Data Processing Agreement

This agreement sets out how SuperMoo handles the personal data in the videos you host with us, and the viewer data those videos create. It forms part of our Terms of Service and applies automatically to every customer, so there is nothing to sign.

01 Parties and definitions

This Data Processing Agreement (the "DPA") is entered into between:

SuperMoo Ltd, a company registered in England and Wales under company number 16382514, whose registered office is at 37 Chynowen Parc, Cubert, Newquay, England, TR8 5HD ("SuperMoo", the "Processor"); and

the customer that has accepted the SuperMoo Terms of Service (the "Customer", the "Controller").

It forms part of, and is subject to, the SuperMoo Terms of Service in force between the parties (the "Agreement").

Definitions. "Data Protection Law" means the UK GDPR and the Data Protection Act 2018, and, where the Customer or its end users are in the EEA, Regulation (EU) 2016/679 ("EU GDPR"), in each case as amended or replaced. "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" carry the meanings given in Data Protection Law. "Sub-processor" means any processor engaged by SuperMoo to process Customer Personal Data. "Customer Personal Data" means Personal Data processed by SuperMoo on the Customer's behalf under the Agreement, as described in Annex A.

"UK Addendum" means the Information Commissioner's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0. "EU SCCs" means the standard contractual clauses in Commission Implementing Decision (EU) 2021/914. "IDTA" means the Information Commissioner's International Data Transfer Agreement.

02 Scope and roles

The Customer is the Controller of Customer Personal Data. SuperMoo is the Processor and processes that data only on the Customer's behalf.

This split applies to the videos the Customer uploads or collects through ReMoo, anyone appearing or identifiable in them, the details people enter when they submit a ReMoo review, any captions or transcripts, and the viewer data generated when those videos are played on the Customer's websites.

SuperMoo acts as a Controller, not a Processor, for the Customer's own account and billing data, which it processes to run and bill for the service. That processing is governed by the SuperMoo Privacy Policy, not by this DPA.

This DPA takes effect when the Agreement does and ends when all Customer Personal Data has been deleted or returned under clause 9. It applies automatically to every Customer that accepts the Agreement and does not need to be signed. A Customer that needs a countersigned copy for its records can request one from team@supermoo.co.

03 SuperMoo's obligations

SuperMoo shall:

1. Process Customer Personal Data only on the Customer's documented instructions, including on transfers to a third country, unless required otherwise by law. The Agreement, this DPA and the Customer's use of the service are the Customer's documented instructions. Where law requires other processing, SuperMoo will tell the Customer first unless that law prohibits it.
2. Tell the Customer without delay if, in its opinion, an instruction infringes Data Protection Law.
3. Ensure that everyone authorised to process Customer Personal Data is bound by an appropriate duty of confidence, and limit access to those who need it to deliver the service.
4. Not sell Customer Personal Data, use it to train machine learning models, or use it for its own advertising or marketing.
5. Assist the Customer, taking into account the nature of the processing, in responding to requests from Data Subjects exercising their rights under Chapter III of the UK GDPR. Where a Data Subject contacts SuperMoo directly about Customer Personal Data, SuperMoo will not respond substantively but will pass the request to the Customer without undue delay and in any event within five business days.
6. Provide reasonable assistance with data protection impact assessments and prior consultation with a Supervisory Authority, taking into account the nature of the processing and the information available to SuperMoo.

Assistance under items 5 and 6 is provided at no charge for requests of reasonable volume. The parties will agree reasonable charges in advance for anything beyond that.

04 Security

SuperMoo shall implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as required by Article 32 of the UK GDPR.

The measures in force at the date of this DPA are set out in Annex C. SuperMoo may update them as the service develops, provided the level of protection is not reduced.

05 Sub-processors

The Customer gives SuperMoo general written authorisation to engage Sub-processors, subject to this clause.

The Sub-processors engaged at the date of this DPA are listed in Annex B. SuperMoo maintains a current list at supermoo.co/dpa#annex-b.

