Data Processing Addendum

Last updated: October 21, 2026

Auftragsverarbeitungsvertrag pursuant to Art. 28 GDPR

This Data Processing Addendum ("DPA") is between Plugin Play LLC, a Kentucky limited liability company doing business as Brevidy, 1724 Rosecrans Drive, Lexington, Kentucky 40504, United States ("Company"), and the entity or person that accepted the Terms of Use or signed an order form for the Brevidy Services ("Customer").

This DPA forms part of the Terms of Use available at https://www.brevidy.pro/usage-terms (or any successor URL) and any order form, enterprise agreement, or other written agreement between the parties governing Customer's use of the Brevidy Services (collectively, the "Agreement"). It is incorporated into the Agreement automatically, without signature, for every Customer whose use of the Services is subject to the GDPR, the UK GDPR, or the Swiss FADP, and takes effect on the later of the date Customer accepted the Agreement and the date shown above (the "Effective Date"). If Customer and Company have signed a separate data processing agreement, that signed agreement applies instead of this DPA.

How to accept. No separate signature is needed: Customer accepts this DPA by agreeing to the Terms of Use or signing an order form. Customers that need a countersigned copy for their records can request one at admin@pluginplay.app.

1. Purpose and Scope

This DPA applies only to Company's Processing of Customer Personal Data in connection with providing the Services. The Services are a software product (an Adobe Premiere Pro extension and a web dashboard) and related support services for animated captioning, transcription, automated editing (AutoCut), reframing (AutoCrop), AI-assisted editing features, media workflow assistance, and related account administration. This DPA does not apply to information Company processes as an independent controller for its own business operations, such as billing records Company maintains for its own tax and accounting purposes, legal compliance, internal business records, or general website analytics for Company's marketing site, except to the extent required by Applicable Data Protection Law. That processing is described in the Privacy Policy.

This DPA is intended to satisfy Article 28 of Regulation (EU) 2016/679 ("GDPR") and the corresponding processor requirements of the UK GDPR and the Swiss Federal Act on Data Protection, as applicable.

2. Definitions

"Applicable Data Protection Law" means privacy, data protection, and data security laws applicable to a party's Processing of Customer Personal Data under the Agreement, including the GDPR and the national laws implementing or supplementing it, the UK GDPR and the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection ("Swiss FADP"), where applicable.

"Customer Personal Data" means Personal Data contained in Customer Content, account/user administration data, or support communications that Company Processes on behalf of Customer to provide the Services. Customer Personal Data does not include data Company processes as an independent controller or data outside the scope of the Services.

"Customer Content" means media, extracted audio, captions, transcripts, project files, text, prompts, assets, and other content submitted to the Services by or on behalf of Customer, and outputs generated from it.

"Personal Data" means information relating to an identified or identifiable natural person, or any similar term under Applicable Data Protection Law.

"Process" or "Processing" means any operation performed on Personal Data, including collection, storage, use, transmission, deletion, or return.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed by Company or its Subprocessors (a "personal data breach" within the meaning of Article 4(12) GDPR). Security Incident does not include unsuccessful attempts or activities that do not compromise the confidentiality, integrity, or availability of Customer Personal Data, such as pings, port scans, or blocked log-in attempts.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (controller to processor).

"Subprocessor" means a third party engaged by Company to Process Customer Personal Data on Company's behalf for the Services.

"TOMs" means the document "Brevidy: Technical and Organisational Measures", available to Customer on request, as updated in accordance with Section 7. A summary is published at https://www.brevidy.pro/security.

"UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner's Office and laid before Parliament in accordance with s.119A of the Data Protection Act 2018, as revised from time to time.

3. Roles of the Parties

As between the parties, Customer is the controller, business, or equivalent party that determines the purposes and means of Processing Customer Personal Data, and Company is the processor, service provider, or equivalent party that Processes Customer Personal Data on Customer's behalf. Customer is responsible for ensuring that it has all rights, notices, permissions, and lawful bases required to provide Customer Personal Data to Company and to instruct Company to Process Customer Personal Data as contemplated by the Agreement.

