Timeliner Data Processing Addendum

1. Definitions

Words not defined here have the meanings given in the Terms.

• “Data Protection Laws” means all data protection laws that apply to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation 2016/679 (“EU GDPR”), the EU GDPR as it forms part of UK law and the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), and the California Consumer Privacy Act as amended (“CCPA”).
• “Customer Personal Data” means personal data in User Content, or otherwise submitted to the Services by or for you, that Timeliner processes on your behalf as a processor. It includes the faces, voices, names and other information about people who appear in or are heard in videos, images and audio you upload, and the comments, annotations and feedback left in your workspace.
• “Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings given in the EU GDPR or UK GDPR. “Business”, “Service Provider”, “Sell” and “Share” have the meanings given in the CCPA.
• “Sub-processor” means a third party engaged by Timeliner that processes Customer Personal Data.
• “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, as revised from time to time.

2. Roles and scope

2.1 Roles. For Customer Personal Data, you are the Controller (or a Processor acting for your own clients) and Timeliner is your Processor (or Sub-processor). Where you act for your own clients, you confirm that your clients have authorized you to engage Timeliner on the terms of this DPA.

2.2 Data Timeliner controls. This DPA does not cover data Timeliner processes as a Controller for its own purposes, such as account sign-up and billing details, product analytics about how the Services are used, security logs, and sales and support communications. Our Privacy Policy covers that data.

2.3 Details of processing. The subject matter, nature, purpose and duration of the processing, and the types of personal data and Data Subjects, are described in Annex I.

3. Your instructions

3.1 Processing only on instructions. Timeliner processes Customer Personal Data only on your documented instructions, unless the law requires otherwise. If the law requires otherwise, we will tell you before the processing unless the law forbids us to.

3.2 What your instructions are. Your instructions are this DPA, the Terms, and the way you and your authorized users configure and use the Services. That includes uploading, storing, transcoding, streaming, sharing and downloading files; inviting team members and clients; and choosing to use or switch on features that process content. Those features include transcription, the in-app assistant and footage tagging. When you or an authorized user turns on or uses such a feature, you instruct Timeliner to process the relevant Customer Personal Data to provide it, including by sending it to the Sub-processors listed for that feature in Annex III.

3.3 Unlawful instructions. We will tell you if we believe an instruction breaks Data Protection Laws. We may then stop the processing concerned until you change or confirm the instruction.

3.4 Your responsibilities. You are responsible for having a lawful basis for the processing you instruct, and for giving any notices and obtaining any consents it needs. That includes notices and consents for the people who appear in or are heard in your footage. You are also responsible for the accuracy of Customer Personal Data and for not uploading special category data unless you have a lawful basis to process it with the Services.

4. No AI training on your content

4.1 Timeliner does not use Customer Personal Data or other User Content to train, retrain or fine-tune any artificial intelligence or machine-learning model, whether Timeliner's or a third party's.

4.2 The brand memory kept by the AI features (brand notes, pinned examples and patterns learned from a brand's approvals and review notes) is part of the Services you instruct under section 3.2. It is stored in your workspace, used only for that brand's work in your workspace, and can be edited or deleted by your supervisors and admins at any time. It is not a model and is never shared with other customers.

4.3 We require each AI Sub-processor in Annex III to process Customer Personal Data only to provide its service to us, and not to use it to train its own models.

4.4 Timeliner may create aggregated statistics about how the Services perform and are used (for example, how long a transcode takes or how often a feature is used). These statistics do not contain User Content and do not identify you, your users or any Data Subject. They are not Customer Personal Data.

5. Confidentiality

Timeliner ensures that everyone it authorizes to process Customer Personal Data is bound by a duty of confidentiality. Our staff access Customer Personal Data only to run the Services, to provide support you request, to fix a problem, to keep the Services secure, or where the law requires it.

6. Security

6.1 Timeliner implements and maintains the technical and organizational measures described in Annex II. They are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure and unauthorized access.

6.2 We may update these measures over time, provided the update does not reduce the overall level of protection.

6.3 You are responsible for the security settings you control, such as who you invite, the roles you give them, share link settings, download permissions and requiring two-step sign-in where your plan allows it.

7. Sub-processors

7.1 General authorization. You give Timeliner a general authorization to engage Sub-processors. The Sub-processors we use today are listed in Annex III and in Section 11.1 of our Privacy Policy.

7.2 Our obligations. We impose on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA. We remain responsible to you for each Sub-processor's performance of those obligations.

7.3 New Sub-processors. We will notify you at least 15 days before a new Sub-processor starts processing Customer Personal Data, by updating the list in our Privacy Policy and emailing your workspace admins. In an emergency, for example to keep the Services secure or available, the notice may be shorter, and we will notify you as soon as we can.

