Data Processing Agreement
This Data Processing Agreement covers how SulusCast handles Customer Personal Data when customers use SulusCast for recording, sharing, storage, AI, and collaboration.
This Data Processing Agreement ("DPA") forms part of the Services Agreement between Sulus ("SulusCast," "we," "us," or "our") and the customer using SulusCast's services ("Customer," "you," or "your"). Customer agrees to this DPA by entering into the Services Agreement or by using the Services where SulusCast processes personal data on Customer's behalf. This DPA applies to SulusCast's website, desktop application, hosted services, recording and sharing workflows, team workspaces, APIs, integrations, support, and related services (collectively, the "Services").
This DPA is designed to meet Article 28 of the GDPR, the UK GDPR, and similar processor contract requirements under applicable Data Protection Laws. If Customer has a separate signed data processing agreement with SulusCast, that signed agreement controls to the extent of any conflict.
Definitions
"DPA" means this Data Processing Agreement, including its annexes.
"Services Agreement" means SulusCast's Terms of Service, an order form, a subscription agreement, or any other written agreement governing Customer's use of the Services.
"Customer Content" means recordings, screen content, webcam video, audio, transcripts, captions, titles, summaries, comments, thumbnails, folders, workspace content, files, metadata, and other content submitted to or generated through the Services by or for Customer.
"Customer Personal Data" means personal data contained in Customer Content or otherwise processed by SulusCast on Customer's behalf as a processor or subprocessor under the Services Agreement.
"Data Protection Laws" means all privacy and data protection laws applicable to SulusCast's processing of Customer Personal Data under the Services Agreement, including Regulation (EU) 2016/679, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act, and any implementing or supplemental laws.
"Security Incident" means a confirmed breach of security of SulusCast's systems that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
"Subprocessor" means a third party engaged by SulusCast to process Customer Personal Data on SulusCast's behalf.Roles of the Parties
For Customer Personal Data, Customer is the controller and SulusCast is the processor. If Customer acts as a processor for another controller, SulusCast acts as Customer's subprocessor and Customer is responsible for ensuring that its instructions to SulusCast are authorized by the relevant controller.
SulusCast acts as an independent controller for personal data that SulusCast processes for its own business purposes rather than on Customer's behalf, including account administration, billing, sales, marketing, website analytics, security, fraud prevention, product analytics, and legal compliance. SulusCast's Privacy Policy governs that processing.
Customer decides what to record, upload, share, transcribe, store, delete, or otherwise process through the Services. SulusCast does not decide the purpose of Customer's recordings or what personal data Customer includes in Customer Content.Customer Instructions
SulusCast will process Customer Personal Data only on Customer's documented instructions, including the Services Agreement, this DPA, Customer's product settings, Customer's use of the Services, and written instructions submitted through support or other agreed channels.
Customer instructs SulusCast to process Customer Personal Data to provide, secure, maintain, support, troubleshoot, and improve the Services for Customer, including their functionality, safety, reliability, and performance; to prevent abuse; to comply with law; and as otherwise described in Annex I. SulusCast will notify Customer if SulusCast believes an instruction violates Data Protection Laws, unless legally prohibited from doing so.Customer Content and AI
SulusCast will not use Customer Content to train general-purpose AI models or third-party AI models unless Customer expressly enables a feature that permits that training, provides documented instructions, or the data has been aggregated or de-identified so that it is no longer Customer Personal Data.
Optional AI features may process Customer Personal Data through Subprocessors listed in SulusCast's trust portal. Customer decides whether to use those workflows and whether they are appropriate for Customer's data and compliance needs.
SulusCast may use telemetry, metadata, usage information, and aggregated or de-identified information to operate, secure, analyze, and improve the Services. SulusCast does not use Customer Content in identifiable form to train generalized models except as described in this section.Customer Responsibilities
Customer is responsible for complying with Data Protection Laws in its use of the Services, including providing required notices, obtaining required consents, choosing an appropriate legal basis, respecting recording laws, honoring data subject rights, and ensuring that Customer Content is lawful.
Customer is responsible for configuring the Services for its compliance needs, including whether to use SulusCast Cloud storage, a custom S3-compatible bucket, a self-hosted deployment, password-protected sharing, restricted access, optional AI features, retention settings, or other available controls.
