Data Processing Agreement

This Data Processing Agreement ("DPA") is incorporated into and forms part of the Master Services Agreement ("MSA") or Order Form between Company and Customer. In the event of conflict between this DPA and the MSA, this DPA controls with respect to data protection matters.

1. Definitions

  • "CCPA" means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by CPRA.
  • "Controller" means the natural or legal person that determines the purposes and means of Processing of Personal Data (here, Customer).
  • "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
  • "EEA" means the European Economic Area.
  • "GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation) and, where applicable, the UK GDPR.
  • "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws.
  • "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
  • "Processing" (and "Process", "Processed") means any operation performed on Personal Data, including collection, storage, retrieval, transmission, erasure, and destruction.
  • "Processor" means the entity that Processes Personal Data on behalf of the Controller (here, Company).
  • "Standard Contractual Clauses" or "SCCs" means the clauses adopted by the European Commission for the transfer of Personal Data to third countries.
  • "Sub-processor" means any third party engaged by the Company to Process Personal Data on behalf of Customer.
  • "Supervisory Authority" means the relevant data protection authority in the applicable jurisdiction.

2. Roles; Scope of Processing

2.1 Processor Appointment

Customer appoints the Company as a Processor to Process Personal Data on Customer's behalf solely for the purposes of providing the Services as described in Exhibit A ("Processing Activities").

2.2 Compliance with Instructions

The Company shall Process Personal Data only in accordance with Customer's documented instructions (as set forth in this DPA and the MSA/Order Form) and applicable law. The Company shall inform Customer if, in its opinion, an instruction infringes applicable Data Protection Laws.

2.3 Categories of Data and Data Subjects

The categories of Personal Data and Data Subjects are set forth in Exhibit A. Customer shall not submit Special Categories of Personal Data (e.g., health, biometric, political views) to the Services without the Company's prior written consent.

3. Customer Obligations

Customer represents and warrants that: (a) it has a lawful basis for Processing and for instructing the Company to Process Personal Data; (b) it has provided all required notices to and obtained all required consents from Data Subjects; (c) it will comply with all applicable Data Protection Laws with respect to its Processing activities; and (d) it has the authority to enter into this DPA.

3.4 Biometric Data

To the extent that Customer Content includes voice recordings, facial images, voiceprints, retina or iris scans, fingerprints, or any other biometric identifier or biometric information as defined under applicable law (including the Illinois Biometric Information Privacy Act (740 ILCS 14/), California Civil Code § 1798.91.04, Texas Business & Commerce Code Chapter 503, or similar biometric privacy statutes) (collectively, "Biometric Data"), Customer represents, warrants, and covenants that: (a) it has provided all legally required written notices to the individuals whose Biometric Data is included in Customer Content; (b) it has obtained all legally required written consents from such individuals prior to submitting Biometric Data to the Services; (c) it has established and made available a publicly available retention schedule and guidelines for permanently destroying Biometric Data as required by applicable law; and (d) its collection, use, and submission of Biometric Data complies in all respects with applicable biometric privacy laws. Customer shall defend, indemnify, and hold the Company harmless from any claims, regulatory actions, fines, or penalties arising from Customer's failure to comply with this Section 3.4.

4. Company Obligations

4.1 Confidentiality of Processing

The Company shall ensure that persons authorised to Process Personal Data are subject to enforceable confidentiality obligations or professional secrecy duties.

4.2 Security Measures

The Company shall use commercially reasonable efforts to implement and maintain appropriate technical and organizational security measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are described in Exhibit B (Security Measures). The Company may update Exhibit B provided the overall level of protection is not materially reduced.

4.3 Data Subject Rights Assistance

Upon Customer's request, the Company shall provide reasonable assistance to help Customer fulfill its obligations to respond to Data Subject requests (access, rectification, erasure, portability, objection). Customer shall be solely responsible for responding to Data Subjects.

4.4 Data Protection Impact Assessment

The Company shall provide reasonable assistance to Customer in carrying out any required Data Protection Impact Assessment (DPIA) or prior consultation with a Supervisory Authority, to the extent that such DPIAs relate to the Company's Processing activities.

4.5 No Selling or Sharing of Personal Data

The Company shall not: (a) sell or share Personal Data for cross-context behavioural advertising; (b) retain, use, or disclose Personal Data outside the scope of the Services; or (c) combine Personal Data with data obtained from other sources except as specifically authorised in writing by Customer.

4.6 AI-Specific Restrictions

The Company shall not use Customer Data (including Personal Data) to train, fine-tune, evaluate, or improve any general-purpose AI model that is offered to customers other than Customer, without Customer's explicit written consent.

5. Sub-processors

5.1 Authorisation

Customer hereby provides general written authorisation for the Company to engage Sub-processors. The Company's current list of Sub-processors is available at lenera.ai/legal/subprocessors ("Sub-processor List").