7.4 Objections. You may object to a new Sub-processor on reasonable data protection grounds by emailing contact@timeliner.io within that notice period. We will discuss your concern in good faith. If we cannot resolve it, you may terminate the affected Services by written notice, and we will refund any fees you prepaid for the period after termination.

8. Helping you meet your obligations

8.1 Data Subject requests. Most requests can be handled with tools in the Services: you can find, export, edit and delete content, comments and users in your workspace. If that is not enough, we will provide reasonable help for you to respond to Data Subjects exercising their rights. If a Data Subject contacts us directly about Customer Personal Data, we will pass the request to you and will not respond ourselves unless you tell us to or the law requires it.

8.2 Assessments and authorities. Taking into account the nature of the processing and the information available to us, we will provide reasonable help with data protection impact assessments and prior consultations with Supervisory Authorities that relate to the Services.

9. Personal Data Breaches

9.1 Timeliner will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. We will send the notice to your workspace admins by email.

9.2 The notice will describe, as far as we know them at the time, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available.

9.3 We will take reasonable steps to contain and investigate the breach and to reduce its effects.

9.4 Notifying you of a breach is not an admission of fault or liability.

10. Deletion and return

10.1 During your subscription, you can export or delete Customer Personal Data at any time using the Services.

10.2 After your subscription ends, files are deleted as described in Section 14 of the Terms. If you ask us in writing, at the end of your subscription or at any time after it, to delete all Customer Personal Data, we will do so within 30 days of your request. That includes the comments, projects and workspace structure we would otherwise keep in case you reactivate.

10.3 Copies in backups are deleted when the backups expire in the ordinary backup cycle. Until then they stay protected by this DPA and are not used for any other purpose.

10.4 We may keep Customer Personal Data where the law requires us to keep it. It stays protected by this DPA for as long as we keep it.

11. Audits and information

11.1 On written request, and no more than once a year (or more often where a Supervisory Authority requires it or after a Personal Data Breach), Timeliner will provide the information reasonably necessary to show that it complies with this DPA. This may take the form of answers to a written security questionnaire, a summary of our security measures and, once available, third-party audit reports.

11.2 If that information is not enough to show compliance, or a Supervisory Authority requires it, you may carry out an audit, yourself or through an independent auditor bound by confidentiality. You must give us at least 30 days' written notice, the audit must take place during normal business hours with minimal disruption, and you bear its cost. It does not include access to other customers' data or to information whose disclosure would compromise the security of the Services.

12. International transfers

12.1 Where data is processed. Timeliner is established in the United States, and Customer Personal Data is processed primarily in the United States, and in the other countries listed in Annex III.

12.2 EU transfers. Where Customer Personal Data subject to the EU GDPR is transferred to Timeliner in a country that does not have an adequacy decision, the SCCs are incorporated into this DPA as follows:

• Module 2 (controller to processor) applies where you are a Controller, and Module 3 (processor to processor) applies where you are a Processor.
• You are the data exporter and Timeliner is the data importer.
• Clause 7 (docking clause) applies.
• In Clause 9, Option 2 (general written authorization) applies, with the notice period in section 7.3 of this DPA.
• The optional wording in Clause 11 does not apply.
• In Clause 13, the competent Supervisory Authority is the one determined under Clause 13 by your establishment or representative.
• In Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland. In Clause 18, disputes are resolved by the courts of Ireland.
• Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

12.3 UK transfers. Where Customer Personal Data subject to the UK GDPR is transferred, the UK Addendum is incorporated into this DPA and amends the SCCs as set out in it. Table 1 is completed with the parties' details in Annex I. Table 2 refers to the SCCs modules and options chosen in section 12.2. Table 3 is completed by Annexes I to III of this DPA. In Table 4, either party may end the UK Addendum as allowed by its Section 19. The UK Addendum is governed by the laws of England and Wales.

12.4 Swiss transfers. Where Customer Personal Data subject to the FADP is transferred, the SCCs apply as set out in section 12.2, with these changes: references to the EU GDPR are read as references to the FADP; the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner; and “Member State” includes Switzerland, so that Swiss Data Subjects can enforce their rights there.

12.5 Data Privacy Framework. Where a Sub-processor is certified under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework, Timeliner may rely on that certification for onward transfers to it, in addition to or instead of the SCCs.

12.6 Onward transfers. Where a Sub-processor processes Customer Personal Data outside the EEA, the UK or Switzerland, Timeliner ensures that a valid transfer mechanism is in place.

13. CCPA

Where Timeliner processes Customer Personal Data that is personal information under the CCPA, Timeliner acts as your Service Provider and will not:

• Sell or Share it;
• keep, use or disclose it for any purpose other than providing the Services to you, or as the CCPA otherwise allows;
• keep, use or disclose it outside its direct business relationship with you; or
• combine it with personal information it receives from other sources, except as the CCPA allows.

