Processor duties that match how Showmesh is built.

1. Scope and roles

This Data Processing Addendum (“DPA”) applies to processing of Customer Personal Data by Sansa Group AB, acting through its Sansa Vision division, on behalf of Customer in connection with Showmesh. Customer is the controller or business; Sansa Group AB is the processor, service provider, or contractor, as those terms are defined by applicable data-protection law. Each party remains an independent controller for personal data it processes for its own account administration, security, billing, legal compliance, and direct business relationship purposes.

2. Instructions and details

Sansa Group AB will process Customer Personal Data only on documented instructions in the agreement, product configuration, API calls, and authorized support requests, unless law requires otherwise. If an instruction appears unlawful, we will inform Customer where permitted and may suspend the affected processing.

• Subject matter: hosting, capture, authoring, replay, delivery, analytics, support, AI-assisted processing, integration, export, and deletion for Showmesh.
• Duration: the subscription plus configured retention and a limited recovery/deletion period.
• Data subjects: Customer personnel, collaborators, product users visible in authorized captures, viewers, leads, and support contacts.
• Data types: identifiers, professional information, device/activity data, customer content, communications, visual and interaction data, and categories deliberately supplied by Customer.

3. Confidentiality and personnel

We ensure personnel authorized to process Customer Personal Data are bound by confidentiality and receive role-appropriate security and privacy training. Access is limited by role and operational need.

4. Security measures

We maintain measures appropriate to risk, including tenant-scoped authorization, least-privilege service bindings, encryption in transit and platform encryption at rest, secure secret management, short-lived signed asset access, immutable published releases, audit events, rate limiting, capture sanitization, network restrictions, masking and synthetic replacement, vulnerability management, dependency scanning, backup and recovery testing, and incident response. Current details appear on the Security page and may evolve without materially reducing overall protection.

5. Subprocessors

Customer authorizes use of subprocessors required to provide Showmesh, subject to written agreements imposing data-protection obligations materially equivalent to this DPA. Our current subprocessor list identifies purpose and processing location. We will provide notice of a new subprocessor where required. Customer may object on reasonable data-protection grounds within the stated notice period; the parties will work in good faith on a commercially reasonable solution.

6. International transfers

For restricted transfers from the EEA, the 2021 EU Standard Contractual Clauses apply, using Module Two (controller to processor) or Module Three (processor to processor) as appropriate, with the DPA and security documentation completing the annexes. The UK Addendum applies to UK restricted transfers, and the Swiss adaptations apply where Swiss law governs. Customer grants us authority to enter onward-transfer clauses with subprocessors.

7. Data-subject requests

Taking account of the nature of processing, we will reasonably assist Customer with requests to access, correct, delete, restrict, object, or port Customer Personal Data. If a person contacts us about data processed solely for Customer, we will direct the request to Customer unless law requires a direct response. Customer is responsible for determining the response and lawful exceptions.

8. DPIAs and regulators

We will provide information reasonably available to help Customer conduct a data-protection impact assessment, prior consultation, or regulator response concerning Showmesh. Assistance beyond standard documentation may be subject to agreed fees if it requires substantial bespoke work.

9. Security incidents

We will notify Customer without undue delay after confirming a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Notice will include available information about the nature, likely consequences, affected data, containment, remediation, and a contact. Notification is not an admission of fault. Customer is responsible for notifications for which it is the controller.

10. Return and deletion

On termination or Customer instruction, we will delete or return Customer Personal Data unless law requires retention. Deletion follows active-system processing and scheduled expiration of backups and immutable recovery copies. Customer should export required content before account closure. We may retain de-identified data that cannot reasonably identify Customer or a person.

11. Audit and information rights

We will provide available security, privacy, architecture, and compliance information reasonably necessary to demonstrate compliance. After reviewing that information, Customer may request one audit per year by an independent auditor under confidentiality, during business hours, without access to other customers’ data and at Customer’s cost. Additional audits are permitted after a confirmed incident or regulator requirement. We may satisfy overlapping requests with a recent independent report when appropriate.

12. US state privacy commitments

Sansa Group AB will not sell or share Customer Personal Data, retain/use/disclose it outside the direct business relationship except as permitted by law, combine it with personal information from unrelated sources except as legally permitted to provide the service, or use it for targeted advertising. We will notify Customer if we determine we can no longer meet these obligations and allow reasonable steps to stop and remediate unauthorized use.

13. Conflict and termination

This DPA controls over conflicting terms concerning processing of Customer Personal Data. Liability is subject to the agreement’s limits unless prohibited by law. The DPA ends after deletion of Customer Personal Data, except provisions that must survive.