Courtesy translation: only the French version is legally binding. Read the French version

Data processing agreement

Within the meaning of Art. 9 FADP and Art. 28 GDPR. It applies as soon as you open an account: nothing to sign, nothing to request.

When you use Emodio to produce videos concerning your own customers, you are the controller and we are the processor. This agreement sets out what that entails. It forms part of the terms and conditions and prevails over them in the event of conflict on this subject.

1. Subject matter, duration, nature

We process personal data on your behalf, for the sole purpose of providing the service: making videos from what you write and what you upload. The duration is that of your account. The data subjects are your staff and, where applicable, the people appearing in the media you upload. The categories of data are those listed in the privacy policy.

2. Instructions to us

We process this data only on your documented instructions (use of the product constitutes an instruction), unless required to do so by law, in which case we inform you beforehand, unless the law prohibits it. We never use your data for our own purposes, nor to train a model.

3. Confidentiality

The people on our side who can access your data are bound by confidentiality. Support access to your account, to help you, is only possible for an administrator, it is logged by name, and it is announced by a banner visible on every page for as long as it lasts. You may ask us for the list of these accesses at any time.

4. Security

• Encryption in transit (HTTPS) and at rest with our hosting providers.
• Hashed passwords; we cannot read them.
• Separation by organisation verified by an automated test on every code change: not by review.
• Code written by the model runs in a disposable container, with no network and no access to our secrets.
• Regular backups, whose restoration is tested automatically.
• Rate limiting on costly routes, audit log retained.

5. Sub-processors

You give us general authorisation to engage the providers listed in the privacy policy, which is kept up to date. We inform you by e-mail before any addition or replacement, and you may object by cancelling free of charge. Each of them is bound by obligations at least equivalent to these.

6. Transfers outside Switzerland and the EU

The model, the voice, image generation, payment, the sending of e-mails and sign-in with Google go through providers established in the United States. These transfers are based on the Data Privacy Framework (Swiss–US and EU–US) for certified providers and, failing that, on the standard contractual clauses of the European Commission, with the adaptations recognised by the FDPIC. The database, the files and the rendering server (Hetzner, Germany), on the other hand, remain in Europe.

7. Assistance

We help you respond to requests from data subjects: a complete export of the data is available in one click from the product, and so is deletion. We also help you with your impact assessments and prior consultations, to the extent of what we know about the processing.

8. Data breach

If a breach affects your data, we notify you within 48 hours of becoming aware of it, with what we know: what happened, which data, how many people, and what we are doing. We do not notify the authority on your behalf, that is your role as controller, but we give you everything you need to do so within the deadlines.

9. Return and erasure

At the end of the contract, you retrieve your data in one click. Erasure takes place at your request, within 7 days, database and files included. Only invoices are kept for 10 years (Swiss accounting obligation), and they are kept without your name.

10. Audit

On request, we provide you with the information necessary to demonstrate compliance with this agreement. An on-site audit is possible once a year, subject to reasonable notice and at your expense.

Victoria Gaillard Sàrl, Avenue des Alpes 90, 1820 Montreux, IDE CHE-103.457.224. This page is the version in force: it is dated by the deployment that published it. Write to us at bonjour@emodio.ch if your customer asks for a signed version.