Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between IndySoft, Inc. ("IndySoft") and the customer accepting the Terms of Service ("Customer"), and applies where IndySoft processes personal data on Customer’s behalf in providing VidSeen.

1. Roles

Customer is the data controller of personal data in its recordings, viewer lists, and team roster; IndySoft is the data processor. IndySoft processes such data only on Customer’s documented instructions — operating the Service as configured by Customer is such an instruction.

2. What is processed

Names, email addresses, and account identifiers of team members and viewers; the content of recordings and screenshots Customer uploads (which may contain personal data Customer chooses to include); viewing activity; and support communications. Processing lasts for the duration of the subscription plus the deletion window below.

3. Confidentiality and security

IndySoft limits access to personnel who need it to operate the Service and binds them to confidentiality. Technical and organizational measures are described on the security page and include encryption in transit and at rest, role-based access, secret management in Azure Key Vault, continuous backups, and availability monitoring.

4. Subprocessors

Customer authorizes the subprocessors listed on the security page. IndySoft will update that list before adding a subprocessor; Customer may object on reasonable data-protection grounds within 30 days of an update.

5. International transfers

Data is stored in the United States. Where personal data of EEA, UK, or Swiss individuals is transferred, the parties rely on the subprocessors’ compliance frameworks (including the EU–US Data Privacy Framework where certified) and, where required, standard contractual clauses incorporated by reference.

6. Assistance and incidents

IndySoft will assist Customer with data subject requests it cannot fulfil directly, and will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data.

7. Deletion

On termination, or earlier on request, IndySoft deletes Customer personal data within 30 days, except copies retained for up to 14 additional days in backups, which are then purged on schedule.

8. Audit

IndySoft will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party audits of its cloud providers.

To execute this DPA, email support@vidseen.com from an admin account naming your organization; we will countersign and return it.