Data Processing Agreement

This DPA governs how Clip Story Limited processes personal data on behalf of the Controller under UK GDPR Article 28.

Definitions

"Data Protection Law"	The UK GDPR and Data Protection Act 2018, as amended from time to time.
"Main Agreement"	The ClipStory subscription agreement or order form between the parties.
"Personal Data"	Has the meaning given in UK GDPR Article 4(1).
"Processing"	Has the meaning given in UK GDPR Article 4(2).
"Sub-processor"	Any third party engaged by ClipStory to process Personal Data on behalf of the Controller.
"Security Incident"	A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

Details of processing

Item	Detail
Subject-matter	Operation of the ClipStory video campaign platform on behalf of the Controller.
Duration	For the term of the Main Agreement and any applicable retention period thereafter.
Nature & purpose	Collecting, storing, transcribing, analysing and delivering video content submitted by Contributors; sending email communications; providing analytics.
Data subjects	Contributors (employees, customers or members of the public invited by the Controller); Controller's own users (employees or contractors).
Personal data types	Name, email address, job title, video recording, audio, transcript, consent record, IP address, device type.
Lawful basis	Consent (UK GDPR Art 6(1)(a)) for Contributors. Legitimate interests / contract performance for Controller users.
Special category data	None intentionally collected. Controller must not use the platform to collect special category data without prior written agreement.

Processor obligations
3.1 ClipStory shall process Personal Data only on the documented instructions of the Controller, which are set out in this DPA and the Main Agreement.
3.2 ClipStory shall ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
3.3 ClipStory shall implement and maintain appropriate technical and organisational security measures as described in §6 below.
3.4 ClipStory shall assist the Controller, insofar as reasonably practicable, in responding to requests from Data Subjects exercising their rights under Data Protection Law.
3.5 ClipStory shall assist the Controller in ensuring compliance with its obligations under UK GDPR Articles 32–36 (security, breach notification, DPIA, prior consultation).
3.6 ClipStory shall, at the choice of the Controller, delete or return all Personal Data to the Controller on termination of the Main Agreement, and delete existing copies unless UK law requires storage.
3.7 ClipStory shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits conducted by the Controller or a mandated auditor, on reasonable notice and at the Controller's cost.
Sub-processors
4.1 The Controller grants ClipStory general written authorisation to engage sub-processors. The current list of approved sub-processors is published at clipstory.io/policies/sub-processors.
4.2 ClipStory shall inform the Controller of any intended changes to the sub-processor list (additions or replacements) by updating that page and notifying account administrators by email at least 14 days in advance. The Controller may object in writing within 14 days; if no resolution is reached either party may terminate the relevant service on 30 days' notice.
4.3 Where ClipStory engages a sub-processor, it shall impose equivalent data-protection obligations to those set out in this DPA.
International data transfers
5.1 Personal data is processed primarily in the UK. ClipStory will not transfer Personal Data outside the UK or EEA except where covered by an appropriate safeguard under Data Protection Law.
5.2 Where data is transferred to sub-processors in a third country (for example, the United States), the transfer is covered by Standard Contractual Clauses (2021/914/EU) approved by the European Commission and, for UK transfers, adapted by the ICO's International Data Transfer Addendum (IDTA). The applicable transfer mechanisms for each sub-processor are listed in the Sub-Processor List at clipstory.io/policies/sub-processors. Executed copies are available to the Controller on written request.
Security measures
ClipStory maintains the following technical and organisational measures:
Encryption — Data encrypted in transit (TLS 1.2+) and at rest (AES-256). Video files served via signed, time-limited URLs.
Access control — Role-based access; Row-Level Security enforced at database level; multi-factor authentication for all admin accounts.
Isolation — Strict data isolation between customer organisations; no cross-tenant data access.
Monitoring — Continuous application performance and security monitoring via New Relic; structured audit logs retained for 90 days.
Incident response — ClipStory will notify the Controller without undue delay, and in any event within 72 hours of becoming aware, of a Security Incident affecting their Personal Data.
Backups — Daily automated database backups retained for 14 days; tested quarterly.
Controller obligations
7.1 The Controller warrants that it has a valid lawful basis for instructing ClipStory to process Personal Data and that its use of the platform complies with Data Protection Law.
7.2 The Controller is responsible for obtaining any required consents from Contributors before inviting them to the platform.
7.3 The Controller shall not use the platform to collect Special Category data (UK GDPR Art 9) without prior written agreement with ClipStory.

