Parties & roles
Controller: Client (decides why and how personal data is processed for the project).
Processor: VidCity.co (processes data on Controller’s instructions).
Purpose & scope
VidCity processes personal data strictly to perform project services (editing, animation, storage, delivery). Categories of data include contact details, project files, talent data, and any client-provided personal data.
Subprocessors
We may engage subprocessors (cloud storage, render farms, hosting, analytics). We will provide a current list on request and obtain client approval for any new subprocessor when required.
Security measures
We implement appropriate technical and organizational measures (access controls, encryption, backups, staff confidentiality obligations).
Data subject rights & cooperation
We will assist Controller with data subject requests (access, rectification, deletion) to the extent required by law.
Breach notification
We notify Controller without undue delay after discovering a personal data breach affecting Controller’s data.
Return & deletion
After services end, we will delete or return personal data as instructed by Controller, within agreed timelines, unless retention is required by law.
Audits
Controller may audit compliance, subject to reasonable notice and confidentiality protections, or receive summary evidence of compliance.
Liability & indemnity
Liability terms to be agreed in the contract (recommended: caps and mutual indemnities suited to contract value and risk).
