Data Processing Agreement

This Data Processing Agreement ('DPA') applies when Dubformer processes personal data on your behalf as a data processor. You are the data controller; Dubformer acts as data processor.

This DPA supplements the Terms of Use and applies to all personal data processed through Dubformer Studio.

Dubformer processes personal data solely to provide the dubbing services described in the Terms of Use, and only on your documented instructions.

If we believe an instruction violates GDPR or other applicable data protection law, we will inform you without undue delay.

Dubformer implements appropriate technical and organizational measures to protect personal data, including encryption in transit and at rest, access controls, regular security testing, and incident response procedures.

We maintain SOC 2 Type II compliance and undergo regular third-party security audits.

Dubformer engages subprocessors to assist in providing the service. We maintain a list of current subprocessors and will notify you before adding new subprocessors.

You may object to a new subprocessor within 30 days of notification. Each subprocessor is bound by data protection obligations equivalent to those in this DPA.

Dubformer assists you in responding to data subject requests (access, rectification, erasure, portability, restriction, objection) through appropriate technical and organizational measures.

Dubformer will notify you of a personal data breach without undue delay, and in any event within 72 hours of becoming aware of it.

Notification includes the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

Where personal data is transferred outside the EEA, Dubformer ensures appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

You have the right to audit Dubformer's compliance with this DPA. Audits are conducted at reasonable intervals and with reasonable advance notice, at your expense.

Dubformer will make available all information necessary to demonstrate compliance and allow for audits and inspections.

This DPA remains in effect for the duration of data processing. Upon termination, Dubformer will delete or return all personal data within 30 days, unless retention is required by law.