5.2 New Sub-processors

The Company shall provide Customer with thirty (30) days' prior written notice of any new Sub-processor additions or material changes. Customer may object to a new Sub-processor within this notice period on reasonable, documented data protection grounds by providing written notice specifying the objection. The parties shall negotiate in good faith to resolve the objection within fifteen (15) days. If the parties cannot resolve the issue, Customer may terminate the portion of the Service relying on the objected Sub-processor upon thirty (30) days' written notice, and the Company shall refund a pro-rata portion of any prepaid Fees for the terminated portion covering the period after the effective date of termination.

5.3 Sub-processor Obligations

The Company shall impose data protection obligations on Sub-processors no less protective than those in this DPA. The Company remains fully liable for the acts and omissions of its Sub-processors.

6. Personal Data Breach Notification

The Company shall notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Data, using commercially reasonable efforts to provide notice within seventy-two (72) hours. Initial notice may be provided before all information is available; the Company will supplement as details are confirmed. Such notice shall include, to the extent then known: (a) nature of the breach; (b) categories and approximate number of Data Subjects affected; (c) categories and approximate number of Personal Data records affected; (d) likely consequences; (e) measures taken or proposed to address the breach. The Company shall cooperate with Customer's reasonable investigation and remediation requests.

7. Deletion and Return of Data

Upon expiry or termination of the MSA/Order Form, the Company shall, at Customer's election: (a) delete all Personal Data within thirty (30) days; or (b) return a copy to Customer in a machine-readable format within thirty (30) days, and delete all copies thereafter. The Company may retain Personal Data required by applicable law, for the duration required by such law only. For the avoidance of doubt, Personal Data may persist in encrypted, isolated backup archives for up to ninety (90) days following completion of active deletion; the Company will not actively access, process, or restore such backup data during this period and will purge it on its standard backup rotation schedule. This backup retention period does not affect Customer's rights or the Company's obligations under applicable Data Protection Law.

8. Audits and Compliance

The Company shall: (a) maintain records of Processing activities as required by applicable Data Protection Laws; (b) make available to Customer all information reasonably necessary to demonstrate compliance with this DPA; and (c) upon Customer's written request and reasonable notice (not less than 30 days), contribute to audits of the Company's processing activities, no more than once per calendar year.

9. International Data Transfers

If the Company transfers Personal Data from the EEA, UK, or Switzerland to countries not deemed adequate by the European Commission or applicable authorities, such transfer shall be subject to: (a) the Standard Contractual Clauses (SCCs) adopted by the European Commission (as amended from time to time), incorporated herein by reference in the applicable module; or (b) another valid transfer mechanism under applicable Data Protection Law.

For UK transfers: the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs shall apply where required.

10. CCPA Compliance

To the extent the CCPA applies: (a) the Company shall not sell or share Personal Data; (b) the Company shall not retain, use, or disclose Personal Data for any purpose other than the Services; (c) the Company shall provide the same level of privacy protection as required under the CCPA; and (d) the Company shall notify Customer if it determines it can no longer meet its CCPA obligations, and Customer may take reasonable steps to investigate, remediate, or stop the Processing.

11. Governing Law

This DPA shall be governed by the laws specified in the MSA, except that GDPR-related provisions shall be governed by the laws of the EU member state of Customer's primary establishment (if applicable) for the purposes of SCCs compliance.

Exhibit A — Processing Activities

Subject MatterProvision of AI video creation services, including rendering AI-narrated corporate training and communications videos
Nature of ProcessingCollection, hosting, storage, transmission, processing for video rendering; voiceover synthesis from text; AI-assisted script generation
Purposes of ProcessingTo deliver the Services contracted under the MSA; to provide customer support; to ensure security and integrity of the platform
Duration of ProcessingFor the term of the MSA/Order Form and for 30 days post-termination for data export
Categories of Personal DataNames, email addresses, profile data of Authorized Users; Voice recordings (if custom voice feature used); Any personal data included in Customer-uploaded scripts or documents; Usage data and metadata (login times, feature usage, video content metadata)
Categories of Data SubjectsCustomer's Authorized Users (employees, contractors); Persons mentioned in Customer-uploaded scripts or content; Viewers of AI Output (if analytics enabled)
Special CategoriesNONE — Customer shall not submit special category data without prior written consent

Exhibit B — Security Measures

The Company maintains the following technical and organizational security measures (updated periodically at lenera.ai/legal/security):

B.1 Access Controls

  • Multi-factor authentication required for all Company staff accessing production systems
  • Role-based access control (RBAC) — principle of least privilege
  • Customer data is logically isolated between tenants

B.2 Encryption

  • Data at rest: AES-256 encryption
  • Data in transit: TLS 1.2+ on all endpoints

B.3 Infrastructure Security

  • Hosted on AWS / Render / Vercel — ISO 27001 and SOC 2 Type II certified infrastructure
  • Network segmentation and firewall rules enforced

B.4 Incident Response

  • Security incident response plan maintained and tested annually
  • 72-hour breach notification commitment to Customer

B.5 Organizational Measures

  • Employee security training annually
  • Background checks for employees with access to production data
  • Vendor risk assessments for all Sub-processors

B.6 Vulnerability Management

  • Regular penetration testing (annually by external firm)
  • Automated dependency vulnerability scanning in CI/CD pipeline

Last updated: June 2026