Data Processing Agreement

1. Roles and scope

This Data Processing Agreement ("DPA") between the Customer and Samba Intelligence Holding B.V. (GetReelCom) forms an integral part of the Terms of Service. For personal data that the Customer uploads to or processes through the Service ("Customer Data"), the Customer is the controller and GetReelCom the processor within the meaning of art. 4 GDPR. For data GetReelCom processes for its own purposes (accounts, billing, security logs), GetReelCom is controller and the Privacy Policy applies.

2. Subject matter of the processing

The Customer warrants that it has a valid legal basis — and where required, the demonstrable consent of depicted individuals — for the processing of Customer Data through the Service, and that no special categories of data (art. 9 GDPR) are provided unless a valid exception applies. Biometric analysis for the purpose of uniquely identifying a person is not part of the Service and must not be requested.

3. Our obligations as processor

• We process Customer Data only on the Customer's documented instructions — as given via the Service's functionality and the agreement — unless EU or member-state law requires otherwise, in which case we inform the Customer unless that law forbids it. We inform the Customer if, in our opinion, an instruction infringes the GDPR.
• Persons authorised to process Customer Data are bound by confidentiality.
• We do not use Customer Data to train AI models and do not permit our subprocessors to do so.
• Taking into account the nature of the processing, we assist the Customer with appropriate technical and organisational measures in fulfilling data-subject requests (arts. 15–22 GDPR) and, insofar as information is available to us, with the Customer's obligations under arts. 32–36 GDPR. We may charge reasonable costs for assistance that goes beyond the Service's standard functionality.

4. Security (art. 32 GDPR)

We implement appropriate technical and organisational measures, including: encryption of data in transit (TLS); hosting and databases with certified providers in the EU (Frankfurt and Paris); logical access control and role separation; authentication via a dedicated identity provider; separated production and development environments; and backups. We may update these measures provided the overall security level does not decrease.

5. Subprocessors

• The Customer grants a general written authorisation to engage the subprocessors listed on getreelcom.com/subprocessors. We impose data-protection obligations on each subprocessor equivalent to this DPA and remain responsible to the Customer for their performance.
• We announce additions or replacements at least 14 days in advance by updating that page and notifying account holders by email or in the app. The Customer may object in writing on reasonable data-protection grounds within that period; if we cannot offer a workable alternative, the Customer's remedy is to terminate the affected part of the Service, with a pro-rata refund of prepaid fees for the remaining period.

6. International transfers

Customer Data is stored in the EU. Where a subprocessor processes personal data outside the EEA, we ensure a valid transfer mechanism under chapter V GDPR: an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) and/or Standard Contractual Clauses, with supplementary measures where needed. Details per subprocessor are on the subprocessor page.

7. Personal data breaches

We notify the Customer without undue delay, where feasible within 72 hours after becoming aware of a personal data breach affecting Customer Data, providing the information reasonably available to us (nature, categories, approximate numbers, likely consequences, measures taken). Notifying supervisory authorities and data subjects is the Customer's responsibility as controller; our notification to the Customer is not an acknowledgement of fault or liability.

8. Audits

We make available the information reasonably necessary to demonstrate compliance with art. 28 GDPR. Audit requests are satisfied first through documentation: current certifications, audit reports and security summaries of ourselves and our subprocessors. Where these are demonstrably insufficient, the Customer may — at most once per 12 months, with at least 30 days' written notice, during business hours, without access to other customers' data or to systems of subprocessors — have an audit performed by an independent auditor bound to confidentiality. The Customer bears the costs, including our reasonable internal costs. Audits of subprocessors are limited to the audit rights those subprocessors offer us.

9. Deletion and return

During the term, the Customer can export Output via the Service. After termination of the agreement — or on the Customer's written request — we delete Customer Data within 30 days, unless EU or Dutch law requires longer storage. Data in encrypted backups is overwritten in the normal backup cycle, no later than 90 days after deletion.

10. Liability and precedence

The liability provisions of the Terms of Service (art. 13) apply in full to this DPA; all claims under this DPA count toward the same aggregate cap. Each party is responsible for the administrative fines imposed on it and for its own compliance with the GDPR in its role. In the event of conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails.

11. Term

This DPA applies for as long as we process Customer Data and ends automatically after the deletion under art. 9. Questions: [email protected].