Data Processing Agreement

This agreement is between you, the editor using EditorFlow (the “controller”), and Scucci Projects, KvK 95910352, Ruijgenhoeksepolder 50, 3453 NG De Meern (“we”, the “processor”). It applies whenever we process personal data on your behalf while providing EditorFlow, and forms part of our Terms of Service. By using EditorFlow you agree to it; no signature is needed. If you need a signed copy for your own records, email support@editorflow.app.

1. Subject and duration

We process personal data only to provide EditorFlow to you, for as long as your account is open, plus the deletion period in section 12.

2. Nature and purpose

Storing, organising and displaying your client records; generating proposals, contracts and invoices; running the client portal; hosting review copies and final files you upload; and sending the emails you trigger or switch on.

3. Types of personal data

• Contact details: names, email addresses, phone numbers, company details.
• Project and communication content: notes, feedback, drawings on video frames, testimonials.
• Contract data: the name typed as a signature, the time, and the IP address it was signed from.
• Invoice data: amounts, invoice details, payment status.
• Portal usage: IP addresses and portal access-code attempts.
• Uploaded files, which may show or contain the voices of people who appear in your footage.

4. Categories of data subjects

Your clients and prospective clients, the people who act on their behalf, and people appearing in footage you upload.

5. Your instructions

We process personal data only on your documented instructions — given through your use of EditorFlow, your settings, and these terms — unless EU or Dutch law requires otherwise. In that case we tell you first, unless the law forbids it. If we believe an instruction breaks data protection law, we tell you.

6. Confidentiality

Anyone we authorise to process the data is bound to confidentiality.

7. Security

We take appropriate technical and organisational measures, including:

• Row-level security in the database, isolating each editor’s data and each client portal’s data.
• Encryption of data in transit.
• Short-lived signed links for videos and files.
• Rate limiting and bot protection on sign-in, signup, password reset, forms and portal login codes, and a login code sent by email before a client portal opens on a new device.
• Database and server functions hosted in the EU (Ireland).

8. Sub-processors

You give us general authorisation to use the sub-processors listed in our Privacy Policy. We email you at least 30 days before adding or replacing one. If you object, you can close your account before the change takes effect. We bind every sub-processor to data protection obligations equivalent to these, and remain responsible for them.

9. Assistance

Taking into account the nature of the processing, we help you respond to requests from data subjects — for example by exporting, correcting or deleting their data — and with data protection impact assessments and prior consultations where the law requires them.

10. Personal data breaches

If we become aware of a personal data breach affecting your data, we notify you without undue delay and, where feasible, within 48 hours, with the information you need to meet your own obligations, as far as it is available to us.

11. Transfers outside the EEA

Where a sub-processor processes personal data outside the European Economic Area, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

12. Deletion and return

When your account closes, we delete the personal data we process for you within 30 days. Before closing, you can ask us for a copy in a machine-readable format. Data the law requires us to keep, such as invoices for 7 years, is kept for that period and nothing else.

13. Information and audits

We make available the information needed to show we comply with this agreement. You may request an audit with reasonable notice, at your own cost, no more than once a year, and subject to confidentiality; where possible we answer it with existing documentation or our providers’ certifications.

14. Liability and precedence

Liability under this agreement follows the Terms of Service. Where the Terms and this agreement conflict on the processing of personal data, this agreement prevails.

15. Contact

Questions about this agreement: support@editorflow.app, Scucci Projects, Ruijgenhoeksepolder 50, 3453 NG De Meern, KvK 95910352.