4. Processing Instructions

4.1 Company will Process Customer Personal Data only on Customer's documented instructions, including with regard to transfers of Customer Personal Data to a third country, unless required to do so by Union or Member State law to which Company is subject (or other law applicable to Company, to the extent such law does not conflict with Clauses 14 and 15 of the SCCs). In such a case, Company will inform Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

4.2 The Agreement, this DPA (including Annex 1), Customer's configuration of the Services (for example, enabling zero data retention), and Customer's and its authorised users' use of the Services constitute Customer's complete documented instructions as of the Effective Date. Within that scope, Customer instructs Company to Process Customer Personal Data to provide, secure, support, maintain and troubleshoot the Services. Company will not use Customer Content, or Personal Data contained in it, to develop or improve the Services or for any other purpose of its own, and any provision of the Agreement that would permit this does not apply to Customer Content. Additional or changed instructions must be agreed in writing (email suffices).

4.3 Company will immediately inform Customer if, in Company's opinion, an instruction infringes Applicable Data Protection Law. Company may suspend performance of that instruction until Customer confirms or changes it.

4.4 Company will not use Customer Content, outputs, or Customer Personal Data to train or fine-tune machine learning or AI models, and will not permit its Subprocessors to do so, unless expressly agreed in writing by Customer.

5. Product Scope and Data Minimisation

Customer will not intentionally submit to the Services any special categories of data under Article 9 GDPR, government identification numbers, financial account numbers, payment card data, protected health information, children's data, biometric data, precise geolocation data, or other highly regulated data unless the parties have expressly agreed in writing that the Services may Process such data. Customer acknowledges that Customer Content may incidentally contain Personal Data (for example, the voices, images and spoken words of people appearing in media) depending on the media or text Customer chooses to upload, and Customer remains responsible for reviewing and controlling that content.

6. Confidentiality and Personnel

Company will ensure that persons authorised to Process Customer Personal Data have committed themselves to confidentiality in writing or are under an appropriate statutory obligation of confidentiality, and that such obligations survive the end of their engagement. Company will limit access to Customer Personal Data to personnel and Subprocessors who need access to provide, secure, support, or maintain the Services.

7. Security Measures

Company will implement and maintain the technical and organisational measures described in the TOMs (Annex 2), which take into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing as well as the risks to the rights and freedoms of natural persons, in accordance with Article 32 GDPR. Company may update the TOMs over time to reflect technical progress, provided that updates do not reduce the overall level of protection. Company will make the current version available to Customer on request at admin@pluginplay.app and will inform Customer of material changes. A summary is published at https://www.brevidy.pro/security.

8. Security Incidents

Company will notify Customer without undue delay, and in any event no later than seventy-two (72) hours, after becoming aware of a Security Incident affecting Customer Personal Data. Company will provide, to the extent available and in phases where necessary, the information Customer needs to meet its obligations under Articles 33 and 34 GDPR, including the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the contact point for further information, and the measures taken or proposed to address the Security Incident and mitigate its effects. Company will take reasonable steps to contain and remediate the Security Incident and will cooperate with Customer's reasonable requests. Company's notice or response to a Security Incident is not an admission of fault or liability. Company is not responsible for Security Incidents caused by Customer, Customer's users, Customer's systems, Customer's credentials, or third-party platforms outside the control of Company and its Subprocessors.

9. Subprocessors

9.1 Customer grants Company a general written authorisation to engage Subprocessors, and specifically approves the Subprocessors listed in Annex 3 as of the Effective Date.

9.2 Company will impose on each Subprocessor, by written contract, data protection obligations that provide at least the same level of protection as those set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures in accordance with Article 28(4) GDPR. Company remains fully liable to Customer for each Subprocessor's performance of its data protection obligations, subject to Section 18.

9.3 Company will inform Customer at least fourteen (14) days before adding or replacing a Subprocessor, by updating the list at https://www.brevidy.pro/subprocessors and by email to the email address of Customer's account owner or administrator (or to a privacy contact Customer designates by writing to admin@pluginplay.app), giving the Subprocessor's name, location and the Processing it will perform. If Customer reasonably objects to a new Subprocessor on data protection grounds within that period, the parties will work in good faith to resolve the objection (for example, by Company not routing Customer's jobs to that Subprocessor). If the objection cannot be resolved, Customer may stop using the affected portion of the Services or terminate the affected subscription or order, and Company will refund any prepaid fees for the unused remainder of the terminated subscription term.

