Draft to be reviewed by a lawyer, provisionally in force.
Parties and purpose
This agreement, entered into under Article 28 of the GDPR, binds the customer organization (controller) and Cryptaguard BV, Fazantenlaan 9, 1600 Sint-Pieters-Leeuw, Belgium, company number BE 1007.610.660 (processor), for personal data processed on behalf of the customer in the DémoPlan service. It is signed electronically in Settings › GDPR: name, role, date and version are kept as proof.
Description of processing
Nature: hosting, recording, generating and distributing demo videos. Purposes: providing the service chosen by the customer. Data subjects: members of the organization, people whose voice or face is used, the customer’s prospects, viewers and contacts. Data: identity and business contact details, voice and image with consent, aggregated viewing statistics, contacts captured with their consent, scenario and video content. Duration: the term of the contract, then until deletion as set out below.
Instructions
We process data only on the customer’s documented instructions, which are these terms, this agreement and the studio settings. If an instruction appears to us to infringe the GDPR, we inform the customer.
Confidentiality
People authorized to process the data are bound by confidentiality. The content of customers’ videos and scenarios is neither viewed nor used for other purposes, including by our monitoring tools.
Security
Measures applied: data isolated per organization, keys and secrets encrypted, two-factor authentication, roles and permissions per organization, signed and expiring video links, audit log, sign-in attempt limits, encrypted off-server backups, security updates and exposure checks after every change to the web server.
Sub-processors
The customer authorizes the use of the sub-processors listed in Settings › GDPR and in the privacy policy. We inform it at least 30 days before any addition or replacement; it may object on reasonable grounds and, failing agreement, terminate free of charge. Each sub-processor is bound by obligations equivalent to those of this agreement.
Transfers outside the European Union
Transfers to third countries rely on an adequacy decision, including the EU–US Data Privacy Framework, or on the European Commission’s standard contractual clauses.
Data subject rights
We help the customer respond to requests from data subjects. The studio lets it export an organization’s data, delete a prospect or contact, withdraw a voice consent and set retention periods.
Data breaches
We notify the customer of any data breach affecting it without undue delay, and no later than 48 hours after becoming aware of it, with its nature, the data and people concerned, its likely consequences and the measures taken, so that it can meet its own 72-hour deadline.
Impact assessment
We provide the customer with the information it needs for a data protection impact assessment or a prior consultation of the supervisory authority.
End of contract
At the end of the contract, the customer can export its data. It is then deleted after the 30-day grace period, with us and our sub-processors, and a deletion certificate is sent. Only the audit log and usage records are kept for our legal obligations.
Audit
We make available the information needed to demonstrate compliance with this agreement. The customer may have an audit carried out once a year, with 30 days’ notice, at its own expense and under a confidentiality undertaking.
Term and precedence
This agreement lasts as long as the contract. For data protection, it prevails over the terms of use. It is governed by Belgian law.
Get a demo of your own app.
Join the waitlist. Early sign-ups get a demo video of their own app, prepared with them.
- A free video of your app
- Access before the public launch
- Pricing confirmed before any billing