ReadyForm

Data Processing Agreement

Recitals

  • ReadyForm develops software that uses AI to analyse, select and edit video and audio material into short, publication-ready content.
  • Insofar as ReadyForm processes personal data exclusively on behalf of the Client, the Client is the controller and ReadyForm is the processor.
  • Insofar as ReadyForm uses personal data for its own marketing, publicity, demonstrations or customer-reference purposes, ReadyForm acts as an independent controller. For product improvement and model development, ReadyForm uses only anonymised or aggregated data, which is no longer personal data.

1. Definitions

GDPR — Regulation (EU) 2016/679. Service — the ReadyForm software and related analysis, editing, transcription, export, storage and support. Source Material — all files supplied by or on behalf of the Client. Output — all results generated by ReadyForm. Personal Data — information relating to an identified or identifiable natural person. Data Subjects — individuals whose Personal Data appears in the material or is processed through the Service. Product Improvement — the use of anonymised or aggregated data to evaluate and improve the Service; it does not include training on identifiable Source Material. Marketing Use — use or publication of company name, logo, testimonials, screenshots, anonymised results and selected fragments for marketing, sales and demonstration.

2. Subject matter and duration

This Agreement applies to all Processing of Personal Data by ReadyForm in connection with the Service. It begins when the Client supplies material and remains in force while ReadyForm processes the Client's Personal Data. Provisions on confidentiality, IP, liability, Product Improvement, Marketing Use and lawfully published materials survive termination.

3. Allocation of roles

For hosting, analysis, transcription, selection, editing and export on behalf of the Client, the Client is the controller and ReadyForm the processor, acting only on the Client's documented instructions (this Agreement, the in-app settings and the uploads). For its own Marketing Use, ReadyForm acts as an independent controller; for Product Improvement it uses only anonymised or aggregated data.

4. Nature and purpose of the Processing

On behalf of the Client, ReadyForm may receive and store material; process video and audio; transcribe; analyse content, structure and potential clips; select and rank fragments; generate hooks, subtitles, titles and text; edit, crop, resize and export video; provide support; and secure, monitor and maintain the Service. ReadyForm does not perform biometric identification or facial recognition. Speaker separation used to colour-code captions is clustering of voices within a single recording, not identification of who a person is.

5. Categories of Personal Data

Depending on the material: names and contact details; job title and organisation; image, face and appearance; voice and speaking style; statements and opinions; audio and video; transcripts and quotations; account and profile information; metadata; IP, browser, log and usage data; feedback and corrections; and other information visible or audible in the Source Material.

6. Categories of Data Subjects

Employees and contractors of the Client; customers and business contacts; guests, interviewees and podcast participants; trainers, experts and presenters; suppliers and partners; event and webinar participants; users of the Service; and others visible, audible or mentioned in the Source Material.

7. Obligations of the Client

The Client determines what material is supplied and warrants it is lawful; informs Data Subjects about the recording, the Processing, the use of AI, the possible publication of clips and Marketing Use; ensures a valid legal basis and, where required, obtains consent; and holds all necessary copyrights, licences, image rights and permissions.

Without ReadyForm's prior written consent, the Client shall not upload material containing minors; medical or health data; data on racial or ethnic origin; political, religious or philosophical beliefs; sex life or sexual orientation; trade-union membership; genetic or biometric data; criminal-offence data; or highly confidential business or state information. Unintentional inclusion must be reported immediately. ReadyForm may refuse or remove material whose use is reasonably expected to be unlawful, unsafe or contrary to this Agreement.

8. Instructions

ReadyForm processes on documented instructions only, and shall inform the Client if an instruction appears to infringe the GDPR — and may suspend performance until a lawful instruction is agreed.

9. Confidentiality

Staff, contractors and other authorised persons are bound by confidentiality; access is limited to those who need it; the obligation survives termination. ReadyForm may disclose where required by law, informing the Client in advance unless prohibited.

10. Security

ReadyForm implements appropriate technical and organisational measures, including secure connections and encryption in transit; secured storage; individual accounts; strong passwords and, where available, multi-factor authentication; least-privilege access; logging; regular updates; backups; separation of customer environments; confidentiality agreements; a breach procedure; and periodic review. The Client keeps its own accounts, passwords and devices secure and reports suspected unauthorised access immediately.