Schedule 1 — Description of Processing

Required under Article 28(3) UK GDPR and Annex I.B to the Standard Contractual Clauses. This schedule forms part of the Data Processing Agreement.

Subject matter.	Operation of the ClipStory platform — a B2B SaaS application that enables the Controller to collect, manage and distribute video content and testimonials from contributors.
Nature of processing	Collection, storage, transcription, AI-assisted analysis, access management, distribution, and deletion of video content and personal data submitted through the ClipStory platform by or on behalf of the Controller.
Purpose of processing	To enable the Controller to run video content campaigns; collect recordings from contributors; manage contributor consent and rights records; apply AI analysis (Clip Pilot); review, compile and distribute content; and receive platform usage analytics.
Types of personal data	Identity data (name, job title); contact data (email address); video and audio recordings; AI-generated transcripts and summaries; consent records (status, timestamps, withdrawal records); platform usage and activity logs; IP addresses and device identifiers collected automatically during platform use.
Special categories	Not actively sought or required by ClipStory. Special category data may be incidentally present in recorded content depending on campaign questions. The Controller is solely responsible for compliance with Article 9 UK GDPR in relation to any such data.
Categories of data subjects	Contributors: third-party individuals (employees, customers or others) invited by the Controller to record video content via campaign links. Customer users: employees or contractors of the Controller who access and manage the ClipStory platform.
Duration of processing	For the term of the agreement. On termination, personal data is deleted or returned within 60 days. Security and audit logs may be retained for up to 12 months then deleted, where required for legal or security purposes.

This DPA governs how Clip Story Limited processes personal data on behalf of the Controller under UK GDPR Article 28.

Definitions

"Data Protection Law"	The UK GDPR and Data Protection Act 2018, as amended from time to time.
"Main Agreement"	The ClipStory subscription agreement or order form between the parties.
"Personal Data"	Has the meaning given in UK GDPR Article 4(1).
"Processing"	Has the meaning given in UK GDPR Article 4(2).
"Sub-processor"	Any third party engaged by ClipStory to process Personal Data on behalf of the Controller.
"Security Incident"	A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

Details of processing

Item	Detail
Subject-matter	Operation of the ClipStory video campaign platform on behalf of the Controller.
Duration	For the term of the Main Agreement and any applicable retention period thereafter.
Nature & purpose	Collecting, storing, transcribing, analysing and delivering video content submitted by Contributors; sending email communications; providing analytics.
Data subjects	Contributors (employees, customers or members of the public invited by the Controller); Controller's own users (employees or contractors).
Personal data types	Name, email address, job title, video recording, audio, transcript, consent record, IP address, device type.
Lawful basis	Consent (UK GDPR Art 6(1)(a)) for Contributors. Legitimate interests / contract performance for Controller users.
Special category data	None intentionally collected. Controller must not use the platform to collect special category data without prior written agreement.

