Data Processing Agreement

1. Parties, scope, conclusion

1.1 This agreement governs the processing of personal data that Droidtech e.K., owner Michael Rauen, Auf der Eichelsbach 19, 54533 Hasborn, Germany (provider, processor), carries out on behalf of a customer (controller) when the customer uses the Castfold platform. It supplements the Terms of Service (terms) and the usage agreement for the account. In case of conflict, this agreement prevails in matters of data protection.

1.2 The agreement applies to customers who are businesses (Section 14 of the German Civil Code, BGB) and use Castfold for personal data of third parties, such as data of their employees, their clients or persons who can be seen or heard in uploaded or generated videos. Consumers do not need it. Where the customer manages channels on behalf of its own clients, the customer is their processor and the provider is a sub-processor; the customer warrants that its clients have approved the provider’s engagement.

1.3 The provider offers this agreement as a standard contract. The customer accepts it by having the account owner declare by e-mail from the address stored in the account to mail@castfold.com that this agreement in the version published at castfold.com/dpa/ shall apply; where the application offers a confirmation, that confirmation suffices as well. The provider confirms the conclusion by e-mail with the date and version; this satisfies the electronic form under Art. 28(9) GDPR. The agreement covers all accounts of which the customer is the account owner. It is free of charge.

1.4 Data that the provider processes under its own responsibility (account and member data, billing, security, logs) is governed by the privacy policy, not by this agreement.

2. Subject matter, duration, nature and purpose, data types, data subjects

2.1 The subject matter is the provision of Castfold: storing, processing and transmitting the customer’s channel and video data, video files and studio files, retrieving and evaluating YouTube data, and generating content with AI models. Annex 1 describes the nature, purpose, data types and data subjects.

2.2 The agreement runs for as long as the usage agreement for the account exists and ends when the account is deleted. The obligations under sections 4 and 9 survive.

2.3 The provider processes the data in the European Union. Sub-processors and transfers to third countries are governed by section 6, section 11 and Annex 3.

3. Instructions

3.1 The provider processes personal data only on documented instructions from the customer (Art. 28(3)(a) GDPR). Instructions are this agreement, the terms, the use of the functions and settings of the application, and jobs submitted through the machine API. Further instructions are issued by the account owner in text form to mail@castfold.com; the provider confirms them.

3.2 If the provider considers an instruction unlawful, it informs the customer without undue delay and may suspend execution until the customer confirms or changes the instruction (Art. 28(3) sentence 3 GDPR).

3.3 If an instruction goes beyond the scope of service described in the terms, the provider may charge the documented effort; it states the cost in advance.

3.4 The provider does not use the customer’s data for its own purposes, does not pass it on to third parties and does not use it to train AI models; this also applies to the model providers listed in Annex 3. It processes the data only for as long as the service and the deletion rules under section 9 require.

4. Confidentiality

The provider grants access to the customer’s data only to persons bound to confidentiality (Art. 28(3)(b) GDPR). The owner has access to the production systems; other persons receive access only after a written confidentiality undertaking. The provider accesses the customer’s content only when the customer requests it for support, when it is necessary for the security of the platform (for example when investigating abuse) or when required by law. The confidentiality obligation survives the end of the agreement.

5. Security of processing

5.1 The provider implements the technical and organisational measures set out in Annex 2 (Art. 32 GDPR). It may adapt them to the state of the art as long as the level of protection does not decrease; material changes are published in Annex 2.

5.2 The customer has reviewed the measures and considers them appropriate for the processing described in Annex 1. If the customer requires further measures, the parties agree them separately.

6. Sub-processors

6.1 The customer gives general authorisation for the provider to engage the sub-processors listed in Annex 3 (Art. 28(2) sentence 1 GDPR). The provider binds every sub-processor by contract to the same data protection obligations that apply to the provider under this agreement (Art. 28(4) GDPR), reviews the sub-processor before engagement and remains liable to the customer for the sub-processor’s performance.

