Last Updated: May 27, 2026
This Processing Addendum (“DPA”) supplements the Storysnap, LLC Main Services Agreement (“Agreement”) entered into by and between the customer signing this DPA (“Customer”) and Storysnap, LLC. (“Company”). By executing the DPA, Customer enters into this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws, in the name and on behalf of its Affiliates, if any. This DPA is incorporated into and governed by the terms of the Agreement.
2.1 The parties acknowledge and agree that with regard to the processing of Personal Data, Customer is the Controller and Company is the Processor. Customer shall ensure that its instructions for the processing of Personal Data comply with Data Protection Laws and will not cause Company to be in breach of Data Protection Laws. Customer is solely responsible for the accuracy, quality, and legality of the Personal Data provided to Company by or on behalf of Customer.
2.2 Company shall not process Personal Data (i) for purposes other than those set forth in the Agreement and/or Exhibit A, or (ii) in a manner inconsistent with the terms and conditions set forth in this DPA or any other documented instructions provided by Customer.
2.3 Company acts as a Controller for user account data (including username and password) to access and use the Services and system usage data to optimize and maintain performance of the Services and to investigate and prevent potential system abuse.
2.4 Retention, Return, and Deletion of Customer Personal Data. During the Term, Company will retain Customer’s Personal Data to enable Customer’s continued access to Deliverables and use of the Services via the Company portal. Customer may, at any time, instruct Company in writing to delete or return all or any portion of Customer’s Personal Data. Company will delete or return the specified Personal Data within thirty (30) days of receipt of Customer’s instruction, unless continued retention is required or authorized by applicable law. Following termination or expiration of the Services, Company will, at Customer’s choice, return or delete remaining Customer Personal Data within thirty (30) days of Customer’s instruction, unless continued retention is required or authorized by applicable law. Where data subjects assert rights of erasure under applicable data protection law, Company will assist Customer in fulfilling such requests per Section 7 and the applicable response timelines therein.
2.5 CCPA: Company acts as a “service provider” under the CCPA and shall not “sell” or “share” any personal information provided by the Customer (as those terms are defined in the CCPA) and otherwise comply with the service provider requirements in CCPA Section 1798.140(ag). Company certifies it understands and will comply with these obligations and restrictions in accordance with the CCPA and gives Customer permission to monitor Company’s compliance with these obligations and to take reasonable steps to remediate unauthorized use of Personal Data. Company will notify Customer if it determines or believes that it cannot meet its obligations under the CCPA.
Company shall ensure that all team members and contractors authorized to process Personal Data are bound by written confidentiality obligations prior to receiving access. Personnel with standing access to in-scope systems complete security awareness training upon onboarding and annually thereafter. Company performs background checks where lawfully permitted and relies on equivalent vetting (including reference checks and verification of professional history) in jurisdictions where background checks are legally restricted or impractical.
4.1 Customer acknowledges and agrees that Company may engage Authorized Sub-Processors to access and process Personal Data in connection with the Services (e.g., cloud infrastructure providers).
4.2 A list of Company’s current Authorized Sub-Processors is available to Customer at trust.storysnap.com. Company will provide 30 days’ notification via email to subscribed Customers prior to enabling any new Sub-Processors, giving Customer ten (10) days to object based on reasonable data security concerns. (Customer may subscribe to receive the emailed notices at trust.storysnap.com.) The parties agree to cooperate in good faith to resolve Customer’s reasonable objection. If Customer’s objection cannot be resolved within a reasonable period of time, Customer may terminate the affected Service(s) by providing written notice to Company; provided, however, that termination of the affected Service(s) shall not relieve Customer from paying any fees then owed to Company under the Agreement. A signed data processing agreement (or acceptance of the Sub-Processor’s standard data processing terms) is in place with each Authorized Sub-Processor that processes Personal Data on Company’s behalf. Company conducts annual reviews of subservice organizations (including review of their SOC 2 Type 2 reports or equivalent independent assurance reports) under Company’s vendor management framework.
4.3 Sub-Processor Liability: Company shall remain fully liable for the acts and omissions of its Authorized Sub-Processors to the same extent Company would be liable if performing the services of each Sub-Processor directly under the terms of this DPA.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, Company shall maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Exhibit C sets forth additional information about Company’s technical and organizational security measures.
