Data Processing Agreement

Last updated: August 10, 2026

This Data Processing Agreement (“DPA”) forms part of the Transcodely Terms of Service and applies automatically, without separate signature, to every customer whose use of the Service involves the processing of personal data subject to the GDPR, the UK GDPR, or similar data protection laws (“Data Protection Law”). It implements Article 28 GDPR. If you require a countersigned copy for your records, email admin@transcodely.com.

Contents

1. Scope, Parties & Roles

The parties are the customer identified by the Transcodely account (“Customer”) and Transcodely, operated by Dimitar Todorov (“Transcodely”).

  • For Customer Data (defined in Section 2), the Customer is the controller (or a processor acting for another controller) and Transcodely is the processor. This DPA governs that processing.
  • For the Customer’s own account, billing, request-log, and support data, Transcodely is an independent controller; that processing is described in the Privacy Policy and is not subject to this DPA.

2. Details of the Processing

Description
Subject matterVideo transcoding, storage, hosting, and delivery services, as configured by the Customer through the API and dashboard
DurationThe term of the Customer’s agreement with Transcodely, plus the deletion period in Section 10
Nature and purposeReceiving, storing, transcoding, packaging, and delivering media files; generating derived artifacts the Customer requests (renditions, manifests, thumbnails, captions, chapters); collecting playback telemetry for the Customer’s analytics
Customer Data — categories(a) Media content uploaded or fetched on the Customer’s instruction, which may contain any personal data the Customer includes in it (images, voices, names, subtitles); (b) transcripts derived from that content where the Customer enables AI captions; (c) playback telemetry of the Customer’s viewers (random session identifier, video watched, playback position, and delivery metadata such as IP address and user agent at the CDN)
Data subjectsIndividuals appearing or speaking in the Customer’s media; viewers of the Customer’s videos; other individuals whose data the Customer includes in content
Special categoriesNot intended by the Service; may be incidentally present in media content the Customer chooses to process. The Customer is responsible for the lawfulness of processing such content

3. Instructions

Transcodely processes Customer Data only on the Customer’s documented instructions — namely: the Terms, this DPA, and the configuration the Customer sets through the API and dashboard (job parameters, storage and visibility settings, enabled features, deletion actions) — unless processing is required by EU or member-state law, in which case Transcodely will inform the Customer before processing unless that law prohibits it. Transcodely will inform the Customer if, in its opinion, an instruction infringes Data Protection Law. Transcodely does not use Customer Data to train AI or machine-learning models.

4. Confidentiality

Access to Customer Data is limited to persons who need it to provide the Service and who are bound by confidentiality obligations. Transcodely does not view the substance of Customer media except as described in the Privacy Policy (requested processing, abuse investigation, support with consent, legal compulsion). Administrative access to customer accounts is recorded in an append-only audit log that cannot be deleted.

5. Security Measures

Taking into account the state of the art and the nature of the data, Transcodely implements and maintains at least the following technical and organizational measures:

  • Encryption in transit (TLS) for all connections, including database connections;
  • Encryption at rest of stored credentials and content-protection secrets (AES-256-GCM with dedicated keys); provider-level disk encryption for databases and object storage;
  • API keys stored only as hashes (SHA-256) with constant-time verification; secrets displayed once at creation;
  • HMAC-SHA-256 signing of webhook payloads for authenticity verification;
  • Access controls scoping every API credential to a single app and organization; owner-only access to billing;
  • Signed, time-limited URLs for private content delivery;
  • An immutable (deletion-blocked) audit log of administrative actions on customer accounts;
  • Scrubbing of error telemetry (cookies, query strings, request bodies, and known-sensitive values removed) before it leaves the platform;
  • EU-located core infrastructure by default (see Section 9);
  • Automatic time-based purging of request logs, playback events, and other transient data per the retention schedule in the Privacy Policy.

Transcodely may update these measures over time, provided the overall level of protection is not reduced.

6. Subprocessors

  • The Customer grants general authorization for the subprocessors listed at transcodely.com/subprocessors, which states each subprocessor’s function, data categories, and location.
  • Transcodely will update that page at least 14 days before adding or replacing a subprocessor that processes Customer Data. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service without penalty. The Service is metered in arrears, so the Customer pays only for usage already incurred up to termination.
  • Transcodely imposes data protection obligations on each subprocessor equivalent to those in this DPA and remains liable for its subprocessors’ performance.

7. Assistance to the Customer

Taking into account the nature of the processing, Transcodely will assist the Customer with appropriate technical and organizational measures in fulfilling the Customer’s obligations to respond to data subject requests (access, rectification, erasure, restriction, portability, objection), and — considering the information available to Transcodely — in meeting the Customer’s obligations regarding security, breach notification, data protection impact assessments, and prior consultation. If a data subject contacts Transcodely directly about Customer Data, Transcodely will refer them to the Customer without undue delay. In practice, most requests can be fulfilled by the Customer directly through the API (for example, deleting a video deletes its stored source, outputs, and cached copies).

8. Personal Data Breaches

Transcodely will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide the information reasonably required for the Customer’s own notification obligations as it becomes available: the nature of the breach, categories and approximate volumes affected, likely consequences, and measures taken or proposed. Notification is sent to the Organization’s registered email address.

9. International Transfers

Customer Data is processed in the European Union by default: the control plane in Belgium, the database in Frankfurt, and transcoding compute and managed storage in Germany and Finland. CDN delivery necessarily serves content from edge locations near the viewer. Where Customer Data is transferred to a third country (see the subprocessor list for locations, and the EU-capacity failover note there), the transfer is protected by an adequacy decision — including the EU–US Data Privacy Framework where the recipient is certified — or by the European Commission’s Standard Contractual Clauses (Module 2 or 3, as applicable), which are incorporated by reference and deemed executed between the parties where required.

10. Deletion & Return of Data

  • During the term, the Customer deletes and retrieves Customer Data self-service through the API and dashboard: media can be downloaded at any time, and deleting a video removes its files from managed storage and purges CDN caches (edge caches expire on their time-to-live).
  • On termination or account closure, Transcodely deletes remaining Customer Data within 30 days, unless EU or member-state law requires longer storage of specific data. Backup and transient copies age out on their fixed cycles within that window.

11. Audit & Information Rights

On request, Transcodely will make available the information reasonably necessary to demonstrate compliance with this DPA — including this document, the subprocessor list, and written answers to reasonable security questionnaires (at most once per 12 months, unless a breach or supervisory authority requires otherwise). Where Data Protection Law grants the Customer a mandatory audit right that cannot be satisfied this way, the Customer may conduct (directly or through an independent, non-competitor auditor under confidentiality) an audit limited in scope, at reasonable notice, during business hours, at the Customer’s expense, and no more than once per 12 months.

12. Liability & Precedence

Each party’s liability under this DPA is subject to the limitations of liability in the Terms of Service, except where Data Protection Law does not permit such limitation. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Data; if the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail. This DPA is governed by the same law as the Terms, without prejudice to mandatory provisions of Data Protection Law.

Questions about this DPA: admin@transcodely.com.