10. Assistance

10.1 Taking into account the nature of the Processing, Company will assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer's obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR, to the extent Customer cannot fulfil the request using the Services.

10.2 Taking into account the nature of the Processing and the information available to Company, Company will assist Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).

10.3 Company may charge reasonable fees for assistance that is not available through standard product functionality and requires non-routine engineering, legal, or operational work, except where the assistance is needed because of Company's breach of this DPA.

10.4 If Company receives a request directly from an individual relating to Customer Personal Data, Company will forward it to Customer without undue delay and will not respond to the request except to redirect the individual to Customer, or as instructed by Customer or required by law.

11. Government and Legal Requests

If Company receives a legally binding request from a public authority for disclosure of Customer Personal Data, Company will handle it in accordance with Clause 15 of the SCCs: Company will, to the extent legally permitted, promptly notify Customer; review the legality of the request and challenge it where, after careful assessment, there are reasonable grounds to consider it unlawful; and disclose only the minimum Customer Personal Data required to comply. Company will document its assessment and make it available to Customer to the extent permitted.

12. Return and Deletion

12.1 General. Outputs (captions, transcripts and edits) are delivered into Customer's Premiere Pro projects and can be exported by Customer at any time. During the term, Customer may request deletion of specific Customer Content or user accounts by email to admin@pluginplay.app, and Company will complete the deletion within thirty (30) days. Upon termination or expiration of the Agreement, Company will, at Customer's choice, return (by enabling export through the Services) or delete Customer Personal Data. Unless Customer requests return in writing within thirty (30) days after termination, Company will delete Customer Personal Data, including all job content in its database and all uploaded files in its storage, from its active systems within sixty (60) days after termination, and will confirm deletion in writing on request. Copies in backups are deleted as backups expire in the ordinary rotation cycle described in the TOMs, are not restored except for disaster recovery, and remain subject to this DPA until deleted. Company may retain Customer Personal Data only to the extent required by Union or Member State law or other law applicable to Company (for example, tax and accounting records), and any retained Customer Personal Data remains subject to this DPA and is Processed only for the purpose requiring retention.

12.2 Zero data retention (optional). Zero data retention is an optional setting. It applies to Customer's jobs while Customer (or, for a team, an organisation administrator) has enabled it in the Brevidy dashboard, or while Company has enabled it for Customer's organisation at Customer's written request. Each job records when it is created whether zero data retention applies to it. For each job covered by zero data retention:

(a) Raw audio and video files, and audio extracted from those files, are Processed only transiently, on a job-scoped basis, to provide the requested captioning, transcription, and related media features. Company does not retain a standing library of Customer media.

(b) Uploaded media, extracted audio, transcripts, caption text, and AI inputs and outputs for each job are deleted from Company's active systems within sixty (60) minutes after the job finishes, and in any event within twenty-four (24) hours. This applies equally to jobs that fail or are cancelled.

(c) Company will not retain such media, transcripts, or caption text for billing, backup-as-a-service, or general business-record purposes.

(d) Authorised Subprocessors listed in Annex 3 may Process those files solely as needed to complete the applicable job. Company will not instruct those Subprocessors to retain Customer media or transcripts after the job finishes, except for residual copies overwritten in the ordinary backup cycle and not used for any other purpose.

(e) Account data, billing and subscription records, and security or diagnostic logs that do not contain Customer Content remain subject to Section 12.1.

(f) Residual copies, if any, that cannot be immediately erased from encrypted backups or similar immutable systems will be overwritten in the ordinary course, will remain subject to this DPA, and will not be restored except as required to provide the Services or comply with law.

(g) Captions, transcripts and edits that the Services write into Customer's local Adobe Premiere Pro project remain on Customer's own systems under Customer's control and are not affected by this Section.

Jobs created while zero data retention is not enabled are subject to Section 12.1. Turning zero data retention off applies only to jobs created after the change.

