Home › Legal › Data Processing Agreement
Data Processing Agreement
This Data Processing Agreement ("DPA") forms an annex to the Fonti Studio General Terms and Conditions (the "Agreement") between the customer (the "Controller") and Fonti Studio, Gent, Belgium (the "Processor"; full company identification is provided at contracting and on request). The Controller and the Processor are collectively the "Parties".
Version 1.0 (14 July 2026).
1. Definitions
1.1 "Annex" means an annex to this DPA, forming an integral part of it. "Data Protection Legislation" means all legislation in force within the European Union on the protection of personal data, including Regulation (EU) 2016/679 (the "GDPR"). "Services" means the subtitle and dub production services provided by the Processor under the Agreement. "Sub-processor" means a third party engaged by the Processor to process Personal Data in the performance of the Services.
1.2 "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Supervisory Authority" and "Processing" have the meanings given to them in the GDPR.
2. Subject matter and instructions
2.1 The Processor Processes Personal Data on behalf of the Controller solely to perform the Services. The Controller determines the purposes and means of the Processing and warrants that it is entitled to have the Personal Data Processed by the Processor and that it has one or more legal grounds for the Processing, including, where the supplied materials contain the voices and likenesses of performers, an adequate rights and consent position with respect to those performers.
2.2 The Processor shall Process Personal Data only on the documented instructions of the Controller, as set out in this DPA and the Agreement, unless required to Process by EU or Member State law, in which case the Processor informs the Controller of that legal requirement before Processing (unless the law prohibits this on important grounds of public interest).
2.3 The nature and purpose of the Processing, the categories of Personal Data and of Data Subjects are described in Annex 1.
3. Confidentiality and personnel
3.1 The Processor ensures that all persons authorised to Process the Personal Data (employees, agents, subcontractors) are aware of its confidential nature and are bound by confidentiality obligations or an appropriate statutory duty of confidentiality.
4. Security
4.1 Each Party shall take appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing, as well as the risks to the rights and freedoms of natural persons. The Processor shall take at least the measures set out in Annex 3.
4.2 Given that the materials Processed typically include unreleased audiovisual content and performers' voice recordings, the Processor treats all Controller content as confidential, stores it encrypted at rest on EU-located infrastructure, and makes it accessible only through access-controlled, signed URLs.
5. Sub-processors
5.1 The Controller grants the Processor general written authorisation to engage the Sub-processors listed in Annex 2. The Processor informs the Controller at least thirty (30) days in advance of any intended addition or replacement of a Sub-processor. The Controller may object on reasonable, data-protection-related grounds within that window; if the Parties cannot agree an alternative, either Party may terminate the affected Order(s).
5.2 The Processor imposes on each Sub-processor, by contract, data-protection obligations materially equivalent to those in this DPA, and remains fully liable to the Controller, within the limits of liability agreed in the Agreement, for the performance of each Sub-processor's obligations.
6. Assistance to the Controller
6.1 Taking into account the nature of the Processing, the Processor assists the Controller, by appropriate technical and organisational measures and insofar as possible, in fulfilling the Controller's obligation to respond to Data Subject requests (Articles 12 to 23 GDPR), and, taking into account the information available to it, in ensuring compliance with the Controller's obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation). The Processor may charge reasonable costs for such assistance at its then-applicable rates, except where the need for assistance arises from the Processor's own breach of this DPA.
7. Personal Data Breach
7.1 The Processor notifies the Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting the Controller's Personal Data, and provides the information reasonably required under Article 33(3) GDPR as it becomes available. The Processor documents the breach and cooperates with the Controller's investigation, notification and mitigation efforts.
8. International transfers
8.1 Personal Data may be transferred to a third country or international organisation only in accordance with Data Protection Legislation and this DPA. The Controller authorises transfers to the Sub-processors listed in Annex 2 on the basis of: (a) an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified US providers); or (b) appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (2021/914), together with supplementary measures where required. The Processor makes summaries of the executed transfer mechanisms available to the Controller on request.
9. Audit
9.1 The Processor makes available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 GDPR, and allows and contributes to audits conducted by the Controller or an auditor mandated by the Controller, subject to the following: no more than once per contract year; at least thirty (30) days' prior written notice; during office hours; the auditor may not be a competitor of the Processor; confidentiality undertakings are given; the Processor receives a draft of the audit report and may append comments; all audit costs are borne by the Controller, and the Processor may invoice its own reasonable time at its then-applicable rates.
10. Return and deletion
10.1 Upon termination or expiry of the Services, or earlier on the Controller's written request, the Processor deletes or returns (at the Controller's choice) all Personal Data and Controller content, and deletes existing copies, unless EU or Member State law requires storage. In any event, the Processor purges Controller content no later than twelve (12) months after delivery of the last Deliverable, in accordance with the Agreement. Backup copies are deleted on the normal expiry of the backup rotation.