6.2 If the provider intends to add or replace a sub-processor, it informs the account owner by e-mail at least 30 days before the engagement begins and publishes the updated Annex 3 at castfold.com/dpa/. The customer may object to the change within 14 days of receipt of the notice on legitimate data protection grounds. If the customer does not object, the engagement is deemed authorised. In case of an objection the parties seek a solution; if none is found before the announced start, either party may terminate the affected service with 30 days’ notice; unused paid credit is refunded under section 7b.8 of the terms.

6.3 If a sub-processor must be replaced immediately for security reasons, the provider may engage the replacement before the notice period ends and informs the customer without undue delay; the right to object under 6.2 remains.

6.4 Service providers the provider uses without access to the customer’s data (for example software maintenance without data access) and parties that process data under their own responsibility (payment service provider, Google LLC in the context of the YouTube API) are not sub-processors.

7. Rights of data subjects

7.1 The provider assists the customer with appropriate measures in fulfilling the rights of data subjects (Art. 12 to 22 GDPR; Art. 28(3)(e)). The customer can handle access, rectification, erasure and data portability for its data largely on its own in the application: changing and deleting data, disconnecting channels, deleting videos and files, exporting data as a file.

7.2 If a data subject contacts the provider directly, the provider forwards the request to the account owner within three working days and does not answer it itself unless required by law.

7.3 Where assistance goes beyond the functions of the application, section 3.3 applies.

8. Personal data breaches, data protection impact assessment

8.1 If the provider becomes aware of a personal data breach affecting the customer’s data, it notifies the account owner by e-mail without undue delay and at the latest 48 hours after becoming aware. The notification contains, as far as known, the nature and extent of the breach, the categories of data and data subjects concerned, the likely consequences, the measures taken and proposed, and a contact point (Art. 33(3) GDPR). Missing details are provided subsequently.

8.2 The provider assists the customer with the obligations under Art. 32 to 36 GDPR, in particular with notifications to the supervisory authority and communications to data subjects, and with a data protection impact assessment insofar as it concerns the processing described in Annex 1. For this purpose it provides the information in this agreement and its annexes.

9. Deletion and return

9.1 The customer can export its data as a file in the application at any time (Art. 28(3)(g) GDPR). Video files are not included; the customer backs them up itself (terms 11.5).

9.2 During the term the provider deletes according to the rules described in the terms and the privacy policy: video files of scheduled or published videos at the latest 48 hours after the transfer to YouTube, unscheduled uploads 30 days after the upload, dormant studio working files after 30 days, data retrieved through the YouTube API after 30 days without refresh, disconnected channels within 30 days. These rules are instructions of the customer.

9.3 When the account is deleted, the provider deletes all of the customer’s data without undue delay, including the objects in object storage and the copies held by sub-processors, unless they have already deleted them. Excluded is data the provider must retain by law (section 10 of the privacy policy); such data is blocked for the duration of the retention obligation and then deleted. Database backups are overwritten after 14 days, off-site encrypted backups after 30 days. On request the provider confirms the deletion in text form.

10. Evidence and audits

10.1 The provider makes available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR (Art. 28(3)(h)). This includes this agreement with its annexes, information in text form, and evidence and certificates of the sub-processors as far as they provide them.

10.2 If this evidence is insufficient in an individual case, the customer may carry out an audit once per calendar year, with 30 days’ notice, during normal business hours and without disrupting operations, either itself or through an auditor bound to confidentiality. Audits at sub-processors take place through their audit procedures. The customer bears the cost of the audit unless it reveals a material breach by the provider.

10.3 The provider submits to audits by a supervisory authority; it informs the customer of authority requests concerning the customer’s data to the extent permitted.

11. Transfers to third countries

The provider itself processes the customer’s data only in the European Union. A transfer to a third country takes place only through sub-processors listed in Annex 3 and only with the safeguards stated there (Art. 44 to 46 GDPR). The customer authorises these transfers; for transfers to the USA to recipients certified under the EU-US Data Privacy Framework, the European Commission’s adequacy decision applies (Art. 45 GDPR), supplemented by the EU standard contractual clauses (Art. 46(2)(c) GDPR).

