Data Processing Agreement

Download

DATA PROCESSING AGREEMENT

Last updated on 17 October 2026


1. WHAT THIS AGREEMENT IS

This agreement is between you, the customer who holds a Reelwire workspace ("you"), and
Tim Zierer, trading as Reelwire, Calle 47A x 47Y 100-1 #818, Fraccionamiento Las Americas
2, 97302 Merida, Yucatan, Mexico, sole trader ("we"). It is part of our Terms and
Conditions and applies automatically, with nothing to sign, wherever we process personal
data on your behalf and the EU General Data Protection Regulation (GDPR), the UK GDPR, the
Swiss Federal Act on Data Protection or a similar law applies to that processing. Where
Mexican data protection law applies, we are your encargado under the same terms.

You are the controller of that data and we are your processor. Words such as "personal
data", "processing", "controller", "processor", "sub-processor" and "personal data breach"
mean what they mean in the GDPR.

If you need a copy signed by both of us, write to contact@reelwire.io and we will send one
with the same text. Where this agreement and the Terms and Conditions disagree about
personal data we process for you, this agreement prevails.


2. WHAT WE PROCESS FOR YOU

Subject matter: running Reelwire for your workspace, as the Terms and Conditions describe.

Duration: for as long as your workspace exists, and then until the data is deleted as
section 10 describes.

Nature and purpose: storing what you put into Reelwire; rendering it into video clips;
handing clips and their texts over by email, by webhook and through the platform
connectors you switch on; passing them on to your syndication participants; keeping the
records of your workspace, including, on Enterprise, its compliance record; and helping
you when you ask us to.

Personal data, as far as you put it there:
- the personal data in your workspace's content: names, pictures, voices and other details
  of people shown or named in the media, posts, brands and data you upload or send over
  the API;
- your syndication participants' details: email addresses, webhook addresses and the
  contact address given for them, the participant ID your own site passes, the channels
  they chose, and the record of what was sent to them;
- the names and addresses of the people in your workspace, as your workspace's records and
  compliance record keep them beside what each of them did.

Data subjects: people shown or named in your content; your syndication participants; the
people in your workspace; and anybody else whose details you send us.

Special categories: Reelwire is not made for special categories of personal data (such as
health, religion or political opinions) or for data about criminal convictions. Do not put
them into Reelwire unless the law allows you to and you have told us first.

The personal data we decide on ourselves, such as your account, your billing details and
the server logs, is described in our Privacy Policy and is not covered by this agreement.


3. YOUR INSTRUCTIONS

We process the data in section 2 only on your documented instructions, transfers included.
Your instructions are the Terms and Conditions, this agreement, and what you and your
workspace do in Reelwire: the settings you choose, the content you send, the API calls your
keys make and the approvals you give. Further instructions need to be agreed in writing.

If the law makes us process the data in another way, we will tell you before we do, unless
that law forbids telling you. If we believe an instruction infringes data protection law,
we will tell you at once and may hold it until you confirm or change it.


4. THE PEOPLE WHO PROCESS IT

Everybody we allow to process the data is bound to confidentiality, by contract or by law,
and only processes it as far as their work for Reelwire needs.


5. SECURITY

We keep the data secure with the technical and organisational measures in Annex 1, which
take into account the state of the art, the cost, and the nature, scope, context and
purposes of the processing and its risks to people. We may improve them; we will not make
them less protective.


6. SUB-PROCESSORS

You authorise us generally to use sub-processors. Those we use today are in Annex 2.

Before we add or replace one, we will update Annex 2 and tell the owners of affected
workspaces by email at least 30 days ahead. You may object on reasonable data protection
grounds within those 30 days. If we cannot meet the objection, you may end your
subscription before the change takes effect, and we will refund the unused part of a period
you have paid for.

Every sub-processor is bound by contract to data protection obligations that protect the
data at least as well as this agreement does. We remain responsible to you for what our
sub-processors do.

The services you choose yourself are not our sub-processors: the AI services you connect
with your own keys, the platforms your platform connectors post to, the webhook addresses
and posting services you hand clips to, the mail server you give for your syndication
emails, and your syndication participants. They receive what you or your workspace send
them, on your instruction, under your own agreement with them.


7. TRANSFERS OUTSIDE THE EUROPEAN UNION

The servers that hold the data are in the European Union (Annex 2). We are established in
Mexico, and we reach the data from there to run and support the service; some
sub-processors in Annex 2 are in the United States.

For a transfer of personal data from the European Economic Area to us, the standard
contractual clauses adopted by the European Commission in Implementing Decision (EU)
2021/914, Module Two (controller to processor), apply and are part of this agreement, with
you as the data exporter and us as the data importer, as follows:
- clause 7 (docking clause) applies;
- clause 9: option 2, general authorisation, with the 30 days of notice in section 6;
- clause 11: the optional wording does not apply;
- clause 13: the supervisory authority competent for you;
- clause 17: the law of the EU member state in which you are established, or, where that
  law does not allow third-party beneficiary rights, the law of Ireland;
- clause 18: the courts of that member state;
- Annexes I, II and III of the clauses are filled in by section 2 and sections 1 and 2 of
  this agreement, by Annex 1 and by Annex 2.

