Data Processing Agreement (DPA)

This agreement applies to business customers who upload recordings to Circla that contain the personal data of third parties. It sets out the terms on which we process that data on your behalf, in accordance with Art. 28 GDPR.

If you are a Consumer, this agreement does not apply to you. See the Privacy Policy.

§ 1. Parties and scope

1.1. Controller (you, the Customer) — a User who uses the Service in the course of a business or profession and uploads User Content containing the personal data of third parties.

1.2. Processor (Circla, we) — Mateusz Czerwiński, a sole trader registered in the Polish Central Register and Information on Business Activity (CEIDG), trading as "Mateusz Czerwiński", service address: ul. Twarda 18, 00-105 Warsaw, Poland, tax ID (NIP) 9571051219, statistical number (REGON) 362940234.

1.3. This agreement is concluded together with the contract for the Service (Terms § 17) and applies for its duration.

1.4. This agreement takes precedence over the Terms in relation to the processing of personal data entrusted by the Customer.

§ 2. Subject matter, nature and purpose of processing

2.1. Subject matter: personal data contained in User Content uploaded by the Customer to the Service, and in Generated Materials.

2.2. Nature and purpose: processing solely in order to provide the Service to the Customer, namely: storing recordings, normalising them technically, extracting the audio track, transcribing speech to text, analysing the transcript with language models to identify segments, detecting the position of a face in frame for reframing, generating clips and captions, indexing the transcript for search, and making the results available to the Customer.

2.3. Circla does not process entrusted data for any other purpose. In particular it does not use it to train machine learning models, does not profile data subjects and does not share data for marketing purposes.

2.4. Duration: for the term of the contract for the Service, subject to § 9.

§ 3. Categories of data subjects and data

3.1. Categories of data subjects:

• people appearing in the Customer's recordings — participants, speakers, guests, employees;
• people whose data appears in a screen recording — in particular the Customer's clients and counterparties;
• people mentioned in speech captured on the recording.

3.2. Categories of data:

• image and voice;
• the content of speech and its transcript;
• data visible in a screen recording — which may include names, e-mail addresses, phone numbers, correspondence content and data held in the Customer's systems;
• coordinates of face position in frame (with no biometric template created — see Privacy Policy § 11).

3.3. Special categories of data (Art. 9 GDPR). The Service is not intended for processing special categories of data or data on criminal convictions. If the Customer's recordings may contain such data — for example health data in recorded consultations — the Customer undertakes to inform us before processing begins, so that admissibility can be assessed and additional safeguards agreed if needed.

§ 4. Circla's obligations

4.1. We process data only on the Customer's documented instructions, which consist of the Customer's use of the Service's features. If Union or Polish law imposes on us an obligation to process beyond those instructions, we will inform the Customer before processing, unless the law prohibits it.

4.2. If in our view an instruction from the Customer infringes the GDPR, we will inform them promptly.

4.3. We ensure that persons authorised to process the data have committed to confidentiality.

4.4. We implement appropriate technical and organisational measures (Art. 32 GDPR) — listed in § 5.

4.5. We assist the Customer in complying with Art. 32-36 GDPR, in particular with breach notification and data protection impact assessments.

4.6. We assist the Customer in responding to data subject requests — see § 7.

4.7. We maintain a record of categories of processing activities (Art. 30(2) GDPR).

§ 5. Security measures (Art. 32 GDPR)

5.1. We apply, in particular:

a) encryption in transit — TLS for all traffic;

b) encryption at rest — database and cache;

c) no public access to file storage — access only through signed links, valid for 1 hour by default;

d) access control — token authentication, sessions in httpOnly cookies, CSRF protection, separation of privileges;

e) logging of security events and of all administrative actions, including every use of the Account-impersonation feature;

f) a web application firewall and request rate limiting;

g) database backups;

h) automated deletion of data once retention periods expire, carried out by scheduled jobs.

5.2. Honest caveat about process maturity. We do not today have a formalised, documented schedule of backup restore testing, a periodic access-rights review beyond the ongoing control described in § 5.1, or a separate, written vulnerability management procedure. If this is an important criterion for you in choosing a provider, ask us about the current state of these processes before entering into a contract — we would rather disclose this plainly than declare something we do not yet do.

§ 6. Subprocessors

6.1. The Customer gives general authorisation for us to engage the subprocessors listed in § 6.3.

6.2. We conclude an agreement with each subprocessor imposing obligations no less protective than those in this agreement, and we remain liable for its acts and omissions.