Customer will not submit special categories of personal data, criminal conviction data, protected health information, children's data, or other regulated data unless Customer has determined that its use of the Services is lawful and appropriate for that data and has implemented the required safeguards.U.S. State Privacy Terms
To the extent Customer Personal Data is personal information governed by U.S. state privacy laws and Customer is a business or controller under those laws, SulusCast will process that information as a service provider, contractor, or processor for the limited and specified business purposes described in this DPA and the Services Agreement.
SulusCast will not sell or share Customer Personal Data, retain, use, or disclose Customer Personal Data outside the business purposes described in this DPA and the Services Agreement, or combine Customer Personal Data with personal information from other sources, except as permitted by applicable U.S. state privacy laws.
SulusCast will provide the level of privacy protection required of service providers, contractors, or processors under applicable U.S. state privacy laws and will notify Customer if SulusCast determines it can no longer meet those obligations.Confidentiality
SulusCast will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations or are subject to an appropriate statutory duty of confidentiality. SulusCast will limit access to Customer Personal Data to personnel who need access to provide, secure, support, or maintain the Services.Security Measures
SulusCast will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are described in Annex II.
Customer acknowledges that security measures may evolve over time, provided that SulusCast does not materially decrease the overall security of the Services during the applicable subscription term.Subprocessors
Customer grants SulusCast general written authorization to engage Subprocessors to process Customer Personal Data. SulusCast will require each Subprocessor to protect Customer Personal Data under written terms that are at least as protective as the applicable data-processing obligations in this DPA.
SulusCast remains responsible for each Subprocessor's performance of its data-processing obligations. SulusCast maintains its current Subprocessor list through SulusCast's trust portal at trust.cap.so which may require access approval, or makes it available on request. That list is the source of truth for SulusCast Subprocessor names, service categories, processing purposes, processing locations, and related transfer information.
SulusCast will provide notice of new or replacement Subprocessors by updating the trust portal, through trust portal notifications where available, by account or email notice, or through another reasonable notice mechanism. Customer may object to a new or replacement Subprocessor within 30 days after notice if Customer has reasonable data protection grounds for the objection. SulusCast will use reasonable efforts to address the objection. If SulusCast cannot reasonably address the objection, Customer's sole remedy is to stop using the affected Service feature or terminate the affected portion of the Services before the new or replacement Subprocessor is used for Customer Personal Data.
Providers selected, contracted, or configured directly by Customer, including Customer's own S3-compatible storage provider, identity provider, cloud account, or self-hosted infrastructure provider, are not SulusCast Subprocessors.International Transfers
Sulus is established in the United States. Customer authorizes SulusCast and its Subprocessors to process Customer Personal Data in the United States and other locations where SulusCast or its Subprocessors maintain operations, subject to this DPA and Data Protection Laws.
Where Data Protection Laws require a transfer mechanism for a transfer of Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been found to provide an adequate level of protection, the parties agree to use the applicable Standard Contractual Clauses, the EU-U.S. Data Privacy Framework to the extent SulusCast is certified and the framework applies, or another valid transfer mechanism.
For EEA transfers, the Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914 apply as follows: Module Two applies where Customer is a controller and SulusCast is a processor; Module Three applies where Customer is a processor and SulusCast is a subprocessor; Clause 7 is deemed omitted; Clause 9 uses general written authorization with the notice period in Section 7; Clause 11 optional language is omitted; and the annexes are completed by Annexes I, II, and III of this DPA.
For the Standard Contractual Clauses, Customer is the data exporter and SulusCast is the data importer. The parties' contact details are the contact details in the Services Agreement, the applicable account, or the order document. The competent supervisory authority, governing law, and competent courts are determined under the applicable Standard Contractual Clauses. If the Standard Contractual Clauses require a selection, the parties will use the selection required by the Standard Contractual Clauses, the relevant data exporter, or the transfer documentation for the applicable transfer.
For UK transfers, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies as required by UK Data Protection Laws, with its tables completed by the Services Agreement, this DPA, and SulusCast's trust portal. For Swiss transfers, references to the GDPR are deemed to include the Swiss Federal Act on Data Protection, references to EU supervisory authorities are deemed to include the Swiss Federal Data Protection and Information Commissioner, and data subjects in Switzerland may exercise and enforce their rights as required by Swiss law.
