Data Processing Agreement

We process personal data on your behalf only to provide the Service, for as long as you have an active account, or as otherwise agreed in writing.

We process personal data as necessary to host, store, and process the content you upload (briefs, brand assets, feedback) and to render the videos you direct — no other purpose.

The personal data processed depends entirely on what you choose to upload or include in your projects — typically, this may include names, images, or likenesses appearing in logos, screenshots, or brand assets you provide. The data subjects are whoever appears in or is identified by that content, most commonly your own employees, customers, or business contacts.

As processor, we:

• Process personal data only on your documented instructions, including regarding international transfers, unless required to do otherwise by EU or Lithuanian law.
• Ensure our personnel are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures (see our Privacy Policy, Section 10).
• Do not engage a sub-processor without prior general authorization, and remain liable for any sub-processor’s performance.
• Assist you, insofar as reasonably possible, in responding to data subject requests and in meeting your own GDPR obligations (security, breach notification, impact assessments).
• Notify you without undue delay after becoming aware of a personal data breach affecting your data.
• At your choice, delete or return all personal data at the end of the relationship, and delete existing copies unless retention is required by law.
• Make available to you the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits, subject to reasonable notice and confidentiality.

You authorize us to engage the following categories of sub-processors to provide the Service, each bound by data protection terms consistent with this DPA:

• Cloud hosting and compute — [provider name], for running the Service’s application and rendering infrastructure.
• Object storage — [provider name], for storing uploaded assets and rendered video output.
• Database and authentication — [provider name], for account data and project records.
• Payment processing — [provider name], for billing (transaction data only, not full card numbers).

We will give you reasonable notice before adding or replacing a sub-processor, so you can object on reasonable data-protection grounds.

Where a sub-processor is located outside the European Economic Area, we ensure the transfer is protected by an adequate safeguard, such as the European Commission’s Standard Contractual Clauses.

Liability under this DPA is subject to the limitation of liability set out in our Terms of Service.

This DPA remains in effect for as long as we process personal data on your behalf under the Terms of Service, and terminates automatically when that processing ends.

Questions about this DPA, or a request for a signed copy, can be sent to legal@vellym.com, or by post at [registered office address], Lithuania.