13. Audit and Compliance Information

Company will make available to Customer all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, such as the TOMs, completed security questionnaires, and the Subprocessor list, and will allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer who is bound by confidentiality. Customer will first seek to satisfy its audit needs through such documentation. Any audit must be limited to the Services and Customer Personal Data, occur no more than once per calendar year unless required by a supervisory authority or following a Security Incident, be conducted during normal business hours with at least thirty (30) days' notice (or shorter notice where required by a supervisory authority or following a Security Incident), avoid unreasonable disruption to Company operations, and protect Company and third-party confidential information. Because Company's systems are operated by cloud providers, inspections will be performed by remote review of documentation, configurations and evidence; for the providers' facilities, Company may rely on the providers' current independent audit reports (such as SOC 2 Type II or ISO/IEC 27001). Customer bears its own costs of an audit, and Company may charge reasonable fees for time spent on on-site or third-party assessments beyond one business day, unless the audit reveals a material breach of this DPA by Company.

14. International Transfers

14.1 Company is established in the United States. Customer Personal Data is Processed in the United States and in the other locations of the Subprocessors set out in Annex 3.

14.2 To the extent legally required for transfers of Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country not recognised as providing an adequate level of protection, the following apply and are incorporated into this DPA:

(a) EEA transfers. The SCCs (Module Two: controller to processor) are incorporated by reference and form part of this DPA, with Customer as data exporter and Company as data importer. The SCC elections and completed annex information are set out in Annex 4. In case of conflict between the SCCs and this DPA or the Agreement, the SCCs prevail.

(b) UK transfers. The UK Addendum is incorporated by reference and forms part of this DPA. Table 1 is completed with the party details in Annex 4; Table 2 refers to the SCCs Module Two as completed in Annex 4; Table 3 is completed with Annexes 1 to 3; for Table 4, neither party may end the UK Addendum under its Section 19. The Information Commissioner's Office is the competent supervisory authority.

(c) Swiss transfers. Where the Swiss FADP applies, the SCCs apply with the adaptations required by Swiss law, including treating references to the GDPR as references to the FADP, references to "Member State" as including Switzerland (so that data subjects in Switzerland can enforce their rights in their place of habitual residence), and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

14.3 Company does not participate in the EU-U.S. Data Privacy Framework or any other voluntary transfer certification, and relies on the SCCs.

14.4 Transfer impact assessment. Company has assessed, as required by Clause 14 of the SCCs, the laws and practices of the United States applicable to the transfer, as summarised in Annex 5, and warrants that it has no reason to believe those laws and practices prevent it from fulfilling its obligations under the SCCs. Company will notify Customer promptly if it has reason to believe that this is no longer the case.

14.5 For onward transfers to Subprocessors, Company will ensure a lawful transfer mechanism is in place, such as the Subprocessor's SCCs (Module Three where Company is the exporter), the Subprocessor's certification under the EU-U.S. Data Privacy Framework, or an adequacy decision.

15. No Sale; No Cross-Context Behavioural Advertising

Company will not sell Customer Personal Data or share Customer Personal Data for cross-context behavioural advertising as those terms are defined under applicable U.S. state privacy laws. Company will not retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer except as permitted by this DPA or required by law.

16. Aggregated Service Data

Company may compile aggregated, anonymised statistics about the operation and use of the Services (for example, job counts, processing times, error rates, minutes used and feature usage) to secure, maintain and improve the Services and for its business purposes, provided that such statistics do not contain Customer Content, do not identify Customer or any individual, and Company does not attempt to re-identify them. Company will not create such statistics from the content of Customer's media, transcripts or captions.

17. HIPAA, PCI, and Other Regulated Data

The Services are not designed for Processing protected health information subject to HIPAA, cardholder data subject to PCI-DSS, or other highly regulated data unless the parties enter into a separate written agreement expressly covering that data. Customer will not submit such data to the Services unless expressly authorised in writing by Company.

18. Liability

All claims arising out of or relating to this DPA are subject to the limitations and exclusions of liability in the Agreement, to the extent permitted by Applicable Data Protection Law. This DPA does not create any uncapped, separate, or additional liability unless the parties expressly agree otherwise in a signed writing. Nothing in this Section limits either party's liability towards data subjects under Article 82 GDPR or Clause 12 of the SCCs.

19. Term and Order of Precedence

This DPA remains in force for as long as Company Processes Customer Personal Data on Customer's behalf. If there is a conflict between this DPA and the Agreement regarding Processing of Customer Personal Data, this DPA controls, except that the SCCs control for restricted international transfers as stated in Section 14. The Agreement controls for all commercial, product, payment, insurance, support, intellectual property, warranty, and general liability terms.