Before engaging a new Sub-processor or replacing an existing one, SuperMoo will give the Customer at least 30 days' notice by email to the Customer's account owner. The Customer may object on reasonable data protection grounds within 14 days of that notice. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Agreement without penalty and receive a pro rata refund of fees paid in advance for the unused period.

SuperMoo shall impose on each Sub-processor data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for each Sub-processor's performance.

Sub-processors operating content delivery networks cache encoded video and image files to serve them close to viewers. They do not receive the Customer's account data.

06 International transfers

SuperMoo does not transfer Customer Personal Data outside the United Kingdom or the EEA except as set out in Annex B, and only where one of the following applies:

1. The destination is covered by UK adequacy regulations or an EU adequacy decision.
2. The recipient is certified under the EU-US Data Privacy Framework and its UK Extension, for transfers from the EEA and the UK respectively.
3. The EU SCCs apply, with Module Two for controller to processor transfers and Module Three for processor to processor transfers, read with the UK Addendum for transfers subject to the UK GDPR, or the IDTA applies.

Where the EU SCCs apply between the parties, they are incorporated into this DPA and completed as follows. The Customer is the data exporter and SuperMoo the data importer. The optional docking clause in clause 7 applies. In clause 9, Option 2 (general written authorisation) applies with the 30 day notice period in clause 5 above. In clause 11, the optional independent dispute resolution body does not apply. In clauses 17 and 18, the governing law and forum are those of England and Wales, or of Ireland where mandatory EU law requires an EU member state. Annex A of this DPA completes Annexes I and II of the EU SCCs, and Annex B completes the list of sub-processors.

If a transfer mechanism relied on here is invalidated, the parties will work in good faith to put a valid alternative in place without undue delay.

SuperMoo has carried out a transfer risk assessment for each transfer described in Annex B and will make it available to the Customer on request.

07 Personal data breaches

SuperMoo shall notify the Customer without undue delay, and in any event within 48 hours, of becoming aware of a Personal Data Breach affecting Customer Personal Data.

The notification shall describe the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for more information. Where that detail is not all available at once, SuperMoo will provide it in phases without further undue delay.

SuperMoo shall not make any public statement identifying the Customer in connection with a breach without the Customer's prior written consent, unless required by law.

08 Audit and information

SuperMoo shall make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.

In the first instance SuperMoo may satisfy this by providing its security documentation, its answers to a reasonable security questionnaire, and any third party audit reports or certifications held by it or its Sub-processors.

Where that is not sufficient, the Customer may carry out an on-site audit no more than once in any 12 month period, on 30 days' written notice, during business hours, subject to confidentiality, and without unreasonable disruption to SuperMoo's operations. The Customer may audit more often where required by a Supervisory Authority or following a Personal Data Breach affecting Customer Personal Data. Each party bears its own costs.

09 Deletion and return

On termination or expiry of the Agreement, SuperMoo shall, at the Customer's choice, delete or return all Customer Personal Data, and delete existing copies, unless required by law to retain it.

The Customer has 30 days from termination to export its data. SuperMoo shall provide, on request within that period, an export of the Customer's video files, caption and transcript files, poster images and video metadata in a commonly used machine readable format.

After that period SuperMoo shall delete Customer Personal Data from live systems within 30 days, and from routine backups within a further 90 days, during which it remains isolated and protected from further processing. SuperMoo shall confirm deletion in writing on request.

Viewer analytics records are retained for no more than 100 days from collection and are deleted on a rolling basis regardless of termination.

10 General

Order of precedence. If this DPA conflicts with the Agreement, this DPA prevails on data protection matters. If this DPA conflicts with the EU SCCs or the IDTA, those clauses prevail.

Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Law does not permit that.

Changes. SuperMoo may update this DPA where needed to reflect a change in Data Protection Law, a regulator's guidance, or a change to its Sub-processors or security measures, provided the change does not reduce the protection given to Customer Personal Data. SuperMoo will give the Customer at least 30 days' notice of a material change.

Governing law. This DPA is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales, except where clause 6 provides otherwise for transfers.

Contact. Data protection queries should be sent to team@supermoo.co.

