Legal

Data Processing Addendum

[LEGAL REVIEW REQUIRED] This addendum sets out the data-processing terms that attach to a Firsthand commercial agreement. It is placeholder language and has not been reviewed by counsel.

Effective: Draft — not yet effective

1. Roles

[LEGAL REVIEW REQUIRED] For participant footage collected to your specification, the parties will confirm in the order form whether Firsthand acts as an independent controller or as your processor. This determines the obligations that follow.

2. Processing scope

[LEGAL REVIEW REQUIRED] Personal data is processed only to collect, de-identify, quality-check, and deliver the datasets described in the order form, and for no other purpose without instruction.

3. Security measures

[LEGAL REVIEW REQUIRED] Firsthand maintains technical and organizational measures appropriate to the risk, including access controls, encryption in transit and at rest, and the de-identification pipeline. A SOC 2 Type II audit is in progress; the report will be available under NDA once complete.

4. Sub-processors

[LEGAL REVIEW REQUIRED] A current list of sub-processors (for storage, delivery, and de-identification tooling) will be maintained and made available on request, with notice of material changes.

5. International transfers

[LEGAL REVIEW REQUIRED] Where data is transferred across borders, the parties will rely on an appropriate transfer mechanism such as Standard Contractual Clauses, to be attached to the signed agreement.

6. Contact

Data-processing questions can be sent to support@cloudpano.com.