Data Processing Agreement
This Data Processing Agreement (DPA) applies where Convolink Ltd processes personal data on behalf of a customer and is incorporated into our Terms of Service. It reflects Article 28 of the UK GDPR.
Last updated: 25 September 2026
1. Roles
The Customer is the controller of personal data contained in Content. Convolink is the processor. Each party will comply with applicable Data Protection Laws, meaning the UK GDPR, the Data Protection Act 2018 and PECR 2003.
2. Details of processing
| Subject matter | Provision of the Convolink async video service |
|---|---|
| Duration | The term of the Customer's subscription plus the deletion period |
| Nature and purpose | Hosting, streaming, transcribing, storing and sharing recordings and related collaboration data |
| Data subjects | Customer's employees, contractors, clients and any individuals appearing in recordings |
| Categories of data | Names, contact details, images and voice, screen contents, comments; any special category data the Customer chooses to record |
3. Processor obligations
Convolink shall:
- process personal data only on the Customer's documented instructions, including regarding international transfers, unless required by UK law;
- ensure persons authorised to process data are bound by confidentiality;
- implement appropriate technical and organisational measures (Annex 1);
- engage sub-processors only under the conditions in section 4;
- assist the Customer with data subject requests, DPIAs and consultations with the ICO;
- notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach;
- delete or return all personal data at the end of the service, unless UK law requires retention;
- make available information necessary to demonstrate compliance and allow audits, on reasonable notice, no more than once per year unless required by a regulator.
4. Sub-processors
The Customer authorises Convolink to use the sub-processors listed on our Security page, all bound by written terms no less protective than this DPA. We will give at least 30 days' notice of new sub-processors; the Customer may object on reasonable grounds and, if unresolved, terminate the affected service.
5. International transfers
Personal data is hosted in the United Kingdom. Any transfer outside the UK will rely on UK adequacy regulations, the IDTA or the UK Addendum to the EU SCCs, supported by a transfer risk assessment.
6. Liability
Each party's liability under this DPA is subject to the limitations in the Terms of Service, save that nothing limits liability to data subjects under Article 82 UK GDPR.
Annex 1 — Technical and organisational measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Role-based access control, least privilege, MFA for staff and audit logging.
- UK-region hosting with geo-redundant encrypted backups.
- Secure development lifecycle, dependency scanning and annual independent penetration testing.
- Documented incident response and business continuity plans, tested annually.
- Staff data protection training on induction and annually thereafter.
A signed copy of this DPA is available to Business customers on request from privacy@convolink.co.uk.