A Annex A: particulars of processing

This Annex completes Annex I of the EU SCCs.

Subject matter

Hosting, encoding, storage and delivery of the Customer's video content, collection of video reviews through ReMoo, and the measurement of how that content is played.

Duration

For the term of the Agreement, plus the deletion periods in clause 9.

Nature and purpose

Receiving uploaded video files, including reviews recorded through ReMoo; encoding them into streaming and still image formats; storing them; generating captions and transcripts where the Customer enables that; delivering them to viewers through content delivery networks; and recording playback events so the Customer can see how its videos perform.

Frequency

Continuous for the term of the Agreement.

Retention

Video, captions, images, metadata and ReMoo submission details for as long as the Customer keeps them in its account, then per clause 9. Viewer analytics for no more than 100 days.

Categories of Data Subject

• People appearing, speaking or otherwise identifiable in video the Customer uploads
• People who record and submit video reviews through a ReMoo campaign
• People identifiable in captions, transcripts or video metadata the Customer supplies
• Viewers of the Customer's videos
• The Customer's own users of the SuperMoo dashboard

Categories of Personal Data

Audiovisual content

Images, likenesses and voices of people in uploaded video, and anything they say.

ReMoo submission details

The name and email address a reviewer enters, and the date and time they gave consent for their video to be used.

Caption and transcript text

Text derived from the audio, including any personal data spoken in it.

Video metadata

Titles, descriptions and file names the Customer supplies.

Viewer technical data

IP address, truncated after being used to derive country level location and to filter bots; device, browser and operating system; referring page.

Playback events

Video played, watch time, playback quality and errors, tied to a pseudonymous viewer identifier.

Dashboard user data

Name, email address and authentication data for the Customer's own users.

Special category data

SuperMoo does not require special category data. The Customer decides what it uploads. Where video reveals data falling within Article 9 of the UK GDPR, the Customer remains responsible for identifying a lawful basis and an Article 9 condition.

Cookies and similar technologies

The embedded player sets no cookies before or after playback. It loads no advertising scripts and no Google scripts. It stores one non-identifying viewer preference, the mute setting, in browser local storage. On load it requests the poster image and the video stream, and sends one pseudonymous playback event so view counts work.

B Annex B: sub-processors

Direct sub-processors

Stripe and Crisp process the Customer's account, contact and billing data rather than viewer or video data. Resend sends emails to the Customer's dashboard users, which can include a reviewer's name when a new ReMoo review arrives.

Onward sub-processors used by Mux

These are taken from the Mux Data Processing Addendum last updated 1 April 2025. They handle encoded video and image files, not the Customer's account data.

Source: Mux Data Processing Addendum, updated 1 April 2025.

Mux gives at least 30 days' notice of a new sub-processor and a 14 day objection window. SuperMoo passes those notices on to the Customer under clause 5.

C Annex C: technical and organisational measures

This Annex completes Annex II of the EU SCCs.

Encryption

All data in transit is encrypted with TLS. Video files, database contents and backups are encrypted at rest by the relevant sub-processor.

Access control

Access to production systems is limited to named personnel who need it, protected by multi-factor authentication. Access is reviewed periodically and removed when no longer needed.

Tenant separation

Customer data is logically separated so that one customer's users cannot access another's content or analytics.

Playback access control

By default, video playback uses signed, time limited URLs, so a video cannot be played from a link that has expired. Where the Customer turns on a direct video link for a video, that video is also available from a public URL until the Customer turns the link off.

Resilience

Video and application data are hosted on infrastructure with redundancy across availability zones. Database backups are taken on a regular schedule and restoration is tested periodically.

Data minimisation in analytics

Viewer IP addresses are used to derive country level location and to filter bot traffic, then truncated. No viewer names, email addresses or advertising identifiers are collected.

Logging

Access to production systems is logged.

Change management

Application changes go through version control and review before release.

Personnel

Everyone with access to Customer Personal Data is bound by confidentiality obligations.

Vendor management

Sub-processors are assessed for data protection and security before engagement and are bound by written terms no less protective than this DPA.