Timeliner will comply with the CCPA's obligations for Service Providers and will tell you if it can no longer meet them.

14. Liability

Each party's liability arising out of or in connection with this DPA, including under the SCCs, is subject to the limitations of liability in the Terms, to the extent the law allows. Nothing in this DPA limits either party's liability to Data Subjects under the SCCs, or any liability that cannot be limited by law.

15. General

15.1 Order of precedence. If there is a conflict between the SCCs or the UK Addendum and this DPA, the SCCs or the UK Addendum prevail. If there is a conflict between this DPA and the Terms, this DPA prevails for the processing of Customer Personal Data.

15.2 Duration. This DPA lasts for as long as Timeliner processes Customer Personal Data on your behalf.

15.3 Changes. We may update this DPA to reflect changes in Data Protection Laws, in the Services or in our Sub-processors. An update will not reduce the overall protection this DPA gives Customer Personal Data. We will post the updated DPA at timeliner.io/dpa and notify workspace admins by email of material changes.

15.4 Governing law. Except where the SCCs or the UK Addendum require otherwise, this DPA is governed by the law that governs the Terms.

Annex I: Details of processing

A. Parties

• Data exporter: the Customer, at the address and contact details in its Timeliner account. Activities: using the Services to produce, review and deliver video and other creative work. Role: Controller, or Processor acting for its own clients.
• Data importer: Timeliner Inc., 8 The Green STE A, Dover, DE 19901, USA. Contact: contact@timeliner.io. Activities: providing the Services under the Terms. Role: Processor, or Sub-processor.

B. Data Subjects

• The Customer's team members and other authorized users.
• The Customer's clients and their staff who are invited as reviewers, or who use share links.
• People who appear in, or are heard in, videos, images and audio the Customer uploads.
• People who are named or described in briefs, comments, documents and other content the Customer submits.

C. Categories of personal data

• Names, email addresses, phone numbers, roles and profile photos of users and reviewers.
• Images and video showing people's faces and bodies, and audio recordings of their voices.
• Transcripts of audio, and comments, annotations, voice notes and timestamped feedback.
• Metadata saved in uploaded files, such as recording date, device and location.
• Briefs, documents and project information that contain personal data.
• Records of activity in the workspace, such as uploads, approvals and share link use.

D. Special category data

The Services are not designed to process special category data, and Timeliner does not use footage to identify individuals by their faces or voices. Content the Customer uploads may nonetheless reveal special category data (for example, health or religious belief visible in footage). The Customer decides whether to upload such content and is responsible for having a lawful basis for it. The measures in Annex II apply to all Customer Personal Data.

E. Frequency of transfer

Continuous, for as long as the Customer uses the Services.

F. Nature and purpose of processing

Hosting and storing files; transcoding and streaming video; sharing content with the reviewers the Customer chooses; collecting review comments and approvals; sending the notifications the Customer and its users set up; publishing to social accounts the Customer connects; support the Customer requests; and, when the Customer or its users turn them on or use them, transcription, the in-app assistant and footage tagging.

G. Duration

For the term of the Customer's subscription, and afterwards until deletion under section 10 of this DPA.

H. Transfers to Sub-processors

As listed in Annex III, for the same nature, purpose and duration as above.

Annex II: Technical and organizational security measures

• Encryption: files are encrypted at rest (AES-256), and all data is encrypted in transit (HTTPS/TLS).
• Access control in the Services: access is limited to the people a customer invites. Team roles (admin, supervisor, editor) and client roles (approver, commenter, viewer) decide what each person can do, down to a single brand or project. Database row-level security enforces workspace boundaries.
• Sign-in: sign-in by email and password, Google, or an email link; two-step sign-in with an authenticator app, with backup codes, available to every user and enforceable for a whole team on eligible plans.
• Sharing controls: share links can be set to expire, protected with a passcode and switched off at any time; customers decide whether reviewers can download, and can add review watermarks.
• Staff access: limited to staff who need it to run and support the Services, using individual accounts; administrative access to production systems is restricted and logged.
• Logging and monitoring: a workspace activity log records approvals, uploads, share links and role changes; server errors and uptime are monitored continuously.
• Resilience: managed infrastructure providers with redundant storage; database backups; deleted items held in a 30-day recovery window before permanent deletion.
• Separation of environments: development and testing use separate databases from production.
• Sub-processor management: written contracts with data protection terms for every Sub-processor, and a restriction on AI Sub-processors using customer content to train their models.
• Incident response: a process to investigate, contain and notify Personal Data Breaches under section 9.
• Compliance program: a SOC 2 compliance program is in progress (not yet certified; status at timeliner.io/security).

Annex III: Sub-processors

The current list is kept in Section 11.1 of our Privacy Policy, which prevails if it differs from this table.