Personal data processing agreement

This agreement is entered into pursuant to article 28 of Regulation (EU) 2016/679 ("GDPR") between the Customer, as data controller, and UNRUSH.IO, a French simplified joint-stock company (SAS), 47 rue Vivienne, 75002 Paris, France, registered with the Paris Trade and Companies Register under number 108 577 214 ("Unrush"), as processor. It forms an integral part of the terms and conditions and applies as soon as they are accepted, without separate signature. A signed copy may be provided on request at contact@unrush.io. This is an English translation provided for convenience: the French version (Accord de sous-traitance) is the reference text and prevails in the event of any discrepancy.

1. Purpose

The footage that the Customer entrusts to the Service contains personal data of third parties: image, voice, statements, sometimes the name and position of the people filmed. The Customer alone determines the purposes and means of this processing; Unrush processes this data on the Customer's behalf, solely to provide the Service.

This agreement does not cover account and billing data, which Unrush processes as data controller in accordance with its privacy policy.

2. Description of the processing

The processing is described in appendix 1. Its duration is that of the contract, plus the deletion period provided for in article 10.

3. Customer instructions

Unrush processes the data only on documented instructions from the Customer. The following constitute instructions: the terms and conditions, this agreement, and the actions that the Customer and its Users carry out in the Service (upload, launching an analysis, sharing, deletion). If Unrush considers that an instruction infringes the regulations, it informs the Customer without delay.

If Unrush is required by Union or Member State law to carry out processing, it informs the Customer beforehand, unless prohibited by law.

4. Customer obligations

The Customer warrants that the processing has a legal basis, that the data subjects have been informed, and that it holds the necessary authorizations, in particular with regard to image and voice rights.

The Service is not designed for content whose purpose is to process special categories of data within the meaning of article 9 of the GDPR, data relating to criminal convictions, or data of minors on a large scale. A Customer who plans such a use informs Unrush beforehand so that the necessary safeguards can be assessed; failing that, it alone bears the consequences.

5. Confidentiality

Unrush ensures that the persons authorized to access the data are bound by a confidentiality obligation and access it only to the extent necessary: support requested by the Customer, incident resolution, security.

6. Security

Unrush implements the technical and organizational measures described in appendix 2 and develops them without reducing their overall level.

7. Sub-processors

The Customer gives Unrush a general authorization to engage sub-processors. The categories in force are listed in appendix 3; the identity of each one is provided to the Customer on simple request. Unrush contractually imposes on each of them data protection obligations equivalent to those of this agreement, and remains liable to the Customer for their performance.

Unrush informs the Customer of any addition or replacement at least thirty days in advance, by email or in the application. The Customer may object during this period on legitimate grounds relating to data protection. If the parties cannot find a solution, the Customer may terminate the Service concerned without penalty, with a pro rata refund of sums paid in advance.

Sub-processors do not use the Customer's data to train artificial intelligence models.

8. Transfers outside the European Union

Video files are stored in the European Union. The application database is hosted in the United Kingdom, a country recognized by the European Commission as ensuring an adequate level of protection. Some sub-processors process data in the United States, as indicated in appendix 3, which specifies the processing location of each category. These transfers are governed by the adequacy decision on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise by the standard contractual clauses adopted by the European Commission (decision 2021/914), supplemented where necessary by additional measures.

9. Assistance to the Customer

Data subject rights. Unrush forwards to the Customer without delay any request received directly from a data subject and does not answer it itself. The Customer can search, export and delete its content from the Service; beyond that, Unrush assists it to a reasonable extent.

Data breach. Unrush notifies the Customer of any personal data breach affecting its content as soon as possible, and no later than forty-eight hours after becoming aware of it, with the information available: nature of the breach, categories and approximate volume of data, likely consequences, measures taken. Missing information is provided as it becomes available.

Impact assessments. Unrush provides the Customer with the information needed to carry out a data protection impact assessment and, where applicable, to consult the supervisory authority.

10. Fate of the data at the end of the contract

At the end of the contract, the data remains accessible to the Customer for thirty days for retrieval, and is then deleted from active systems, including at sub-processors. Backups are overwritten within a further period of thirty days at most. The Customer may request earlier deletion, and a certificate of deletion. Unrush retains beyond that only what the law requires.

11. Documentation and audit

Unrush keeps a record of the processing carried out on behalf of its customers and makes available to the Customer the information needed to demonstrate compliance with this agreement.

The Customer may have an audit carried out, no more than once a year except in the event of a proven breach, with thirty days' notice, during business hours, by an auditor bound by confidentiality and not a competitor of Unrush. The audit covers only the items relating to the processing of the Customer's data. The costs of the audit are borne by the Customer; beyond one day of involvement, the time spent by Unrush is invoiced at the rate in force. For sub-processors, the audit is carried out through the provision of their certifications and reports.

12. Liability

The liability of each party under this agreement is governed by the terms and conditions, including their cap, without prejudice to the rights that data subjects derive from the GDPR.

Appendix 1 — Description of the processing

Appendix 2 — Security measures

• Encryption: exchanges encrypted in transit (TLS); files encrypted at rest by the storage provider; third-party access keys encrypted in the database (AES-256-GCM); passwords hashed (bcrypt).
• Isolation: each piece of content is attached to an account and an organization; access control on every request; private storage spaces, accessible only through time-limited signed links; option of a dedicated analysis environment per customer.
• Internal access: named and restricted administrative access; consultation of content limited to support and incidents.
• Minimization at analysis providers: files read in place whenever possible; working copies automatically deleted within forty-eight hours; deletion propagated when the Customer deletes a video; transcription service configured with no retention of audio tracks or texts after processing.
• Operations: hosting with professional providers; security updates; database backups; technical logging.
• Development: code review, automated tests, test environments separate from production.
• Incidents: internal procedure for qualification, notification and lessons learned.

Appendix 3 — Sub-processors

The identity of each sub-processor is provided to the Customer on simple request at contact@unrush.io, unconditionally and free of charge. It is not published so as not to expose the technical architecture of the Service; this reservation cannot be invoked against the Customer or a supervisory authority.