SulusCast will provide reasonable information available to it, including information in SulusCast's trust portal, to help Customer assess transfer risks and safeguards. Customer remains responsible for determining whether its use of the Services satisfies Customer's transfer obligations. SulusCast will notify Customer if SulusCast determines it can no longer comply with an applicable transfer mechanism.Data Subject Requests
SulusCast will, taking into account the nature of the processing, provide reasonable assistance to help Customer respond to requests from data subjects exercising rights under Data Protection Laws. If SulusCast receives a request directly from a data subject regarding Customer Personal Data, SulusCast will either direct the data subject to Customer or notify Customer, unless legally prohibited from doing so.
Customer is responsible for responding to data subject requests. SulusCast will not independently respond to a request for Customer Personal Data except to confirm that the request relates to Customer or as legally required.Assistance With Compliance
SulusCast will provide reasonable assistance, taking into account the nature of the processing and the information available to SulusCast, to help Customer meet Customer's obligations relating to security, personal data breach notification, data protection impact assessments, and prior consultation with supervisory authorities. SulusCast may charge a reasonable fee for assistance that requires material effort beyond standard product functionality or support.Security Incident Notification
SulusCast will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data and, where feasible, within 72 hours after becoming aware of the Security Incident. SulusCast's notification will include information reasonably available to SulusCast, which may include the nature of the incident, affected data categories, affected data subjects, likely consequences, measures taken or proposed, and a contact point for follow-up.
SulusCast will take reasonable steps to contain, investigate, remediate, and mitigate the effects of a Security Incident. SulusCast's notification of or response to a Security Incident is not an admission of fault or liability.Return and Deletion
During the term of the Services Agreement, Customer may access, export, or delete Customer Personal Data using the functionality made available in the Services. After termination or expiration of the Services Agreement, SulusCast will delete or return Customer Personal Data in accordance with the Services Agreement and Customer's documented instructions, unless retention is required by law.
Deleted Customer Personal Data may remain in backups, logs, or archives for a limited period until overwritten or deleted through SulusCast's normal retention cycles. During that period, SulusCast will protect the retained data under this DPA and use it only for backup, recovery, security, legal compliance, or as otherwise required by law.
For self-hosted deployments or Customer-controlled storage, Customer is responsible for deleting Customer Personal Data from infrastructure, backups, logs, and providers under Customer's control.Audits and Information
SulusCast will make available information reasonably necessary to demonstrate compliance with this DPA, including security documentation, product information, Subprocessor information, and other materials available through SulusCast's trust portal, public documentation, or support channels.
If that information is not enough to demonstrate compliance with this DPA, Customer may request an audit no more than once per calendar year, unless Data Protection Laws require more frequent access or the request follows a Security Incident. SulusCast may require the audit to begin as a remote documentation-based review. Any audit must be conducted during normal business hours, with reasonable advance notice, by Customer or an independent auditor bound by confidentiality, and in a way that does not compromise the security, availability, confidentiality, or privacy of SulusCast, the Services, or any other customer.
Customer will bear its audit costs unless the audit reveals a material breach of this DPA by SulusCast. Customer may not conduct penetration tests, vulnerability scans, social engineering, or physical security reviews without SulusCast's prior written approval.Government and Third-Party Requests
If SulusCast receives a legally binding request from a government, regulator, court, or law enforcement authority for Customer Personal Data, SulusCast will notify Customer before disclosure unless legally prohibited or unless notice would create a risk of harm. SulusCast will review the request and, where appropriate, seek to limit or challenge it.
SulusCast will not voluntarily disclose Customer Personal Data to a government authority except as required by law or with Customer's instructions.Records
SulusCast will maintain records of processing activities as required by Data Protection Laws. Customer is responsible for maintaining its own records of processing, including its purposes, legal bases, categories of data subjects, categories of personal data, retention periods, recipients, and transfer mechanisms.Order of Precedence
If there is a conflict between this DPA and the Services Agreement, this DPA controls for the processing of Customer Personal Data. If there is a conflict between this DPA and the applicable Standard Contractual Clauses or another mandatory transfer mechanism, the Standard Contractual Clauses or mandatory transfer mechanism controls for the relevant transfer.Liability
Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Services Agreement, except to the extent prohibited by Data Protection Laws or the applicable Standard Contractual Clauses.Changes to This DPA
SulusCast may update this DPA from time to time, provided that updates do not materially reduce SulusCast's obligations for Customer Personal Data during an active subscription term unless required by law or agreed by Customer. SulusCast will post the updated DPA and update the "Last Updated" date.Contact
For questions about this DPA, data protection, or Subprocessor information, contact SulusCast at [email protected].Annex I: Details of Processing
Subject matter: SulusCast's provision of the Services under the Services Agreement.