20. Changes; Notices; Form

The parties will cooperate in good faith to amend this DPA if reasonably necessary to comply with a change in Applicable Data Protection Law or a binding regulatory requirement applicable to the Services. Company may update this published DPA from time to time, provided that an update does not reduce the overall level of protection for Customer Personal Data; Company will notify Customer of material changes in accordance with Section 9.3. This DPA is concluded in electronic form, which suffices under Article 28(9) GDPR.

Notices under this DPA may be sent by email to:

• Company: Danny Perry, Founder & CEO, admin@pluginplay.app
• Customer: the email address of Customer's account owner or administrator, or any privacy contact Customer designates in writing to admin@pluginplay.app.

Annex 1: Description of Processing (also SCC Annex I.B)

Subject matter. Company's provision of the Services to Customer under the Agreement.

Duration. For the term of the Agreement and until deletion under Section 12.

Nature of Processing. Receiving, storing, transcribing, analysing, transforming, transmitting and deleting data: upload of audio extracted from media (and, for reframing, a rendered video proxy) from the Premiere Pro extension to Company's cloud storage; speech-to-text transcription; AI-assisted analysis of transcript text (for example, clip selection, editing suggestions and the AI editing agent); generation of captions and edit decisions returned to Customer's local Premiere Pro project; account administration; support.

Purpose of Processing. To provide, secure, support, maintain and troubleshoot the Services for Customer, including captioning, transcription, AutoCut, AutoCrop/reframing, AI-assisted editing features, account and seat administration, and customer support.

Categories of data subjects. Customer's authorised users and administrators; individuals who communicate with Company on Customer's behalf; and individuals whose Personal Data is included in Customer Content (for example, people who are heard or seen in Customer's media).

Categories of Personal Data. (a) Account data: name, business email address, organisation membership and role, authentication data (password hash, one-time email sign-in codes, session tokens), device identifiers and names of authorised Premiere Pro installations; (b) usage and diagnostic data: job records (type, status, duration, minutes used, timestamps), IP address and technical logs, error reports; (c) Customer Content: audio (voices) and, for reframing features, video (images) of individuals in Customer media; transcripts and caption text, which may contain names or other information spoken in the media; prompts to AI features; project metadata such as file and sequence names; (d) support communications.

Sensitive data. None intended (see Section 5). Voice recordings and video images are not processed to uniquely identify individuals; the optional speaker-separation feature runs locally on Customer's computer.

Frequency of transfer. Continuous, as initiated by Customer's authorised users through use of the Services.

Retention. Customer Content: for jobs covered by zero data retention (Section 12.2), uploaded media, transcripts, captions and AI inputs and outputs are deleted within sixty (60) minutes after each job finishes and in any event within twenty-four (24) hours; otherwise, while the account is active and until deleted under Section 12.1. Account data and job metadata: for the term of the Agreement, then deleted under Section 12.1. Database backups: retained for seven (7) days on a rolling basis.

Transfers to Subprocessors. As set out in Annex 3, for the subject matter, nature and duration described in this Annex.

Annex 2: Technical and Organisational Measures (also SCC Annex II)

The technical and organisational measures are set out in Brevidy's Technical and Organisational Measures, available on request at admin@pluginplay.app, which form part of this DPA. A summary is published at https://www.brevidy.pro/security. They are structured by Article 32(1)(a)-(d) GDPR and cross-referenced to the control objectives customary in Germany (Zutritts-, Zugangs-, Zugriffs-, Weitergabe-, Eingabe-, Auftrags- und Verfügbarkeitskontrolle, Trennungsgebot). The measures Subprocessors must take to assist Customer are described in Section 9 and Annex 3.

Annex 3: Subprocessors (also SCC Annex III)

Customer authorises the Subprocessors listed at https://www.brevidy.pro/subprocessors as of the Effective Date, which list forms part of this DPA. Not every Subprocessor receives every category of Customer Personal Data; feature-specific providers receive Customer Content only when Customer's users use the relevant feature. Each Subprocessor is bound by data processing terms, which for these providers form part of their standard customer agreements. Company may update the list in accordance with Section 9.

Annex 4: Standard Contractual Clauses Elections

The SCCs (Module Two: controller to processor) are incorporated by reference and completed as follows.