6.3. Current list of subprocessors:

6.4. We will give notice of an intended change — adding or replacing a subprocessor — at least 30 days in advance, by e-mail and by updating this list.

6.5. The Customer may raise a reasoned objection to a change within 14 days of notice. If we cannot find a solution accommodating the objection, the Customer may terminate the contract for the Service with effect from the date the change takes effect, at no cost and with a pro-rata refund of fees for the unused period.

§ 7. Data subject rights

7.1. If a data subject approaches us directly with a request concerning data entrusted by the Customer, we will not handle it ourselves — we will pass it to the Customer promptly.

7.2. At the Customer's request we provide technical assistance in giving effect to rights under Art. 15-22 GDPR. The Customer exercises them primarily itself, using the Service's features:

• access and portability — data export and download of recordings and clips;
• erasure — deleting a recording or the Account;
• rectification — editing the transcript and captions in the editor.

7.3. Assistance going beyond the Service's features and requiring significant effort may be charged at an agreed rate, of which we will notify the Customer before undertaking it.

§ 8. Personal data breaches

8.1. We will notify the Customer of a breach affecting entrusted data without undue delay and no later than within 48 hours of becoming aware of it.

8.2. The notification will cover: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken and proposed, and contact details for the person handling the matter — to the extent that information is known to us.

8.3. Notification of the breach to the supervisory authority and to data subjects is made by the Customer as controller. We provide the necessary assistance.

8.4. We do not notify the authority or data subjects on the Customer's behalf without its express instruction.

§ 9. Termination and return of data

9.1. On termination of the contract for the Service we delete the entrusted data, on the timelines in Privacy Policy § 8 — that is, after the 30-day recovery window expires.

9.2. Before deletion the Customer may download the data — recordings and clips from the Library, Account data via export. We recommend doing this before deleting the Account.

9.3. We retain data only to the extent required by Union or Polish law — in particular billing records for 5 years from the end of the tax year. Such data remains protected on the terms of this agreement.

9.4. Caveat: database backups are deleted as they rotate, and data held by the subprocessors listed in Privacy Policy § 8.4 currently requires a manual deletion procedure — we carry it out at the Customer's request. Automating this process is a planned improvement, not today's state — until it ships, the manual procedure above governs.

9.5. At the Customer's request we will confirm deletion in writing.

§ 10. Audit and inspection

10.1. At the Customer's request we make available the information necessary to demonstrate compliance with Art. 28 GDPR.

10.2. We allow the Customer, or an auditor it authorises, to conduct an audit, including an inspection, subject to the following:

a) at least 30 days' notice;

b) no more than once a year, unless the audit arises from a personal data breach or a request from a supervisory authority;

c) during business hours and in a way that does not disrupt the Service;

d) the auditor is bound by confidentiality and is not a competitor of ours;

e) the audit may not extend to other customers' data or to information covered by third parties' trade secrets.

10.3. The Customer bears the cost of the audit, except for an audit that reveals a material breach of this agreement on our part.

10.4. Current state. We do not today hold an ISO 27001 certification or a SOC 2 report — at our current stage this would be disproportionate to the size of the business. Individual audits under § 10.2-10.3 therefore remain the verification mechanism. We will revisit this if the scale of our work with business customers warrants it.

§ 11. Transfers outside the European Economic Area

11.1. Entrusted data is processed in the United States, because the Service's infrastructure runs in the AWS us-east-1 region. Data also goes to the other subprocessors listed in § 6.3.

11.2. The transfer bases for individual subprocessors, verified in September 2026, are set out in Privacy Policy § 6.3 — some rely on current EU-US Data Privacy Framework certification, others on Standard Contractual Clauses (SCCs) incorporated in that provider's own standard data processing terms. We have not carried out a separate, formal transfer impact assessment (TIA) for any subprocessor — if you need one for your own compliance records, write to us at the address in § 12.4.

11.3. The Customer acknowledges that the location of the infrastructure in the USA is a material characteristic of the Service, and that it should assess the admissibility of such a transfer for its own purposes before choosing the Service.

§ 12. Liability and final provisions

12.1. The parties' liability is governed by the Terms and by Art. 82 GDPR.

12.2. Matters not covered here are governed by the Terms and by Polish law.

12.3. This agreement exists in a Polish and an English version. In the event of any discrepancy, the Polish version prevails.

12.4. Contact regarding this agreement: [email protected].