11. Personal data breaches

ReadyForm notifies the Client without undue delay after becoming aware of a breach involving the Client's Personal Data, providing the available detail (incident, suspected cause, data and Data Subjects involved, consequences, measures and a contact), and cooperates on investigation, containment and remediation. The Client, as controller, decides on notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to Data Subjects.

12. Rights of Data Subjects

Requests from a Data Subject about Personal Data processed on behalf of the Client are forwarded to the Client; ReadyForm does not respond independently unless instructed, or where it is itself controller. ReadyForm provides reasonable assistance with access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

13. Sub-processors

The Client grants general written authorisation to engage sub-processors to help deliver the Service. ReadyForm maintains an up-to-date list, available to the Client on request, informs the Client in advance of material changes, allows objection within fourteen days for demonstrable risks, imposes equivalent obligations on sub-processors, and remains responsible as required by the GDPR.

14. Transfers outside the EEA

ReadyForm processes all Source Material — the raw video and audio — exclusively within the European Economic Area. Speech-to-text and speaker separation run on EU infrastructure; audio is not sent to an external transcription service. Only derived text (such as transcripts) and low-resolution thumbnails may be sent to AI providers outside the EEA, and only under a valid mechanism such as Standard Contractual Clauses. Raw video and audio never leave the EEA.

15. Retention

ReadyForm retains Source Material and Output only for as long as the account is active, and deletes them within 30 days after the account is closed. Log data is kept up to 12 months; IP addresses are anonymised after 30 days; backups follow the normal backup cycle. On request after termination, ReadyForm deletes or returns Personal Data, unless a statutory retention obligation applies, the data was lawfully used for Marketing Use, or it has been anonymised.

16. Inspections and audits

On reasonable request ReadyForm provides information to assess compliance; the Client may audit once per calendar year with ten business days' notice, without disrupting other customers, relying first on certifications and existing documentation. Audit costs are the Client's unless a material breach by ReadyForm is found.

17. DPIA and supervisory authority

ReadyForm provides reasonable assistance with a data protection impact assessment and cooperates with a competent supervisory authority. The Client determines whether a DPIA, prior consultation or additional consent is required.

18. Product improvement (anonymised data only)

ReadyForm improves the Service using only anonymised or aggregated data (for example which suggestions users accept or reject, error rates and performance). It does not train, fine-tune or evaluate models on identifiable Source Material; recognisable faces, voices, names and complete statements are not used for this. Before use, direct identifiers are removed and the data is aggregated or irreversibly anonymised. ReadyForm shall not use data to identify individuals, infer sensitive characteristics, make automated decisions with legal effect, or create voice or facial imitations. General improvements belong to ReadyForm where they cannot be linked to the Client or a Data Subject.

19. Product feedback and usage data

ReadyForm may use feedback, corrections, click behaviour, error messages and technical usage data to improve the Service, aggregated or pseudonymised where possible. Quotes including a name, job title, photograph or company name are used for marketing only where the Client has given the separate permission described in clause 20. Product ideas grant the Client no ownership in future ReadyForm software.

20. Marketing Use

Marketing Use is optional and is never a condition of using the Service. It applies only where the Client has separately and explicitly given permission. Where that permission is given, the Client grants ReadyForm the right to use, for marketing, sales and demonstration: the company name and logo; screenshots of the software and Output; anonymised or aggregated results and time-savings; any testimonial the Client provides; and selected video and audio fragments from the Source Material and Output, including fragments containing recognisable individuals. The Client warrants that every recognisable individual has agreed to this use and that the Client holds all necessary rights.

Within that scope ReadyForm may select, shorten and edit fragments; add subtitles, text, music and graphics; adapt formats; use the Client's name, logo and description; and publish results. ReadyForm shall not use material in a misleading, offensive, discriminatory or reputation-damaging manner, and shall not alter statements so as to materially change their meaning. Where reasonably possible, ReadyForm submits new public case material to the Client for review in advance. The Client grants a non-exclusive, worldwide, royalty-free licence for these purposes for up to three years.

