Data Processing Agreement

This agreement applies to all businesses that order a video from us and provide us with material containing personal data. You can read it before ordering and download it as a PDF. It is concluded with the order; we store your acceptance with text version and time.

Parties

• The ordering business as stated in the order – “Controller”
• Motion ToGo UG (haftungsbeschränkt), Drebkauer Straße 5d, 03226 Vetschau/Spreewald – “Processor”

§ 1 Subject matter and duration

1. The subject matter is the processing of personal data contained in the Controller’s material, brief and outputs for the production of marketing videos under the main contract (order and terms).
2. The agreement applies for the duration of the main contract and beyond for as long as the Processor stores the Controller’s data under § 9.

§ 2 Nature, purpose, data and data subjects

1. Nature and purpose: storing, reviewing, analyzing, cutting and editing the material; creating script, voice-over, subtitles and video; providing them on the order page.
2. Types of data: image and video recordings of people, voice and audio recordings, names, roles and contact details in material and brief, logos and company details.
3. Data subjects: employees, customers and business partners of the Controller and other persons seen or heard in the material.
4. Special categories of personal data (Art. 9 GDPR, such as health data) are not covered by this agreement. The Controller only provides such data after prior agreement in text form.

§ 3 Instructions

1. The Processor processes the data only on documented instructions from the Controller (Art. 28 (3) (a) GDPR), unless required to do otherwise by law; in that case it informs the Controller beforehand where the law permits.
2. Instructions are the order, the brief, the submitted material and the revision rounds. The Controller issues further instructions in text form, via the message field on the order page or by email. The person who placed the order and any persons they name in text form are authorized to issue instructions.
3. If the Processor considers an instruction unlawful, it informs the Controller without delay and may suspend its execution until clarified.

§ 4 Confidentiality

All persons at the Processor who have access to the data are bound to confidentiality (Art. 28 (3) (b) GDPR). This obligation continues after the end of their work.

§ 5 Technical and organizational measures

The Processor takes the measures under Art. 32 GDPR described in Annex 2. It may adapt them to technical progress provided the level of protection does not decrease. It documents significant changes.

§ 6 Sub-processors

1. The Controller approves the sub-processors listed in Annex 1.
2. The Processor informs the Controller by email at least 14 days in advance of new or replaced sub-processors. Within this period the Controller may object for an important reason relating to data protection. If the parties cannot find a solution, either may terminate the affected order; services already rendered remain payable.
3. The Processor contractually binds each sub-processor to the same data protection obligations (Art. 28 (4) GDPR).

§ 7 Rights of data subjects

The Processor supports the Controller with appropriate measures in responding to requests from data subjects (Art. 28 (3) (e) GDPR) – for example by deleting or blurring a person in material and outputs. It forwards requests received directly without delay.

§ 8 Assistance and data breaches

1. The Processor assists the Controller in meeting the obligations under Art. 32 to 36 GDPR (Art. 28 (3) (f) GDPR).
2. It notifies the Controller of any personal data breach without delay, no later than 48 hours after becoming aware of it, with all information available at that time. It provides further information as soon as it becomes available.

§ 9 Deletion and return

1. The Processor deletes raw material 30 days after delivery (can be extended once by 30 days) and outputs 24 months after delivery. It deletes local copies on the production computers 3 days after delivery and working data of the AI tools after 7 days.
2. The Controller may request deletion or return earlier (Art. 28 (3) (g) GDPR). Statutory retention obligations remain unaffected.
3. Using a video as a reference is not processing on behalf; it is governed by Part A § 16 of the terms. We only show people in the video with their separate consent.

§ 10 Evidence and audits

1. The Processor makes available to the Controller all information necessary to demonstrate compliance with its obligations and allows for audits (Art. 28 (3) (h) GDPR).
2. Audits are primarily conducted through information and documents. On-site audits are possible with 14 days’ notice during normal business hours, without specific cause at most once a year. The Controller bears its own costs.

§ 11 Transfers to third countries

Processing outside the EU and the EEA is carried out only by the sub-processors listed in Annex 1 and only if the requirements of Art. 44 et seq. GDPR are met – on the basis of the adequacy decision for the EU-US Data Privacy Framework insofar as the recipient is certified, and otherwise on the basis of the European Commission’s standard contractual clauses.

§ 12 Liability and final provisions

1. Liability is governed by Art. 82 GDPR. Otherwise the liability provisions of the main contract apply.
2. In matters of data protection this agreement takes precedence over the main contract.
3. Amendments and additions require text form.
4. Should any provision be invalid, the remaining provisions remain valid. German law applies.

Annex 1 – Sub-processors

Sub-processor	Service	Seat
Hetzner Online GmbH	Servers, database and storage for material and outputs, data center in Falkenstein	Germany
Anthropic (Anthropic PBC or Anthropic Ireland, Limited)	AI-assisted analysis of the material and creation of the script with the language model Claude	USA / Ireland
Eleven Labs Inc. (ElevenLabs)	Synthetic voice-over from the script text	USA
Resend, Inc.	Sending emails, such as sign-in and read links and order status emails (sent from the EU)	USA

Payments are processed by Stripe. Stripe receives no content from the material and is not a sub-processor within the meaning of this agreement.

Annex 2 – Technical and organizational measures

• Servers and network: hosting in Germany, firewall with only the necessary ports, server access by key only, automatic security updates, encrypted connections (TLS) for every transfer, internal services only on the internal network.
• Backups: daily encrypted backups, retained for 30 days, regularly tested restoration.
• Storage: private storage without public access, only signed, time-limited links, access only through the application, malware check of every uploaded file, no executable files.
• Access: order page only via a personal sign-in link, non-guessable order numbers, limits on sign-in attempts; administration area only with a second factor (one-time code or passkey), logging of all administrative actions.
• Credentials: service keys stored encrypted, on the production computers only in the system keychain, never in plain text in files.
• Production computers: disk encryption, order folder never in a cloud storage service, screen lock, only outgoing connections of the production software, credentials released per computer.
• AI tools: customer content is treated as data, never as instructions; working data is deleted after 7 days; the material is not used to train our own models.
• Organization: confidentiality obligation, deletion concept (§ 9), data breach process (§ 8), record of processing activities.