. Taking the nature of the service into account, we will give you reasonable help to respond, including the tools in the product for finding and deleting content.

08Personal data breaches

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, customer personal data, we will tell you without undue delay and in any case within 72 hours of becoming aware of it. We will tell you what we know about what happened, the data and people likely to be affected, and what we are doing about it, and we will update you as we learn more. We will take reasonable steps to contain the breach and limit its effects.

Telling you about a breach is not an admission of fault.

09Help, information and audits

We will give you reasonable help with data protection impact assessments and with consulting a regulator, where these concern our processing and you cannot reasonably do them without us.

On request, we will give you the information reasonably needed to show that we meet this addendum, including answers to a security questionnaire and, when we have them, summaries of independent audit reports.

If that information is not enough to meet a legal obligation you have, you may audit our processing of customer personal data once in any 12 months, or after a breach that affected you. You must give at least 30 days' written notice, agree the scope with us in advance, carry it out in business hours without disrupting the service or exposing other customers' data, keep what you learn confidential, and pay your own costs and our reasonable costs.

10Return and deletion

While you use Daab you can download and delete your content yourself. When you stop using the service, or earlier if you ask, we delete customer personal data from our live systems, or return it to you first if you ask, unless the law requires us to keep it. Write to hello@daab.app to ask for deletion or return. We complete it within 30 days and confirm in writing. Copies in backups are not used for any other purpose and are removed as backups are cleared.

11International transfers

Daab stores and processes customer personal data in the United States.

European Economic Area. Where the GDPR applies to a transfer of customer personal data to Daab, the European Commission's standard contractual clauses of 4 June 2021 (Decision 2021/914) apply and are part of this addendum. Module Two applies where you are a controller, and Module Three where you are a processor. In those clauses: the optional docking clause 7 does not apply; in clause 9, option 2 (general written authorisation) applies with the 30 days' notice in section 6 above; the optional wording in clause 11 does not apply; the clauses are governed by the law of Ireland and disputes go to the courts of Ireland; Annex I is completed by sections 2 and 3 of this addendum, with you as data exporter and DAAB INC as data importer; Annex II is section 13; and Annex III is the Sub-processors page. The competent supervisory authority is the one that supervises you.

United Kingdom. Where the UK GDPR applies, the International Data Transfer Addendum to the EU standard contractual clauses issued by the UK Information Commissioner (version B1.0) applies and is part of this addendum, with its tables completed by the information above. Either party may end it under its section 19.

Switzerland. Where Swiss law applies, the standard contractual clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Federal Data Protection and Information Commissioner as the supervisory authority.

If these clauses conflict with the rest of this addendum, the clauses apply. If a transfer mechanism we rely on is withdrawn or held invalid, we will work with you to put a valid one in place.

We will tell you, where the law allows, if a public authority makes a legally binding demand for customer personal data, and we will challenge a demand we reasonably believe to be unlawful.

12Liability

Each party's liability under this addendum is subject to the limits in the Terms. Nothing in this addendum limits what either party owes directly to an individual or a regulator under data protection law.

13Security measures

These are the measures in place today.

• Encryption: all traffic to and between our systems is encrypted in transit. Databases and stored files are encrypted at rest by our hosting providers.
• Access to content: every request for content is checked against the person's role in the org, workspace and video. Stored files sit in a private store and are reached only through links that are signed and expire quickly.
• Sharing: share links can carry a password, which we store only in hashed form, and an expiry date, and can be revoked at any time.
• Sign-in: sign-in and sessions are run by a specialist identity provider. Our systems accept only tokens issued by it.
• Separation: production, staging and development each have their own database, identity service and credentials. Customer data is kept in production.
• AI review: working copies made for a review are deleted when it ends. Files sent to the model provider are deleted when the review ends or expire within 48 hours.
• Abuse protection: rate limits on sensitive actions, and signature checks on every message we accept from another system.
• Logs: secrets, tokens and signed links are removed from logs and error reports.
• Staff access: access to production systems is limited to the people who need it to run the service.

We add to this list as further measures are put in place.