Removal and objection. A recognisable individual, or the Client, may request removal of specific material. Following such a request, the withdrawal of the permission, or the closure of the account, ReadyForm stops new publications within 30 days and removes the material within 60 days from channels it controls, where reasonably feasible; it is not required to recall printed materials and cannot guarantee removal of copies lawfully shared, cached or archived by third parties. Publications lawfully made before the request remain lawful. The statutory rights of Data Subjects are not affected.

21. Use of name, logo and testimonial

A testimonial may be shortened without altering its meaning; the Client may request correction of factual inaccuracies. ReadyForm shall not suggest the Client is a paying customer, partner or investor where untrue, and shall, where appropriate, state the nature of the cooperation.

22. Ownership of Source Material

All rights in the original Source Material remain with the Client or the original rights holder. The Client grants ReadyForm the rights necessary to provide the Service, and, for Marketing Use, the rights set out in clause 20.

23. Ownership of software and models

All rights in ReadyForm, its software, source code, algorithms, models, methods, prompts, templates, interfaces and know-how remain with ReadyForm or its licensors. The Client acquires no rights in the source code, internal models, training methods, other customers' data or general product improvements. General improvements from lawful anonymised use belong to ReadyForm, provided they do not reproduce confidential Source Material as such.

24. Rights in the Output

The Client may use, edit and publish Output generated specifically for it. ReadyForm does not warrant that Output is entirely unique. Before publication the Client verifies factual accuracy, context, copyright, image and privacy rights, trademark rights and platform suitability. ReadyForm is not responsible for publication without human review.

25. Liability

Each Party is responsible for its own GDPR obligations. The Client is particularly responsible for the lawfulness of the Source Material, information to Data Subjects, the legal basis, consent and image rights, and the ultimate publication of Output. ReadyForm is responsible for Processing under this Agreement and for appropriate security. Nothing here limits the statutory rights of Data Subjects or the powers of supervisory authorities.

26. Termination

On termination ReadyForm ceases Processing on behalf of the Client, except where retention is required by law, the data was lawfully used for Marketing Use, or it has been irreversibly anonymised. Before termination the Client may download available Output. ReadyForm deletes data per clause 15 and may keep a minimal administrative record for evidence, security and legal compliance.

27. Amendments

Amendments are valid only when accepted by both Parties in writing or electronically. ReadyForm may amend its security measures and sub-processors provided the overall level of protection is not materially reduced. A material change to the purposes of Product Improvement or Marketing requires renewed consent.

28. Order of precedence & governing law

In case of inconsistency: this DPA; the Terms of Service; then ReadyForm's general terms — except that for commercial arrangements the main agreement prevails unless that would reduce the protection of Personal Data. This Agreement is governed by Dutch law; disputes go to the competent court in Amsterdam unless mandatory law provides otherwise.

Appendix A — Description of the Processing

  • Subject matter: analysis, selection, editing and export of video and audio.
  • Duration: from account creation until account closure.
  • Purposes: analysis, transcription, clip selection, editing, subtitling, export, support.
  • Retention: deleted within 30 days after the account is closed.

Appendix B — Sub-processors

ReadyForm engages third parties to help deliver the Service — for example cloud hosting and storage, GPU processing, authentication, AI text analysis, transactional email and support. Raw video and audio are processed only within the EEA; only derived text and low-resolution thumbnails may be sent to AI providers outside the EEA, under appropriate safeguards such as Standard Contractual Clauses. An up-to-date list of sub-processors, with the categories of personal data and the applicable transfer safeguards, is available to the Client on request.

Appendix C — Your choices

Product improvement: ReadyForm may use anonymised and aggregated data to improve the Service. ReadyForm does not train on identifiable Source Material.

Marketing (optional, off unless you agree): company name; logo; software and Output screenshots; anonymised results and time-savings; a testimonial you provide; and selected video/audio fragments including recognisable individuals, used in publications, advertisements, presentations and sales and investor demonstrations.

Your confirmations: everyone recognisable in the material has been informed and has agreed; you hold all permissions and usage rights; the material contains no prohibited special-category or criminal Personal Data; and no minors appear without prior written approval.

Version 2026-08-28. Last updated: 2026-08-28. Request a signable copy at info@theaiagency.ae.