Data Processing Addendum

This DPA applies only where Provider processes personal data on behalf of Customer within the Services. For such processing, Customer is Controller and Provider is Processor, unless Parties document another arrangement. Each Party is an independent controller for its own business contacts, invoicing, fraud prevention and legally mandated compliance records where it determines purposes and means.

Subject matter: hosting and processing account data, API requests, Customer Input and generated content for Corny Studio. Duration: Service term plus agreed deletion and backup retention. Nature/purpose: receiving, transmitting, storing, generating, securing, moderating and deleting data to deliver contracted Services. Provider shall process personal data only on Customer’s documented instructions, including documented data-transfer instructions, unless law requires otherwise, in which case Provider shall inform Customer unless prohibited.

Data subjects may include Authorized Users, Customer staff, reference individuals lawfully included in Input and end users whose data Customer lawfully submits. Categories may include identifiers, emails, IP addresses, account logs, prompts, user-submitted text, images or media; special-category data and biometric or explicit imagery must not be submitted without prior written approval, appropriate lawful basis and agreed safeguards. Customer shall minimize submitted data and is responsible for lawful collection and required notices.

Provider shall bind authorized staff to confidentiality and implement risk-appropriate security: least-privilege access, MFA for administrative access, TLS in transit, encryption at rest where appropriate, key management, security monitoring, backup and restore processes, vendor due diligence, vulnerability remediation, controlled production access and secure deletion. A detailed technical and organizational measures annex shall be attached before signing [ANNEX TOM].

Customer gives general written authorization for subprocessors listed at [SUBPROCESSOR LIST URL/ANNEX]. Provider shall inform Customer [30] days before intended additions or replacements where practicable and provide a reasonable objection process for demonstrable data-protection risks. Provider shall impose substantially equivalent Article 28 data protection obligations on subprocessors and remain liable to Customer for their performance as required by law. Provider shall not permit subprocessors to train AI models on Customer content.

Provider shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data, with information reasonably available to assist Customer in meeting its legal notification duties. [OPERATIONAL TARGET: e.g., within 24 hours after confirmation, TO NEGOTIATE.] Provider shall reasonably assist with data subject requests, DPIAs, regulator consultations and security evidence, taking into account processing and available information; Customer remains responsible for its controller-side decisions.

No transfer of personal data outside the EEA or an adequate-protection destination shall occur without a valid transfer mechanism, including the applicable EU Standard Contractual Clauses (SCCs) where required, documented transfer assessment and supplementary measures as appropriate. The applicable SCC module, parties, annexes and competent supervisory authority must be selected and appended before any restricted transfer. This DPA alone is not a substitute for completed SCCs.

Provider shall supply information necessary to demonstrate compliance and permit and contribute to audits/inspections as required by GDPR Article 28, subject to reasonable confidentiality, security and scheduling safeguards. Provider may initially make independent audits, certifications and technical evidence available; this does not extinguish mandatory rights of inspection.

At Customer’s choice upon termination, Provider shall return or delete personal data after [30] days, unless law requires retention; remaining backups will be isolated and deleted within [90] days or [AGREED PERIOD], subject to actual architecture. Provider shall confirm completion on request and continue security obligations during retention.

Provider shall not use Customer personal data or content for model training, fine-tuning, benchmarking or general product improvement and shall impose the same restriction on approved subprocessors. Provider may process only the minimum data required for contracted inference, support, lawful abuse detection and security. Any further purpose requires separate lawful basis and documented agreement and cannot be inferred from this DPA.

For personal-data processing matters this DPA overrides inconsistent MSA provisions. Nothing relieves either Party of direct duties under GDPR or applicable data protection law. Governing law and venue are as in MSA to the extent lawful; regulator and data subject rights are unaffected.

Nature, purpose, duration and data categories are described above; specify actual retention, location, systems, transfer flows, controller contacts, documented instructions and end-user interaction paths: [COMPLETE].

Attach actual security control inventory, access management, authentication, encryption, backups, logging, incident handling, physical security, development practices, penetration testing, and vendor access controls. No unsupported certification or technical commitment should be inserted.

List legal name, service, processing purpose, data region, subprocessor role, onward transfers and transfer safeguards for each cloud, AI inference, content moderation, logging and support vendor.