Processor obligations
3.1 ClipStory shall process Personal Data only on the documented instructions of the Controller, which are set out in this DPA and the Main Agreement.
3.2 ClipStory shall ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
3.3 ClipStory shall implement and maintain appropriate technical and organisational security measures as described in §6 below.
3.4 ClipStory shall assist the Controller, insofar as reasonably practicable, in responding to requests from Data Subjects exercising their rights under Data Protection Law.
3.5 ClipStory shall assist the Controller in ensuring compliance with its obligations under UK GDPR Articles 32–36 (security, breach notification, DPIA, prior consultation).
3.6 ClipStory shall, at the choice of the Controller, delete or return all Personal Data to the Controller on termination of the Main Agreement, and delete existing copies unless UK law requires storage.
3.7 ClipStory shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits conducted by the Controller or a mandated auditor, on reasonable notice and at the Controller's cost.
Sub-processors
4.1 The Controller grants ClipStory general written authorisation to engage sub-processors. The current list of approved sub-processors is published at clipstory.io/policies/sub-processors.
4.2 ClipStory shall inform the Controller of any intended changes to the sub-processor list (additions or replacements) by updating that page and notifying account administrators by email at least 14 days in advance. The Controller may object in writing within 14 days; if no resolution is reached either party may terminate the relevant service on 30 days' notice.
4.3 Where ClipStory engages a sub-processor, it shall impose equivalent data-protection obligations to those set out in this DPA.
International data transfers
5.1 Personal data is processed primarily in the UK. ClipStory will not transfer Personal Data outside the UK or EEA except where covered by an appropriate safeguard under Data Protection Law.
5.2 Where data is transferred to sub-processors in a third country (for example, the United States), the transfer is covered by Standard Contractual Clauses (2021/914/EU) approved by the European Commission and, for UK transfers, adapted by the ICO's International Data Transfer Addendum (IDTA). The applicable transfer mechanisms for each sub-processor are listed in the Sub-Processor List at clipstory.io/policies/sub-processors. Executed copies are available to the Controller on written request.
Security measures
ClipStory maintains the following technical and organisational measures:
Encryption — Data encrypted in transit (TLS 1.2+) and at rest (AES-256). Video files served via signed, time-limited URLs.
Access control — Role-based access; Row-Level Security enforced at database level; multi-factor authentication for all admin accounts.
Isolation — Strict data isolation between customer organisations; no cross-tenant data access.
Monitoring — Continuous application performance and security monitoring via New Relic; structured audit logs retained for 90 days.
Incident response — ClipStory will notify the Controller without undue delay, and in any event within 72 hours of becoming aware, of a Security Incident affecting their Personal Data.
Backups — Daily automated database backups retained for 14 days; tested quarterly.
Controller obligations
7.1 The Controller warrants that it has a valid lawful basis for instructing ClipStory to process Personal Data and that its use of the platform complies with Data Protection Law.
7.2 The Controller is responsible for obtaining any required consents from Contributors before inviting them to the platform.
7.3 The Controller shall not use the platform to collect Special Category data (UK GDPR Art 9) without prior written agreement with ClipStory.

Schedule 1 — Description of Processing

Required under Article 28(3) UK GDPR and Annex I.B to the Standard Contractual Clauses. This schedule forms part of the Data Processing Agreement.

Subject matter.	Operation of the ClipStory platform — a B2B SaaS application that enables the Controller to collect, manage and distribute video content and testimonials from contributors.
Nature of processing	Collection, storage, transcription, AI-assisted analysis, access management, distribution, and deletion of video content and personal data submitted through the ClipStory platform by or on behalf of the Controller.
Purpose of processing	To enable the Controller to run video content campaigns; collect recordings from contributors; manage contributor consent and rights records; apply AI analysis (Clip Pilot); review, compile and distribute content; and receive platform usage analytics.
Types of personal data	Identity data (name, job title); contact data (email address); video and audio recordings; AI-generated transcripts and summaries; consent records (status, timestamps, withdrawal records); platform usage and activity logs; IP addresses and device identifiers collected automatically during platform use.
Special categories	Not actively sought or required by ClipStory. Special category data may be incidentally present in recorded content depending on campaign questions. The Controller is solely responsible for compliance with Article 9 UK GDPR in relation to any such data.
Categories of data subjects	Contributors: third-party individuals (employees, customers or others) invited by the Controller to record video content via campaign links. Customer users: employees or contractors of the Controller who access and manage the ClipStory platform.
Duration of processing	For the term of the agreement. On termination, personal data is deleted or returned within 60 days. Security and audit logs may be retained for up to 12 months then deleted, where required for legal or security purposes.