Data Processing Agreement

Overview

This Data Processing Agreement ("DPA") applies where a business customer ("Customer", "Controller") uses Velocity to process personal data on the Customer's behalf. It supplements our Terms of Use and reflects Article 28 GDPR. Velocity is provided by Kevin Klein, Gronau (Westfalen), Germany ("Velocity", "Processor", "we", "our", or "us"). To put this DPA in place for your organisation, contact legal@velocitystreaming.io; we can countersign on request.

Roles

The Customer is the controller for the personal data of the people it brings into Velocity (its Hosts, Guests, Viewers, Listeners, Team Members, and customers). Velocity is the processor for that data. Velocity remains the independent controller for its own account, security, support, and business data, which is governed by our Privacy Policy rather than this DPA.

Subject matter and duration

The subject matter is the processing of personal data necessary to provide Velocity to the Customer. Processing lasts for as long as the Customer uses the service and until data is deleted or returned in accordance with this DPA.

Nature and purpose of processing

Hosting and operating live video sessions and streams, producing and storing recordings where the Customer's Host starts them, delivering live streams, and providing workspace features (storage, whiteboard, IDE, chat), all as instructed by the Customer through its use of the service.

Categories of data subjects

The Customer's Hosts, Team Members, Guests, Viewers, Listeners, and other participants or customers who take part in the Customer's sessions or use its workspace.

Categories of personal data

• identifiers such as display names, account and team email addresses;
• audio, video, screen-shared content, and other session content, including in recordings;
• chat and messages;
• files and workspace content (uploads, whiteboards, code files);
• technical and connection data such as IP address and session metadata.

Special categories of data are not requested by the service; the Customer controls what it processes.

Processor obligations

• process personal data only on the Customer's documented instructions, including for transfers, unless required by law (in which case we inform the Customer where permitted);
• ensure that persons authorised to process the data are bound by confidentiality;
• implement the technical and organisational measures set out in our Technical & Organisational Measures (Art. 32 GDPR);
• assist the Customer, taking into account the nature of processing, in responding to data subject requests (Arts. 12 to 23) and in meeting obligations under Arts. 32 to 36;
• notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data;
• make available information needed to demonstrate compliance and allow for and contribute to reasonable audits (see below); and
• delete or return personal data at the end of processing, as set out below.

Subprocessors

Velocity uses approved categories of service providers necessary to operate the platform, engaged under contracts imposing data protection obligations comparable to this DPA. Business customers may request additional provider information for their data protection review. We will inform the Customer of intended changes to the providers we use so the Customer has the opportunity to object on reasonable data protection grounds.

Where data is processed

Velocity operates its primary application systems and storage in European regions. Where additional provider information is required for the Customer's own data protection review, Velocity can provide it on request.

Deletion and return

On termination, and at the Customer's choice, we delete or return the personal data processed on the Customer's behalf and delete existing copies, unless storage is required by law. Recordings and content are also subject to the retention and deletion behaviour described in our Privacy Policy.

Audit and cooperation

On reasonable request and with reasonable notice, we will provide the information necessary to demonstrate compliance with Art. 28 GDPR, including our TOMs and subprocessor details, and will cooperate with the competent supervisory authority. Audits are limited to what is proportionate and must respect the confidentiality and security of our other customers.

Contact

Data protection contact: legal@velocitystreaming.io.