Data processing agreement

What we process, and why

The personal data in your answers, the files you upload, your messages and the deliverables we make for you. We process it only to prepare your quote and produce the animation you ask for, and only on your instructions: this agreement, the request form and the messages in your case. We never use it for anything else and never for training any model.

Your responsibilities

You confirm that you have a lawful basis to share the material with us and to have it used for your project and, for health data and data about criminal matters, a condition under Articles 9 and 10 of the UK GDPR and the Data Protection Act 2018. You confirm that sharing it breaks no duty of confidence, court order, privilege or data-protection law, that you have told the people concerned where the law requires it, and that your instructions to us are lawful.

You will cover us against the claims, losses and costs that arise from a breach of this confirmation, as the Terms of Use set out.

Our responsibilities

Only our production staff can open case material, under a duty of confidentiality; finance staff see billing details only. Files are encrypted in transit and at rest, stored in a private bucket in the EU (Cloudflare R2, EU jurisdiction), and reached only through short-lived links after your access is checked. Openings and every download are recorded. Staff use separate accounts with two-factor sign-in.

We help you answer requests from the people whose data it is, and we tell you without undue delay if a breach affects your data.

Sub-processors

We use a small number of providers under data processing agreements of their own. They are listed in the Privacy Policy under “Who helps us” with what each receives, why, where, and how a transfer outside the UK is covered; the list’s date changes whenever a provider is added or removed. We email account holders at least 30 days before adding a provider that will process case material. If you object, tell us through the Contact page within that time and we will discuss it; you can always delete your case. We remain responsible to you for each provider’s performance.

The AI provider is used for “Draft with AI”, and only when you press it. It reads only what the Privacy Policy describes under “Who helps us”, does not use it to train its models and retains it only for the short period its agreement with us allows for abuse monitoring, after which it is deleted.

Our motion designers may also use AI tools as an additional aid when producing a video, and every video is made by them. These tools are not given the case material: files, images and descriptions stay out of them.

Where the data is kept

Your files are stored in the EU (Cloudflare R2, EU jurisdiction) and the rest of your data in the UK or the EU with our hosting provider. We transfer personal data outside the UK or the EEA only as the Privacy Policy describes: where a provider processes it there, the transfer is covered by the UK International Data Transfer Addendum to the EU standard contractual clauses, as shown beside that provider.

Deletion and return

Your case and its files stay in your account until you delete the case or ask us to remove them. You can delete a draft, and a case that is finished: delivered, closed, declined or cancelled. A case in progress cannot be deleted; you can cancel it before production starts, or ask us to remove a single file from it. Deleted records and files go to a locked store for 30 days and are then erased; there is no restore. We keep a note that the deletion happened, without the content.

You can download a copy of your data from your profile once a day. Invoices and credit notes are kept for as long as accounting law requires; they show the billing name, firm, address, case reference and amounts, and no case content.

Other duties

This agreement lasts for as long as the case exists in your account. We tell you if an instruction appears to us to break data-protection law. We help you with data protection impact assessments and with the regulator, as far as the processing we do for you is concerned.

At the end of a project you choose whether we keep, return or delete the personal data; on request we delete it and keep only what the law requires us to keep. We are responsible for our providers as we are for ourselves.

Audit

On request we provide the information you reasonably need to show that this agreement is kept, and we allow an audit, by you or an auditor you appoint, on reasonable notice and no more than once a year unless a breach or a regulator requires it. An audit is at your cost, during working hours, under a duty of confidentiality, and without compromising the material of other clients.

Governing law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Contact

Questions about this agreement: use the Contact page.