Data Processing Agreement (DPA)

02Role of each party

The Customer is the controller: it decides what the data in the videos it uploads and in its profiles is used for and how. Originl is the processor: it processes it only to provide the service.

If the Customer is an agency that in turn works on behalf of another client (a creator or a brand), the Customer is that client's processor and Originl is a sub-processor. In that case the Customer guarantees that the client has authorized it to use Originl and answers to it for what this agreement requires of the controller.

Originl is an independent controller only for what is explained in the section "Originl as controller".

03Customer instructions

Originl processes the data on the Customer's documented instructions. Documented instructions are these Terms, this agreement and everything the Customer configures in the dashboard: profiles, videos, calendar, connections, exports and deletions.

If an instruction seems unlawful to it, Originl will tell the Customer and may refrain from carrying it out in the meantime, which is not a breach. Instructions beyond what the service does out of the box are agreed in writing and may carry a fee.

Originl may also process data where required by the law of the European Union, a Member State or another country that applies to it. It will tell the Customer first unless that law forbids it.

04Customer obligations

The Customer guarantees that it processes the data lawfully and that it has a valid legal basis for every processing it commissions. In particular, it undertakes to:

a) Have the permission of the people who appear in the videos it uploads to use their image and voice, and inform them in the terms required by the law of its country.

b) Upload only its own videos or videos it is licensed to use, and not upload content involving minors, sexual or adult content, or sensitive data it does not need.

c) Comply with the rules of the platforms where it publishes (Instagram and Meta, TikTok, YouTube, X, Facebook and Threads) and with the advertising, consumer and intellectual property laws of the countries where it publishes.

d) Look after the data it takes out of the service. From the moment the Customer downloads a video, an export or a copy, the Customer is solely responsible for that file, for where it keeps it and for whom it shares it with. The same goes for the credentials and the access it gives its team.

If the Customer breaches these obligations, Originl may suspend the affected processing and the Customer answers for the consequences, as explained in "Liability".

05Confidentiality

Originl only gives access to the data to the people who need it to provide the service, give support or keep the platform secure. All of them are bound to secrecy, by contract or by law, also when they stop working with Originl. Originl does not look at a Customer's videos or data except to give it support when it asks, to review a security alert, or when the law requires it.

06Security

Originl applies technical and organisational measures appropriate to the risk, bearing in mind that there may be sensitive data. Today's measures are listed in the "Security measures" annex. Originl may change them as long as the level of protection does not go down.

The Customer is responsible for the security of what depends on it: its passwords, its team's two-factor authentication, the permissions it grants and the files it downloads.

07Sub-processors

The Customer gives Originl a general authorisation to engage sub-processors. The list of those used today, with their function and country, is in the Privacy Policy, under "Providers".

Before adding or replacing a sub-processor, Originl will publish it on that list and notify the Customer in the dashboard or by email at least 15 days in advance, except in a security or service continuity emergency, which is notified as soon as possible. Within that period, the Customer may object in writing on reasonable data protection grounds. The parties will look for a solution in good faith; if there is none, the Customer may stop using the affected part of the service or close its account, and that is its sole remedy. If it does not object, the change is deemed accepted.

Originl imposes on each sub-processor, by contract, data protection obligations equivalent to those in this agreement and remains liable to the Customer for their performance, as Article 28(4) GDPR requires.

08International transfers

Originl is in the United States, and so are some sub-processors. If the Customer is in the European Economic Area and sends data to Originl, the transfer relies on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914): module 2 if the Customer is a controller and module 3 if it is a processor for another client. The parties accept them with this agreement, which incorporates them by reference. They apply with these options: the docking clause (clause 7), general authorisation of sub-processors with 14 days' notice (clause 9), without the arbitration option (clause 11), the supervisory authority of the Customer's Member State (clause 13) and the law and courts of Ireland (clauses 17 and 18). The annexes of those clauses are completed with the annexes of this agreement.

For Switzerland and the United Kingdom the same clauses apply with the adjustments their law requires (in the United Kingdom, the international data transfer addendum of its authority).

Where a sub-processor is certified under the EU-US Data Privacy Framework, the transfer also relies on that framework. Originl assesses the risk of each transfer and applies additional measures where needed, such as encryption.

09Assistance to the Customer

Originl helps the Customer comply with the rights of data subjects (access, rectification, erasure, objection, restriction and portability), mainly with the panel tools: deleting videos and profiles, downloading data and exporting or deleting the account. If a person writes directly to Originl, Originl will pass it to the Customer without replying on its own account, except to acknowledge receipt or if the law requires it.

Originl also helps, with the information it has, with impact assessments, consultations with the authority and the security of the processing. What the Customer can do from the panel alone is free of charge; help beyond that may have a cost, at a reasonable price stated beforehand.

10Personal data breaches

If Originl suffers a security breach affecting the Customer's data, it will notify the Customer without undue delay and, wherever possible, within 48 hours of confirming it. The notice will say what is known at that point: what happened, which data and how many people may be affected, the likely consequences, what has been done to contain it and a contact. Anything missing will follow as soon as it is known.