10.2 Voice models created to render a dub of a title (Cloned Voices) are deleted together with the Controller's content and are never reused for any other customer or title.
11. Liability and duration
11.1 The Processor may only be held liable for a breach of this DPA attributable to it, insofar as the Controller has fulfilled its own obligations. The limitations of liability set out in the Agreement apply to this DPA.
11.2 This DPA applies for as long as the Processor Processes Personal Data on behalf of the Controller.
11.3 If new regulator guidance or an amendment to Data Protection Legislation makes all or part of the Services unlawful, the Parties shall first seek to adapt the Services; failing agreement, either Party may terminate the affected Order(s).
12. Governing law
12.1 This DPA is governed by Belgian law. The courts of Ghent have exclusive jurisdiction, per the Agreement.
ANNEX 1: Description of the Processing
Nature and purpose. The Processor produces target-language subtitles and/or AI-assisted dubs of the audiovisual works supplied by the Controller. Processing consists of: ingesting the master, trailer and subtitle/CCSL materials; automatic speech recognition and speaker identification; machine translation with human review; for dub orders, generating synthetic voices from the original cast's recorded dialogue (voice cloning) and rendering, mixing and mastering the dubbed audio; quality control; and delivery of the resulting files.
Categories of Data Subjects.
| Category | In scope |
|---|---|
| Performers (cast) appearing in the supplied materials | Yes |
| Other individuals appearing or named in the supplied materials | Yes |
| Controller's staff and business contacts (ordering, billing) | Yes |
| Controller's end customers / viewers | No |
Categories of Personal Data.
| Category | Detail |
|---|---|
| Image and video data | Performers and other individuals as contained in the master and trailer |
| Voice recordings | Performers' spoken dialogue, isolated dialogue stems, and derived voice models used solely to dub the same title. Voice data that can uniquely identify a person may qualify as biometric data (Article 9 GDPR); the Controller is responsible for an adequate lawful basis and performer consent position |
| Identification and contact data | Names, roles, business email addresses and phone numbers of the Controller's staff |
| Content-embedded data | Names, dialogue and story information relating to real persons, as contained in the works and their subtitle files |
| Financial data | Billing details of the Controller (invoicing) |
Duration. For the duration of the Services, and no longer than twelve (12) months after delivery of the last Deliverable, except where a longer period is required by law or for the defence of legal claims.
ANNEX 2: Authorised Sub-processors
| Sub-processor | Activity | Location / transfer mechanism |
|---|---|---|
| Google LLC (Gemini API, paid tier; API inputs not used for model training) | Machine translation, glossary extraction, translation review | USA (EU-US Data Privacy Framework / SCCs) |
| Anthropic PBC (Claude API) | Translation review and cross-model verification | USA (EU-US Data Privacy Framework / SCCs) |
| ElevenLabs Inc. | Voice cloning and text-to-speech rendering for dub orders only | USA (Data Privacy Framework / SCCs) |
| Stripe Payments Europe Ltd. | Payment processing (billing data only) | Ireland (EEA) |
| Hugging Face, Inc. | Hosting of open-source model weights used locally (no content leaves the Processor's infrastructure) | USA (model downloads only) |
| EU hosting provider (content storage and transfer) | Encrypted storage and delivery of masters and deliverables | EEA |
Voice cloning Sub-processors are only engaged for dub orders; subtitle-only orders do not involve ElevenLabs.
ANNEX 3: Technical and Organisational Measures
| Measure category | Effective measures |
|---|---|
| Access control (digital) | Personal accounts; strong password policy; mandatory two-factor authentication on all systems holding Controller content; least-privilege access |
| Content protection | Encryption at rest and in transit (TLS); access to content only via time-limited signed URLs; EU-located storage; no public buckets |
| Transfer control | Encrypted transfers only; API access to AI providers over TLS with authenticated keys; no Controller content in URLs |
| Input control | Logging of access to and changes in production systems; per-title working directories; checkpointed processing keyed to the title |
| Availability | Versioned backups of work product; retention and rotation policies; purge procedures per Annex 1 duration |
| Organisational | Confidentiality undertakings by all personnel and subcontractors; documented purge-on-request procedure; breach-response procedure with 48-hour Controller notification; annual review of Sub-processor terms (including no-training commitments of AI providers) |
| Separation | Per-customer and per-title segregation of content, glossaries, work files and voice models; voice models never shared across titles or customers |
Fonti Studio · Gent, Belgium · hello@fonti.studio