For a transfer from the United Kingdom, the International Data Transfer Addendum issued by
the UK Information Commissioner applies on top of those clauses. For a transfer from
Switzerland, the same clauses apply with the Swiss Federal Act on Data Protection in place
of the GDPR where that act governs, and the Swiss Federal Data Protection and Information
Commissioner as the competent authority.

Our sub-processors in the United States receive the data under the EU-U.S. Data Privacy
Framework or the European Commission's standard contractual clauses, as Annex 2 says.


8. HELPING YOU

If somebody asks us to exercise their rights over data we process for you, we will pass the
request on to you without undue delay and not answer it ourselves, except to tell them we
have done so. Reelwire lets you find, correct, export and delete that data yourself: your
media library, your posts and their texts, your syndication participants and what each was
sent. Where you cannot, we will help you, as far as the nature of the processing allows.

We will also help you, taking into account the nature of the processing and the information
we have, to keep the data secure, to deal with a personal data breach, and to carry out a
data protection impact assessment or consult a supervisory authority where you have to.


9. PERSONAL DATA BREACHES

If we become aware of a personal data breach affecting data we process for you, we will
tell you without undue delay, and where we can within 48 hours, by email to your
workspace's owners. We will say what happened, which data and people are likely to be
affected, what it is likely to mean, and what we have done and propose to do about it, and
add what we learn as we learn it. Telling you is not an admission of fault.


10. AT THE END

You can download your media, your clips and, on Enterprise, your compliance record's
export before you delete your workspace. When the workspace is deleted, the data we
processed for you is deleted from the service at once, the working copies a renderer made
within a day, and any copy that remains in logs or other records within 30 days, unless the
law requires us to keep it. A workspace that leaves Enterprise keeps its compliance record
for 90 days for a last export, and then it is deleted.


11. SHOWING THAT WE COMPLY, AND AUDITS

We will make available to you the information needed to show that we meet this agreement
and Article 28 of the GDPR, and answer a reasonable security questionnaire once a year.

Where that is not enough, you, or an independent auditor you appoint who is bound to
confidentiality, may audit our compliance with this agreement once a year, or more often
where a supervisory authority requires it or after a personal data breach. Ask us at least
30 days ahead, in writing; the audit takes place in working hours, at your cost, and so as
not to disturb the service or reveal other customers' data. The data centres themselves are
our hosting provider's, and for them we rely on that provider's own audits and
certifications.


12. LIABILITY, AND WHAT ELSE APPLIES

Each of us is liable under this agreement as the Terms and Conditions say, except where the
law does not allow liability to be limited. Where this agreement and the standard
contractual clauses in section 7 disagree, the clauses prevail. Otherwise this agreement is
governed by the law and the courts the Terms and Conditions name.


13. CHANGES

We may change this agreement when the law, our sub-processors or the service change. A
change that makes it less protective for you will be notified to account holders by email
at least 30 days before it takes effect, as the Terms and Conditions describe, and the date
at the top will move.


ANNEX 1: TECHNICAL AND ORGANISATIONAL MEASURES

- Traffic to and from Reelwire is encrypted in transit.
- Credentials kept for use are encrypted at rest: keys for AI services, platform connector
  credentials, API keys kept for copying again, mail server passwords, and the secrets of
  two-factor sign-in. Passwords and API keys are stored as one-way hashes.
- Every workspace's data is kept apart from every other's by the application, which adds the
  workspace to every request it makes of the database.
- People sign in with a password, and can add two-factor sign-in with an authenticator app.
  One signed-in session at a time per person, ended after an hour without use.
- Inside a workspace, each person holds only the permissions they are given, API keys hold
  only the areas they are given, and an audit log records what changed and who changed it.
- Approval before anything goes out, Stop everything, planned silences and, on Enterprise, a
  sealed compliance record, so that you control and can prove what was published.
- The servers are in the European Union, in data centres run by a provider with its own
  physical security and certifications (Annex 2). Administrative access is limited to the
  people who operate the service and protected beyond a password.
- Server logs, which hold IP addresses, are deleted after 30 days.
- Every change to the software is recorded before it is deployed, and the same recorded
  version runs on every server.


ANNEX 2: SUB-PROCESSORS

Hetzner Online GmbH, Germany: hosting. The service runs in Hetzner's data centre near
Helsinki, Finland (operated by its subsidiary Hetzner Finland Oy); our development systems
run in its data centre in Nuremberg, Germany. Both are in the European Union.

AC PM LLC (Postmark), United States: sending emails, including the emails that hand posts
over and the emails to your syndication participants. EU-U.S. Data Privacy Framework, and
the European Commission's standard contractual clauses as an alternative.

Google LLC (Google Workspace), United States: our mailboxes, which hold what you or your
people write to us, including anything you send us for support. EU-U.S. Data Privacy
Framework, and the European Commission's standard contractual clauses.


Contact for anything about this agreement: contact@reelwire.io, or the postal address in
section 1.