As controller, the Customer decides whether to notify the authority or the people affected, and Originl helps with the information it has. Notifying a breach is not an admission of fault or liability.

11Information and audits

Originl makes available to the Customer the information needed to show that it complies with this agreement: this document, the sub-processor list, the description of the security measures and, where they exist, certifications or audit reports. In most cases that is enough.

If it is not, the Customer may request an audit at most once every 12 months, unless an authority requires it or there has been a breach affecting it. It is requested 30 days in advance, carried out remotely and on documents first, during business hours, without putting at risk the security or the data of other customers. It is carried out by the Customer or by an independent auditor who is not a competitor of Originl and signs a confidentiality undertaking. Each party bears its own costs; if the audit shows a serious breach by Originl, Originl pays the Customer's reasonable costs.

12Artificial intelligence

To create the variants and write the text that goes with them, Originl sends its providers (the video engine and the text AI) only what is needed for each task. Originl does not authorize those providers to use the Customer's data to train their models when the provider offers that option, and prefers those that do not. The text written by the AI is a proposal: the Customer reviews it and decides whether to publish it.

13Originl as controller

Originl is a controller, not a processor, for these processing activities of its own, explained in its Privacy Policy:

a) The account of the Customer and its team: access, billing, support and service notices.

b) The security of the platform and the prevention of fraud and abuse, including technical logs.

c) Compliance with its legal obligations.

d) Anonymous, aggregated statistics to improve the service, which do not identify anyone (each figure combines at least several customers). Being anonymous, they are not personal data and Originl may keep them even if the Customer cancels.

Originl does not sell personal data and does not use it for advertising.

14Term and end of processing

This agreement lasts as long as the Customer's account. While the account is active, videos, variants and results are kept, unless the Customer deletes them earlier.

When the Customer deletes the account, it has 14 days to undo it and download its data. After that period, Originl deletes the Customer's personal data. Encrypted backups are deleted as they rotate, within 30 days at most. Originl only keeps what a law requires it to keep (for example, invoices) and the anonymous statistics. If the Customer asks before the period ends, Originl returns the data in a commonly used format instead of simply deleting it.

15Liability

Each party answers for its own breaches of this agreement and of data protection law.

To the extent permitted by law, Originl's total liability under this agreement and the Terms of Service, combined, does not exceed what the Customer has paid it in the 12 months before the event that causes it, and Originl is not liable for indirect damages, lost profits, loss of reach or followers, or for what third parties such as the platforms where the Customer publishes or payment providers do. This limit does not apply to what the law does not allow to be limited: wilful misconduct, liability to data subjects under Article 82 GDPR, or clause 12 of the standard clauses where they apply.

The Customer will hold Originl harmless, and will pay the damages, penalties, costs and reasonable defence expenses, in respect of any claim by data subjects, authorities or third parties arising from: the Customer's lack of legal basis or permissions; the content, names, images or voices in the videos it uploads; its instructions; the files it downloads; or breach of the rules of the platforms where it publishes. Originl will notify the Customer of the claim and cooperate in its defence.

16Order of precedence and changes

In case of conflict, what the law requires comes first; then the standard contractual clauses where they apply; then this agreement; and finally the Terms of Service. If any part of this agreement is invalid, the rest remains in force.

Originl may update this agreement to adapt it to the law, to the authorities or to changes in the service. Material changes are notified 30 days in advance; if the Customer disagrees, it may close its account before they take effect.

17Governing law and courts

This agreement is governed by the same law and courts as the Terms of Service, except where the standard contractual clauses submit matters to the law and courts chosen in them.

18Annex I. Description of the processing

Data subjects: the people who appear in the videos the Customer uploads; the people on its team; and the owners of the public accounts read by the viral radar.

Data: videos, images and voices; name, country, language, Instagram username and photo of each profile; text that goes with the variants; publishing calendar; results of each post (reach and views); public data of the accounts and viral videos the Customer follows.

Sensitive data: Originl neither looks for nor needs it. If a video contains it, the measures in annex II protect it, and the Customer is the one who must have the appropriate legal basis.

Nature and purpose: create variants of the videos, schedule and publish them on the Customer's Instagram, measure results, show virals, write text with AI, notify the Customer and keep backups.

Frequency and duration: continuous, while the account lasts and the deletion period of the previous section.

19Annex II. Security measures

Encrypted connections for all traffic.

Encrypted backup, kept off the main server in private storage, with the key separate from the data and deletion after 30 days. At least one backup is made every day.

Access to the panel with a secure session (HttpOnly and Secure cookies), two-factor authentication available to the whole team, role-based permissions and a log of sensitive actions.

Separation of each customer's and each profile's data through database access rules.

Internal access only on a need basis and with a duty of secrecy, and an incident response procedure. Support screenshots are kept in private storage and are only seen through a temporary link.

20Annex III. Sub-processors

The up-to-date list of sub-processors, with their function and country, is in the Privacy Policy, under "Providers (data processors)". It forms part of this agreement and is updated as described under "Sub-processors".