Data Processing Agreement

This agreement under Article 28 GDPR is concluded between the customer ("controller") and Tutto Digital, Dario Tuttobene, Auf'm Kamp 3, 51381 Leverkusen, Germany ("processor"). It forms part of the Terms of Service and is concluded when the customer accepts them. On request we also sign it as a separate document: b2b@tutto-digital.com.

1. Subject and duration

The processor creates property marketing videos for the controller with ListingReels. In doing so it processes personal data that the controller provides. The agreement applies for as long as the processor processes personal data for the controller, and ends with the deletion of that data after the end of the main contract.

2. Nature and purpose, types of data, data subjects

Purpose: creating, storing and providing videos from listing material; creating and using the controller's own presenter (avatar); providing the account.

Types of data: photos and images (which may show people), names, job titles and contact details shown in videos or on the end card (for example phone, email, website, logo), the photo and name of an avatar, addresses and descriptions of properties, texts of scripts and captions, and account data of the controller's users (email address, name).

Data subjects: the controller's employees and agents, people shown in listing photos or named in listing material, and people whose photo the controller uses for an avatar.

Special categories of personal data (Art. 9 GDPR) are not processed on purpose. The avatar photo is not used to identify anyone.

3. Instructions

The processor processes the data only on documented instructions of the controller. The instructions are given by these terms and by the controller's use of ListingReels (for example uploading material, starting a video, deleting a video or avatar). Further instructions are given in text form. If the processor believes an instruction infringes data protection law, it informs the controller without delay. The processor may process data otherwise only where required by EU or member state law; it then informs the controller beforehand unless the law prohibits this.

4. Confidentiality

Persons authorised to process the data are bound to confidentiality. At present only the processor's owner has access to the server and the stored data.

5. Security of processing

The processor takes the technical and organisational measures in Annex 2 (Art. 32 GDPR). It may adapt them to technical progress as long as the level of protection is not reduced.

6. Sub-processors

The controller authorises the sub-processors listed in Annex 3. The processor informs the controller at least four weeks in advance by email of any intended addition or replacement of a sub-processor. The controller may object within this period for an important data protection reason; if no solution is found, either party may terminate the main contract at the time of the change. The processor imposes on each sub-processor data protection obligations equivalent to this agreement.

7. Transfers outside the EU

Some sub-processors are located in the USA. Transfers are based on the EU-U.S. Data Privacy Framework where the sub-processor is certified, and otherwise on the EU standard contractual clauses (Art. 46 (2) (c) GDPR).

8. Support for the controller

• Rights of data subjects: the processor supports the controller in answering requests (access, rectification, erasure and others). Most of them the controller can fulfil directly in the account, for example by deleting videos or the avatar. Requests addressed to the processor directly are forwarded to the controller.
• Data breaches: the processor informs the controller without undue delay, at the latest within 48 hours of becoming aware, of a personal data breach, with the information needed for a notification under Art. 33 GDPR.
• The processor supports the controller, where needed, with data protection impact assessments and consultations with the supervisory authority (Art. 35, 36 GDPR).

9. Deletion and return

Free previews and their material are deleted automatically after 30 days. Intermediate files (photos, audio, presenter clips) are deleted once a video is finished. After the end of the main contract, the controller can download its videos for 30 days; the processor then deletes all personal data of the controller, including the avatar at HeyGen, unless the law requires it to be kept. On request the processor confirms the deletion in text form.

10. Information and audits

The processor provides the information needed to demonstrate compliance with Art. 28 GDPR. The controller may carry out audits, or have them carried out by an auditor bound to confidentiality, after reasonable notice (usually four weeks), during business hours and without disrupting operations. Audits are first carried out by requesting information in writing.

11. Liability and final provisions

Liability is governed by Art. 82 GDPR and otherwise by the Terms of Service. In case of conflict, this agreement takes precedence over the Terms of Service in matters of data protection. German law applies.

Annex 1: Details of processing

See section 2.

Annex 2: Technical and organisational measures

Physical access and hosting

• The server is operated in a data centre of Hetzner Online GmbH in Germany, certified to ISO/IEC 27001, with access control, video surveillance and staff on site.

System and data access

• Administrative access to the server only for the owner of the processor, with personal authentication.
• Access to the providers' accounts (AI services, payments) only for the owner, with their own credentials; API keys are stored only on the server, not in the browser.
• Every video and upload is stored under a random, non-guessable identifier; there is no listing of other customers' videos.
• Expensive functions only accept requests from the ListingReels website and are limited per visitor and day.

Transfer

• All connections to the website are encrypted with TLS 1.2 or 1.3; the connections to the sub-processors also use TLS.
• Each sub-processor receives only the data needed for its step (for example, the voice service only receives the script text).

Input control and logs

• Web server logs (IP address, time, requested page) are kept for 14 days for security purposes and then deleted.
• For the avatar, the confirmed declarations of the controller are stored with their version and time.

Availability

• Video creation continues automatically after a server restart.
• Operating system security updates are installed automatically.
• The controller should keep its own copies of downloaded videos; the processor does not owe a backup of stored videos.

Separation, minimisation and deletion

• Data is processed only for creating the controller's videos and not for other purposes, in particular not for training AI models by the processor.
• Automatic deletion as described in section 9; the avatar and its photo can be deleted by the controller at any time, also at HeyGen.

Annex 3: Sub-processors

Payments are processed by Stripe Payments Europe Ltd. (Ireland) and login with Google by Google Ireland Ltd. as independent controllers, not as sub-processors.