Data Processing Agreement

This agreement covers the personal data in the content a customer brings to Showcase™ or creates in it. It forms part of our Terms of Service and applies automatically to every customer; nothing needs to be signed for it to take effect. If a customer has a separate signed agreement with us about data processing, that agreement takes priority where the two differ.

“We” and “us” mean Front&Centre®, a trading name of Neuro Spicy Ltd (England and Wales, company number 15218263; Information Commissioner’s Office registration ZC200663). “You” means the customer: the organisation or individual whose workspace it is. “Data protection law” means the UK GDPR and the Data Protection Act 2018.

For the personal data in your content, you are the controller and we are your processor. You decide what is brought to the Service and what is done with it; we process it only to provide the Service to you and on your documented instructions, which are these terms and the choices you and your people make in the Service. If the law requires us to process it in another way, we will tell you first unless the law forbids that.

For the personal data we need to run the Service (accounts, sign-in, usage and security records, billing), we are a controller in our own right. That is covered by our Privacy Policy, not by this agreement.

Where a production partner delivers the Service to you, the partner’s staff reach your workspace to do that work. They act for you under your own agreement with the partner; this agreement governs what we do.

Subject matter and purpose: hosting and streaming your films, transcribing them, building pages from them, and drafting written content grounded in them for your people to review and publish.

Duration: for as long as you use the Service, and afterwards only as section 9 allows.

Kinds of personal data: names, job titles and contact details of the people in or around your content; their voices, likenesses and words as recorded and transcribed; and anything else your content happens to contain. The Service is not designed for special category data (for example health information) and you agree not to bring it in unless we have agreed that with you in writing.

Whose data: the people who appear or are mentioned in your films and written material, such as your staff, guests, customers and contacts.

Confidentiality: everyone we authorise to handle your content is bound to keep it confidential.

Security: we keep in place the technical and organisational measures described on our Security and Data page, and will not materially weaken them.

Helping you: taking into account what the Service does, we will help you answer requests from people exercising their rights over their data, and help you with security, breach notification and data protection impact assessments where you need our input. If a person writes to us about data in your content, we will pass the request to you promptly and not answer it ourselves unless you ask us to.

No other use: we do not sell the personal data in your content, use it for advertising, or use it to train our own or anyone else’s AI models.

You give us general authorisation to use the providers listed in section 12 of our Security and Data page to deliver the Service. Each is bound by a written contract that protects personal data to the standard data protection law requires, and we remain responsible to you for what they do with your content.

Before adding or replacing a provider that will handle the personal data in your content, we will update that list and tell account holders at least 30 days ahead. If you object on reasonable data protection grounds within that time and we cannot resolve it, you may end the affected plan and we will refund any fees paid for the period after it ends.

Some providers process data outside the United Kingdom, as the Security and Data page describes. Where they do, the transfer relies on a UK adequacy decision, or on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, as data protection law requires.

If we become aware of a breach of security leading to the accidental or unlawful loss, alteration or disclosure of, or access to, the personal data in your content, we will tell you without undue delay, and in any case within 48 hours, with what we know: what happened, what data and roughly how many people are affected, what we have done, and who to speak to. We will keep you updated as we learn more.

On reasonable request we will give you the information you need to show that this agreement is being kept, including completing your security questionnaire. If that is not enough, you (or an independent auditor bound by confidentiality) may audit our handling of your content once in any twelve months, on at least 30 days’ notice, in working hours, and without access to other customers’ data. We will tell you if we think an instruction of yours breaks data protection law.

When your use of the Service ends we will, at your choice, return the personal data in your content as an export or delete it. An export is available on request within 30 days of the end; after that we delete your content from the live Service, and it leaves our backups as they roll over. We keep only what the law requires us to keep, such as invoices.

You confirm that you have a lawful basis for the personal data you bring to the Service and that the people in your content have been told what they need to be told, including that AI-assisted tools are used to transcribe films and draft content. You are responsible for what you choose to publish.

The limits on liability in the Terms of Service apply to this agreement, except where data protection law does not allow them to. This agreement is governed by the law of England and Wales. Questions about it: david@frontandcentre.com.