Annex I.A: List of parties

Data exporter (controller): Customer, with the name, address and contact person set out in Customer's account or order form. Data protection officer (if appointed): as notified by Customer. Activities relevant to the transfer: use of the Brevidy Services as described in Annex 1. Role: Controller. Signature and date: Customer's acceptance of the Agreement, which constitutes signature of the SCCs and this Annex.

Data importer (processor): Plugin Play LLC (d/b/a Brevidy), 1724 Rosecrans Drive, Lexington, Kentucky 40504, United States. Contact person: Danny Perry, Founder & CEO, admin@pluginplay.app. Activities relevant to the transfer: provision of the Services as described in Annex 1. Role: Processor. Signature and date: Company's publication of this DPA and provision of the Services under the Agreement, which constitutes signature of the SCCs and this Annex.

Annex I.B: Description of transfer. As set out in Annex 1.

Annex I.C: Competent supervisory authority. The supervisory authority competent for the data exporter in accordance with Clause 13 of the SCCs: where the data exporter is established in an EU Member State, the supervisory authority of that Member State; where the data exporter is not established in the EU but falls within the territorial scope of the GDPR under Article 3(2) and has appointed a representative, the supervisory authority of the Member State in which its representative is established; and where it has not appointed a representative, the supervisory authority of the Member State in which the data subjects concerned are located.

Annex II: Technical and organisational measures. As set out in Annex 2.

Annex III: List of subprocessors. As set out in Annex 3.

Optional elections

• Clause 7 (Docking clause): applies.
• Clause 9(a) (Use of subprocessors): Option 2, general written authorisation, with at least fourteen (14) days' prior notice as stated in Section 9.3.
• Clause 11(a) (Redress): the optional language is not used.
• Clause 13 (Supervision): the supervisory authority set out in Annex I.C.
• Clause 17 (Governing law): Option 1. The SCCs are governed by the laws of Ireland.
• Clause 18(b) (Choice of forum and jurisdiction): the courts of Ireland.

Annex 5: Transfer Impact Assessment Summary

Transfer. Customer Personal Data described in Annex 1 is transferred from the European Economic Area, the United Kingdom or Switzerland to Company in the United States and Processed in the U.S. data centres of the Subprocessors listed in Annex 3 (primary database and storage: Amazon Web Services us-west-1, Northern California, via Supabase).

Transfer tool. SCCs Module Two between Customer and Company (with the UK Addendum and Swiss adaptations where applicable); SCCs Module Three or EU-U.S. Data Privacy Framework certification between Company and its U.S. Subprocessors. Company itself is not certified under the Data Privacy Framework.

Laws of the destination country. U.S. authorities may request data under criminal procedure (e.g. warrants under the Stored Communications Act / CLOUD Act) and, for national security purposes, under Section 702 FISA and Executive Order 12333. Executive Order 14086 (2022) introduced necessity and proportionality limits and a redress mechanism (Data Protection Review Court) for EU individuals; these safeguards apply to all data transferred to the United States, irrespective of the transfer tool used, and were taken into account by the European Commission in its adequacy decision of 10 July 2023.

Practical experience. Company is a small software company whose Services Process business media for captioning and editing. Company has never received a request from a public authority for customer data. Customer Content is not of a type that is typically of interest to intelligence services.

Supplementary measures. Encryption in transit (TLS 1.2 or higher) and at rest; access restricted to named personnel; data minimisation (only extracted audio, not video, is uploaded for transcription); optional zero data retention, deleting Customer Content within 60 minutes of job completion; no use of Customer Content for model training; the commitments in Section 11 (notify, challenge, minimise, document); transparency on request.

Conclusion. Taking into account the nature of the data, the supplementary measures, the safeguards of Executive Order 14086, and the absence of any public-authority requests, Company considers that U.S. law and practice do not prevent it from complying with the SCCs for this transfer. Company will re-assess if circumstances change, in particular if the Commission's adequacy decision for the United States is invalidated.

Acceptance and Countersigned Copies

This DPA is accepted by Customer agreeing to the Terms of Use or signing an order form that references them, and by Company making the Services available under them. No separate signature is required. Customers that need a countersigned copy can request one at admin@pluginplay.app.