12. Obligations of the customer

12.1 The customer is responsible for the lawfulness of the processing, in particular for the legal basis, the information of data subjects and the rights in uploaded content. The customer does not upload data or enter data into AI features for which it has no legal basis (terms 9). Special categories of personal data (Art. 9 GDPR) are processed through Castfold only if the customer has a legal basis for it and informs the provider in advance.

12.2 The customer’s contact person is the account owner; the customer keeps that person’s e-mail address up to date in the account. Notices from the provider under this agreement are sent to that address.

12.3 The customer informs the provider without undue delay if it notices errors or irregularities in the processing.

13. Liability, changes, final provisions

13.1 Liability is governed by Art. 82 GDPR and section 10 of the terms.

13.2 The provider may amend this agreement when the law, case law, sub-processors or features change. It announces changes at least 30 days before they take effect by e-mail to the account owner and publishes the new version at castfold.com/dpa/. If the customer does not object before the changes take effect, the new version applies; the provider points this out in the announcement. If the customer objects, the previous version continues to apply and either party may terminate the usage agreement with 30 days’ notice. Changes to Annex 3 are governed solely by section 6.

13.3 The law of the Federal Republic of Germany applies. The contract language is German; the English version is for information. Should a provision be invalid, the remainder of the agreement remains valid; the statutory provision replaces the invalid one.

Annex 1: Description of the processing

Subject matter and purpose. Operating the customer’s YouTube channels with Castfold: connecting channels via Google OAuth, transferring branding, scheduling and uploading videos, retrieving and evaluating analytics, generating concepts, metadata, translations, images, videos, voices and music with AI models in the video studio, storing video files and studio files until the deletion deadline, providing a machine API, data export.

Nature of the processing. Collection through the YouTube API and through the customer’s input, storage, organisation, evaluation, alteration (editing, translation, generation), transmission to YouTube and to the sub-processors listed in Annex 3, deletion.

Data types.

• Channel and video data from the YouTube API: channel id, title, handle, description, keywords, banner, video id, title, description, tags, status, publish time, views, likes, comment count, daily values for views, watch time, subscribers, estimated revenue and audience retention (no data on individual viewers)
• OAuth access and refresh tokens of the connected Google account (encrypted)
• The customer’s video files, thumbnails, images, narration tracks, music and studio working files, including persons depicted or audible in them
• Input into AI features (keywords, hints, scripts, questions) and the generated results
• Member data of the account: name, e-mail address, role, permissions, times of use
• Machine API data: jobs, access keys (hashed), webhook addresses
• Support communication

Data subjects. Employees and contractors of the customer, clients of the customer and their employees (for agencies), persons recognisable in the customer’s videos, images or audio recordings, the customer’s contact persons towards the provider. Viewers of the channels are included only in aggregated statistics without personal reference.

Duration. Term of the usage agreement; deletion periods under section 9.

Annex 2: Technical and organisational measures (Art. 32 GDPR)

Confidentiality

• Physical access. The application, the database and the working buffer run on a dedicated virtual server at a hosting provider in Germany (Annex 3) in an access-controlled data centre. Video files and studio files reside in the object storage listed in Annex 3 in data centres in the European Union.
• System access. Server administration only via SSH with personal keys; no password login; the application user has no administrative rights on the server. Access only by the owner. The database is not reachable from the internet (local only). Sign-in to the application is passwordless with one-time codes by e-mail; sessions use signed tokens whose refresh tokens are stored only as hashes. Machine API access keys are stored as hashes. Failed attempts and bulk requests are rate-limited.
• Data access. Roles and permissions per account (owner, administrator, members with individual permissions); each account sees only its own data (tenant separation through fixed account filters in every database query). Operator functions are restricted to the platform administrator and logged. Support access only under section 4.
• Separation. Separate environments for development and operations; test accounts are marked and not linked to customer data. Demo accounts cannot send data to YouTube.
• Pseudonymisation and encryption. All connections exclusively via TLS (HTTPS). OAuth tokens are encrypted with AES-256; the keys are kept separately from the database and never appear in the interface, logs or exports. Objects in object storage carry only internal identifiers as names (no titles, no names) and can be retrieved exclusively through signed URLs with short validity (15 minutes for uploads, 30 minutes for previews); the storage is not public. Media URLs of the application are signed. Backups leave the server only encrypted with AES-256.

