Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Use between Turncraft Private Limited ("Turncraft", "we"), which runs Reeltopus, and the customer that accepts it ("Customer", "you"). It applies when Turncraft processes personal data on your behalf as part of providing Reeltopus.

How to accept: a workspace owner or admin can accept this DPA in the app under Account settings. We record who accepted, for which company and workspace, when, and which version. It takes effect on acceptance. If you need a countersigned copy, email privacy@reeltopus.com. Version 2026-10-21.

1. Definitions

"Data Protection Laws" means the laws that apply to the processing of Customer Personal Data, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA ("CCPA") and other US state privacy laws, and India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). "Customer Personal Data" means personal data in the videos, audio, text and other content you or your users put into Reeltopus, and in what Reeltopus makes from it. "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR.

2. Roles

For Customer Personal Data, you are the controller (or a processor acting for your own client), and Turncraft is your processor (or subprocessor). Under the CCPA, Turncraft is your service provider. Under the DPDP Act, you are the data fiduciary and Turncraft is your data processor. For the account, billing and usage data we need to run and bill the service, Turncraft is a controller, as described in our Privacy Policy.

3. Instructions

We process Customer Personal Data only on your documented instructions: these are the Terms, this DPA, and what you or your users ask Reeltopus to do through the app, the API or a connected app. We tell you if we believe an instruction breaks Data Protection Laws. If a law requires us to process Customer Personal Data otherwise, we tell you first unless that law forbids it.

4. Confidentiality and security

Everyone at Turncraft who can access Customer Personal Data is bound by confidentiality. We keep the technical and organisational measures in Annex 2 in place, and may improve them, but won't reduce the overall level of protection.

5. Subprocessors

You give us general authorisation to use subprocessors. The current list is at reeltopus.com/subprocessors. We bind each one by written terms that protect Customer Personal Data at least as well as this DPA, and we remain responsible for them. We tell workspaces that have accepted this DPA about a new subprocessor at least 30 days before it starts processing Customer Personal Data. If you object on reasonable data protection grounds and we can't resolve it, you may end the affected service and we refund any prepaid fees for the unused period.

6. Helping you

• Data subject requests: Reeltopus lets you find, export, correct and delete Customer Personal Data yourself. Where that isn't enough, we help you answer requests. If a data subject contacts us directly about your data, we pass the request to you.
• Assessments: we give you reasonable information for data protection impact assessments and consultations with supervisory authorities.
• Breaches: we notify you without undue delay, and within 48 hours, after we become aware of a personal data breach affecting Customer Personal Data, with what we know and what we are doing, and update you as we learn more.

7. Deletion and return

You can export your data at any time. When you delete a project or your account, or when the Terms end, we delete Customer Personal Data as described in the Privacy Policy, except where a law requires us to keep it. Backups held by our database provider roll off within days.

8. Audits

On request, we give you the information you reasonably need to show compliance with this DPA, including written answers to security questionnaires once a year. If that isn't enough, or a supervisory authority requires it, you may audit our compliance with reasonable notice, at your cost, no more than once a year, under confidentiality, and without access to other customers' data.

9. International transfers

Turncraft is in India, and our subprocessors process data in the countries listed on the subprocessors page. Where Customer Personal Data is transferred out of the European Economic Area, the UK or Switzerland to a country without an adequacy decision:

• EU standard contractual clauses: the clauses annexed to Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference, with you as data exporter and Turncraft as data importer: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. Clause 7 (docking) applies. Under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period in section 5. The optional wording in Clause 11 doesn't apply. Under Clause 13, the supervisory authority is the one competent for you. Under Clauses 17 and 18, the clauses are governed by the laws of Ireland, and disputes go to the courts of Ireland. Annexes I and II of the clauses are Annexes 1 and 2 below, and Annex III is the subprocessors page.
• UK: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) applies and is incorporated by reference. Its Table 1 parties are as above, Tables 2 and 3 are completed by the modules and annexes above, and under Table 4 either party may end the Addendum as its Section 19 allows.
• Switzerland: the EU clauses apply with the changes the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR include the Swiss FADP, and the Commissioner is the competent supervisory authority for transfers under the FADP.

If the clauses conflict with this DPA or the Terms, the clauses prevail.

10. CCPA service provider terms

We process personal information only for the business purposes in this DPA. We don't sell or share it, retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing Reeltopus, or combine it with personal information from other sources except as the CCPA allows. We comply with the CCPA and give the same level of protection it requires, and tell you if we can no longer meet these obligations. You may take reasonable steps to stop and fix any unauthorised use.

11. Liability and order of precedence

Each party's liability under this DPA is subject to the limitation of liability in the Terms, except where Data Protection Laws or the standard contractual clauses don't allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. This DPA lasts as long as we process Customer Personal Data for you.

Annex 1: Details of processing

• Data subjects: people who appear or speak in the content you upload or import, and your users of Reeltopus.
• Personal data: video and audio, including faces and voices; transcripts and word timings; where faces are in the frame (not who they are); names and words spoken or shown; clip text, captions and post text; your users' names and email addresses.
• Special categories: none are intended. Content may reveal them if you upload it. A voice sample is processed to make a dub in the speaker's own voice only when you confirm you have the speaker's consent, and the clone is deleted after the dub.
• Nature and purpose: storing, transcribing, analysing, reframing, captioning, editing, translating, dubbing, exporting and posting content, as you instruct, to provide Reeltopus.
• Frequency and duration: continuous, for as long as you use Reeltopus, then until deletion under section 7.

Annex 2: Security measures

The measures on our security page, including: encryption in transit (HTTPS with HSTS) and at rest; AES-256-GCM encryption of connected-account tokens and webhook secrets; hashed sign-in links, API keys and OAuth tokens; workspace-scoped access checks on every route and tool; OAuth 2.1 with PKCE for connected apps; cross-site request and SSRF protections; shared rate limits; security headers; payment card data handled only by Paddle; self-serve export and deletion; and the incident response process on that page.

Annex 3: Subprocessors

The list at reeltopus.com/subprocessors, as updated under section 5.