Data processing addendum

Draft — written by the SceneRecap team for launch review. Have qualified counsel review before public launch.

This DPA forms part of the Terms for customers who are controllers of personal data under the GDPR/UK GDPR and use SceneRecap to process it. It applies automatically to Team and Enterprise workspaces; Pro customers may request a signed copy.

Roles

You are the controller of the personal data contained in your recordings; SceneRecap is the processor and acts only on your documented instructions (the product's features and settings).

Processing details

• Subject matter: screen recordings, interaction event logs, transcripts and AI-derived outputs.
• Duration: for the term of your account, plus the deletion periods in the privacy policy.
• Categories of data subjects: your users and any individuals visible or audible in recordings.
• Categories of data: anything shown on screen or spoken; navigation metadata; email addresses of your users.

Our obligations

• Confidentiality of personnel; access limited to what operating the service requires.
• Technical and organisational measures described on the security page.
• Sub-processors listed at /legal/subprocessors, with 30 days' notice of additions and a right to object.
• Assistance with data-subject requests, breach notification without undue delay, and deletion or return of data at termination.
• International transfers covered by the EU Standard Contractual Clauses (or UK Addendum) where applicable; primary hosting region is europe-west3 (Frankfurt).

Audit

On reasonable request we provide our security documentation and, for Enterprise customers, support customer audits at most annually.