The parties agree that Company may transfer Personal Data processed under this DPA outside the EEA, the UK, or Switzerland as necessary to provide the Services. The parties agree that ex-EEA or ex-Switzerland Transfers are made pursuant to the EU SCCs (Module One: Controller to Controller and Module Two: Controller to Processor, as applicable), and ex-UK Transfers are made pursuant to the UK Transfer Addendum, which are deemed entered into and incorporated by reference into this DPA in the form as set forth in Exhibit D.
Company shall, to the extent permitted by law, promptly notify Customer upon receipt of a request by a Data Subject to exercise their privacy rights under applicable Data Protection Laws (e.g., a request to delete a video featuring their likeness or other Personal Data). Company will confirm receipt of the request with the Data Subject, forward the request to Customer without undue delay, and assist Customer in fulfilling the request on Customer’s documented instructions. Customer is solely responsible for responding to Data Subject Requests and for instructing Company on any required data deletion or modification. Where Customer is unresponsive within a reasonable timeframe or the request indicates an imminent safety concern, Company may determine appropriate next steps in consultation with applicable supervisory authorities or counsel.
8.1 Records. Company shall maintain records sufficient to demonstrate its compliance with its obligations under this DPA and retain such records for a period of three (3) years after the termination or expiration of the Agreement.
8.2 Audit Rights: Upon Customer’s written request at reasonable intervals (no more than once per calendar year), Company shall make available for Customer’s review copies of certifications or reports demonstrating Company’s compliance with prevailing data security standards (e.g., SOC 2 Type 2 report). Any further audits or inspections legally required by a Supervisory Authority shall be limited to once annually, conducted at Customer’s sole expense, subject to reasonable advance notice of at least 30 days and subject to strict confidentiality obligations.
8.3 Personal Data Breach. In the event of a Personal Data Breach affecting Customer data, Company shall, without undue delay (within at least 72 hours), inform Customer of the Personal Data Breach to allow Customer to fulfill its notification obligations to Authorities and Data Subjects. Company shall take such steps as Company in its sole discretion deems necessary and reasonable to remediate such breach (to the extent that remediation is within Company’s reasonable control).
8.4 DPIA. Company will provide reasonable assistance to Customer in conducting data protection impact assessments and prior consultations with supervisory authorities where required by applicable Data Protection Laws, by making available information about Company’s processing activities to the extent such information is reasonably necessary for Customer to fulfill its obligations.
8.5 Governmental Authority Inquiry or Request. Unless legally prohibited, Company will notify Customer without undue delay if a supervisory authority or other governmental authority makes any inquiry or request for disclosure of Personal Data. Company will not disclose Personal Data in response to such inquiry or request without Customer’s prior written authorization, except where required by applicable law. In such cases, Company will limit any disclosure to the minimum necessary, document the basis for disclosure, and challenge overbroad or unlawful requests where reasonably feasible.
Any claims brought under or in connection with this DPA shall be subject to the terms and conditions, including but not limited to, the exclusions and limitations of liability set forth in the Agreement.
Policy framework. The technical and organizational measures described above are operationalized through Company’s documented information security policy framework. The published portion of the policy framework is available via Company’s Trust Center at trust.storysnap.com.
Part 1: Ex-EEA Transfers: The parties agree that ex-EEA Transfers are made pursuant to the EU SCCs (Module 1: Controller to Controller and Module 2: Transfer Controller to Processor), which are deemed entered into and incorporated into this DPA by this reference and completed as follows:
Part 2: Ex-Switzerland Data Transfers: The parties further agree that ex-Switzerland Transfers are made pursuant to the EU SCCs (Module 2: Transfer Controller to Processor) as set forth above in Part I with the following modifications:
Part 3: Ex-UK Data Transfers: The parties further agree that ex-UK Transfers are made pursuant to the UK Transfer Addendum, which is incorporated into this DPA by reference and takes precedence over the rest of this DPA to the extent of any conflict. Tables 1, 2 and 3 of the UK Transfer Addendum are completed with the information provided in Exhibits A, B, and C, and the version of the approved EU SCCs is set forth above in Part 1. For purposes of Table 4 of the UK Transfer Addendum, either party may end the UK Transfer Addendum in accordance with Section 19 therein.
If the data transfer is exclusively subject to the UK GDPR, the International Data Transfer Agreement issued by the UK Information Commissioner’s Office (Version A1.0, in force 21 March 2022) is deemed entered into and incorporated by reference into this DPA.