Integrity

• Input control. Consents in the purchase flow and in the studio, cancellations, deletions, changes to permissions and connections are recorded in the account log with time and user. Outgoing e-mails are logged without content for 90 days. AI calls are logged with time, model and cost.
• Transfer control. Transfers to YouTube only with the permission granted by the customer and after the customer’s express confirmation of the channel; revocable at any time. Webhooks only to verified addresses. Browser uploads are checked for size, file type and completeness before acceptance.

Availability and resilience

• Backup. Full backup of the database daily, kept 14 days on the server; the three most recent are always retained. In addition, daily retrieval via SSH to a separate, access-protected storage location outside the server environment in Germany, in lockable business premises; access only for the owner; stored there only encrypted (AES-256 via GnuPG), key kept separately; unencrypted only during the integrity check; retained 30 days. Restoration is tested.
• Operations. Monitoring of the application every five minutes; alerts to the operator on outages, storage limits and cost overruns. If the object storage fails, all other functions continue. Video files are transient; after the transfer the source is YouTube.
• Deletion. Automated deletion runs for video files, uploads, studio files, exports, logs and API data according to the periods in section 9; account deletion with confirmation by code, irreversible, including deletion of all of the account’s objects in object storage.

Procedures for regular review

• Automated tests before every release, including checks of tenant separation, permissions and the isolation of demo accounts. Security review of new features with data access before release. Regular updates of operating system, runtime and dependencies. The provider reviews this annex at least once a year and upon material changes.

Annex 3: Approved sub-processors

Sub-processor	Address	Service	Data concerned	Place of processing	Safeguard for third-country transfers
Host Europe GmbH	Hansestraße 111, 51149 Cologne, Germany	Operation of the virtual server with application, database and working buffer (hosting)	All data under Annex 1 except the files held in object storage	Data centre in Germany	No third-country transfer; data processing agreement under Art. 28 GDPR
ALL-INKL.COM – Neue Medien Münnich, owner René Münnich	Hauptstraße 68, 02742 Friedersdorf, Germany	E-mail delivery (sign-in codes, invitations, notifications, order confirmations)	E-mail address, subject and content of the message	Germany (data centres in Dresden)	No third-country transfer; data processing agreement under Art. 28 GDPR
Google Cloud EMEA Limited	70 Sir John Rogerson’s Quay, Dublin 2, Ireland	AI models via Google Cloud Vertex AI (text, translation, image, video, voice, music)	Input into AI features, excerpts of channel data and analytics as context, image prompts, generated results; not used for training	Global endpoint of Vertex AI: Google selects the processing data centre, including outside the European Union, in particular the USA; video models via us-central1 (USA)	Google Cloud Data Processing Addendum with EU standard contractual clauses (Art. 46(2)(c) GDPR); Google LLC and its US subsidiaries are certified under the EU-US Data Privacy Framework (Art. 45 GDPR); Google’s sub-processors: https://cloud.google.com/terms/subprocessors
Cloudflare, Inc.	101 Townsend St., San Francisco, CA 94107, USA; European contact: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany	Object storage Cloudflare R2 for video files, raw thumbnail files and working files of the video studio; direct upload from the browser and previews through signed URLs	The customer’s video and studio files with possible personal content (image, voice); technical object details (internal identifiers, size, time, file type); IP address, time and browser identifier of users during direct upload and previews	Files exclusively in the European Union (bucket with EU jurisdiction); object details, access data, usage metrics, support and operations worldwide, including the USA	Adequacy decision on the EU-US Data Privacy Framework (Cloudflare, Inc. is certified; Art. 45 GDPR); in addition EU standard contractual clauses, Module 3, in the Cloudflare Data Processing Addendum (Art. 46(2)(c) GDPR); Cloudflare’s sub-processors: https://www.cloudflare.com/gdpr/subprocessors/

Stripe Payments Europe, Ltd. (payments and payouts) and Google LLC or Google Ireland Limited in the context of the YouTube API are independent controllers, not sub-processors; details are set out in the privacy policy.