Data Processing Addendum
This addendum applies when a business customer (“you”, the controller) uses Octoque to process personal data about other people, for example people who appear in videos you publish, or your team members, and that processing is covered by the EU or UK GDPR, India’s DPDP Act or another data protection law that requires a processor contract. Zenproducts Technology Private Limited (“we”) is your processor. It forms part of the Terms and needs no signature; if you need a signed copy, write to hello@octoque.com.
1. The processing
| Subject matter and purpose | Storing, preparing and publishing your content to the platforms you connect; showing results; collaborating with your team. |
|---|---|
| Nature | Storage, conversion (such as trimming video), transmission, retrieval of results, deletion. |
| Duration | For as long as you use Octoque, and until deletion under section 8. |
| Types of personal data | Whatever your content contains (images, voices, names in captions), your team members’ names and emails, and platform account handles. |
| Data subjects | Your team members, and people who appear in or are named in your content. |
| Special categories | None intended. Don’t use Octoque to process special-category data unless you have a lawful basis and it appears only incidentally in your content. |
2. Our commitments
- We process personal data only on your documented instructions (these terms, your settings and your actions in Octoque), including for international transfers, unless the law requires otherwise; in that case we tell you first unless the law forbids it.
- We tell you at once if we think an instruction breaks data protection law.
- Everyone who can access the data is bound by confidentiality.
- We apply the security measures in section 5.
- We help you, through Octoque’s features and on request, to answer people’s requests to exercise their rights, and with security, breach notification, impact assessments and consultations with regulators.
- We make available all information needed to show we meet this addendum, and allow audits (see section 7).
3. Sub-processors
You give us general authorisation to use sub-processors for hosting, storage, email delivery, error monitoring, analytics and posting to platforms. We give each the same data protection duties as in this addendum, in writing, and remain responsible for them. The current list is available to business customers on request to hello@octoque.com. We tell you about any intended addition or replacement at least 30 days in advance by email; you can object on reasonable data protection grounds, and if we can’t resolve it, you can end your plan and get a refund of any prepaid unused period.
4. International transfers
We are established in India, which has no EU or UK adequacy decision. Where you are in the EU/EEA and transfer personal data to us, the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914), Module 2 (controller to processor), are incorporated by reference, with you as data exporter and us as data importer; Clause 7 (docking) applies; Clause 9 option 2 (general authorisation, 30 days’ notice); Clause 11 optional language does not apply; Clauses 17 and 18: the law and courts of Ireland. Annex I is section 1 of this addendum; Annex II is section 5; Annex III is the list in section 3. For UK data, the ICO’s International Data Transfer Addendum to those clauses applies; for Swiss data, the clauses apply with references to the Swiss FADP and the FDPIC. When our sub-processors outside the EU process the data, we use Module 3 (processor to processor) or the EU-US Data Privacy Framework where they are certified. If any of these mechanisms is invalidated, we will put a lawful alternative in place.
5. Security measures
- Encryption in transit (TLS) and at rest with our hosting and storage providers; passwords stored as strong salted hashes.
- Data stored in the EU (Frankfurt, Germany); backups roll off within 35 days.
- Access limited to staff who need it, with strong authentication, role-based permissions in Octoque, and audit logs.
- Uploads checked by their real file type and served from an isolated, sandboxed address; strict browser security policies.
- Rate limits, request size limits and monitoring against abuse; platform access tokens held by our posting providers, never sent to browsers.
- Regular dependency updates, automated tests, and security review of changes.
6. Personal data breaches
We notify you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your data, with what we know (nature, categories and approximate numbers, likely consequences, measures taken or proposed, contact point), and update you as we learn more.
7. Audits
On request, we provide written answers to reasonable security questionnaires and the information needed to show compliance, once a year or after a breach. If a regulator requires it, or the information isn’t enough, you may audit us (yourself or through an independent auditor bound by confidentiality) with 30 days’ notice, during business hours, at your cost.
8. Deletion and return
You can export all your data and files at any time from You → Privacy & data. When you delete your workspace or account, we delete the personal data we process for you within 30 days (files at once, backups within 35 days), unless the law requires us to keep it; any retained data stays protected by this addendum.
9. Liability and order of precedence
Each party’s liability under this addendum is subject to the Terms, except where the Standard Contractual Clauses or the law say otherwise. If this addendum conflicts with the Terms, this addendum wins; if it conflicts with the Standard Contractual Clauses, the Clauses win.
Contact
Zenproducts Technology Private Limited, Block B-400, 2nd Floor, Greenfield, NHPC Colony, Faridabad, Haryana 121010 · Data Protection Officer: Kumar Gaurav, hello@octoque.com