Duration: The term of the Services Agreement and any period during which SulusCast processes Customer Personal Data under Customer's documented instructions or as required by law.
Nature and purpose: Providing, operating, hosting, storing, uploading, encoding, streaming, sharing, organizing, displaying, transcribing, summarizing, analyzing, securing, supporting, troubleshooting, maintaining, and improving the functionality, safety, reliability, and performance of the Services.
Processing operations: Collection, receipt, upload, recording, storage, retrieval, access, organization, structuring, hosting, transmission, disclosure to authorized recipients, restriction, encryption, deletion, and other operations necessary to provide the Services.
Categories of data subjects: Customer's administrators, employees, contractors, workspace members, invited users, viewers, commenters, guests, prospects, customers, support contacts, and other individuals whose personal data appears in Customer Content.
Categories of personal data: Names, email addresses, account identifiers, workspace identifiers, user-generated content, screen content, application windows, browser content, webcam images, voices, audio, video, captions, transcripts, summaries, comments, thumbnails, file names, folder names, share links, viewer analytics, device data, IP addresses, approximate location data, timestamps, access logs, support content, integration data, and encrypted storage configuration details where Customer uses bring-your-own-storage features.
Special categories of data: SulusCast does not intentionally request special categories of personal data. Customer Content may contain special categories of personal data if Customer chooses to record, upload, share, transcribe, or otherwise process that information through the Services.
Customer obligations and rights: Customer's obligations and rights are described in the Services Agreement, this DPA, and Data Protection Laws.Annex II: Technical and Organizational Measures
Access controls: SulusCast uses access controls designed to limit access to Customer Personal Data to authorized personnel, systems, and Subprocessors with a need to access it.
Authentication and authorization: SulusCast supports account-based access to the Services and uses authorization controls designed to restrict access to workspaces, recordings, settings, and sharing features.
Encryption: SulusCast uses encrypted transport for data transmitted to and from the Services and uses encryption or equivalent safeguards for managed storage and sensitive configuration values where appropriate.
Storage control: SulusCast supports local recording workflows, Customer-controlled S3-compatible storage, and self-hosted deployments so Customer can choose where recording content is stored when those features are available and configured.
Sharing controls: SulusCast provides controls such as share links, password protection, workspace access controls, signed storage URLs, and custom domain configuration where available and configured by Customer.
Data minimization: SulusCast processes Customer Personal Data for the purposes described in this DPA and supports product controls that allow Customer to limit sharing, disable optional AI workflows, use Customer-controlled storage, delete content, and export content.
Availability and resilience: SulusCast uses operational safeguards designed to support the availability and resilience of the Services, including monitoring, backups, recovery processes, and incident response practices appropriate to the nature of the Services.
Development and change management: SulusCast uses development practices designed to reduce security and privacy risk, including source control, code review, testing, dependency management, and deployment controls.
Logging and monitoring: SulusCast uses logs and monitoring designed to help secure the Services, troubleshoot issues, detect abuse, investigate incidents, and maintain reliability.
Personnel and vendor controls: SulusCast requires personnel with access to Customer Personal Data to protect it and evaluates Subprocessors before authorizing them to process Customer Personal Data.Annex III: Subprocessors
Customer authorizes SulusCast to use Subprocessors for the following categories of services: cloud hosting, database infrastructure, object storage, content delivery, email delivery, authentication, payment processing, customer support, analytics, error monitoring, logging, AI transcription, AI summarization, media processing, workflow automation, and other infrastructure or service providers needed to provide the Services.
SulusCast's current Subprocessor list is maintained through SulusCast's trust portal at trust.cap.so which may require access approval, or made available upon request. The list is incorporated by reference into this Annex III and is the source of truth for Subprocessor names, purposes, processing locations, service categories, and related transfer information.
Customer-controlled providers, including Customer's own S3-compatible storage provider, identity provider, cloud account, or self-hosted infrastructure provider, are selected by Customer and are not SulusCast Subprocessors.
Data Processing Agreement for Sulus
Last Updated: 8 May 2026