Data Processing Addendum

This Data Processing Addendum (the “DPA”) forms part of the agreement between Kadrix operator (details to be confirmed) (the “Processor”) and the customer using the Kadrix service (the “Controller”) when the Controller’s materials contain personal data of third parties, for example audience messages, website form submissions, or people shown in uploaded video. It is intended to meet GDPR Art. 28(3). The English version is the primary text.

1. Subject and duration

1.1. The Processor processes personal data on behalf of the Controller to provide the Service, for as long as the Controller uses it and until deletion under section 8.

1.2. Nature, purpose, data types and data subjects are set out in Annex 1.

2. Instructions

2.1. The Processor processes personal data only on the Controller’s documented instructions, which are the agreement, this DPA and the Controller’s use of the Service, unless the law requires otherwise; in that case the Processor informs the Controller first unless the law prohibits it.

2.2. The Processor informs the Controller if it believes an instruction infringes data protection law.

2.3. The Controller is responsible for the lawfulness of the data it uploads and for having a legal basis for it.

3. Confidentiality

Persons authorised to process the data are bound by confidentiality.

4. Security

The Processor applies the technical and organisational measures in Annex 3 and may improve them, provided the level of protection does not decrease.

5. Sub-processors

5.1. The Controller gives general authorisation to engage sub-processors. The categories in use are listed in Annex 2.

5.2. The Processor binds sub-processors to data protection obligations equivalent in substance to this DPA and remains responsible for them.

5.3. [How the Controller is informed about sub-processors and changes to them, and how it may object: to be confirmed.]

5.4. Voice and image. For speech synthesis (tts) and digital presenter (avatar) tasks, voice recordings, images and the text to be spoken are passed to the providers of those tasks without masking, and only on the Controller’s separate consent. [Form and recording of this consent: to be confirmed; draft for legal review.] These features are not available during the free trial.

6. International transfers

[Transfer mechanism under GDPR Chapter V for sub-processors outside the European Economic Area: to be confirmed.]

7. Assistance, breaches and audits

7.1. The Processor assists the Controller with data subject requests, using the export and deletion tools of the Service where possible.

7.2. The Processor notifies the Controller of a personal data breach without undue delay after becoming aware of it.

7.3. The Processor assists with data protection impact assessments and consultations with supervisory authorities, as far as reasonable given the nature of processing.

7.4. The Processor makes available the information needed to demonstrate compliance and allows for audits. [Audit procedure: to be confirmed.]

8. Deletion and return

When the agreement ends, the Controller may export its data in the dashboard. After account deletion the data is erased within 30 days. Backups rotate within 30 days. Records the law requires us to keep are retained for the required period.

Annex 1. Processing details

Subject matter: hosting, processing, generation and publishing of the Controller’s materials.
Data subjects: people shown or mentioned in materials; audience members; visitors who submit website forms; team members of the Controller.
Data types: names, contact details, images, voice, comments and messages, and anything else the Controller uploads.
Special categories: not intended. [Treatment of biometric data in digital presenter and voice features: to be confirmed.]

Annex 2. Categories of sub-processors

hosting, data storage and compute providers;
providers of text, speech, image and video processing based on machine-learning models;
email and messaging delivery providers;
payment service providers.

Annex 3. Technical and organisational measures

encrypted connections; encryption of secrets and access tokens in the database; password hashing;
role-based access, two-factor authentication, activity logging;
separation of customer data by workspace;
masking of email addresses, phone numbers and payment card numbers in prompts before they are sent for AI processing, except for the tasks in clause 5.4;
encrypted backups with limited retention.

Operator details

Legal name: Kadrix operator (details to be confirmed)
Tax ID: 5609206529
Registration number: 1245600009742
Address: 460047, Оренбургская обл., г. Оренбург, ул. Салмышская, д. 12, кв. 56
Email: support@kadrix.pro
Website: https://kadrix.pro