Data Processing Agreement

§D1Parties, scope and order of precedence

This Data Processing Agreement (DPA) is between the business customer (the “Customer”, controller) and PG Informatika Szolgáltató Korlátolt Felelősségű Társaság (PG Info Kft.), 9141 Ikrény, Sport utca 22., Hungary, company registration number Cg. 08-09-011910 (“Lumière”, processor). It applies when the Customer uses Lumière for its trade, business or profession and Lumière processes personal data on the Customer’s behalf, mainly personal data contained in footage, audio, transcripts, guidelines and other material the Customer uploads or creates (“Customer Personal Data”).

The DPA forms part of the Terms of Service and takes effect when the Customer accepts them as a business customer, or when it is signed. Where the DPA and the Terms of Service differ on personal data, the DPA prevails. Lumière is a controller, not a processor, for account, billing, security and support data; the Privacy Policy covers those.

§D2Instructions

Lumière processes Customer Personal Data only on the Customer’s documented instructions, including on transfers outside the EU, unless EU or Member State law requires otherwise; in that case Lumière tells the Customer before processing unless that law forbids it. The Terms of Service, this DPA and the Customer’s use of Lumière’s features (for example starting a transcription, a compliance scan or an AI generation) are the Customer’s instructions.

Lumière tells the Customer at once if, in its opinion, an instruction infringes the GDPR or other data protection law.

§D3Confidentiality

Lumière ensures that everyone it authorises to process Customer Personal Data is bound to confidentiality by contract or by law, and gives access only where needed to provide, support or secure the service.

§D4Security

Lumière takes the technical and organisational measures in Annex II, appropriate to the risk (GDPR Art. 32). It may change them if the overall level of protection does not fall.

§D5Sub-processors

The Customer gives Lumière general authorisation to engage sub-processors. The current sub-processors are listed in Annex III and in the Privacy Policy.

Lumière informs the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may end the affected service and receives a refund of prepaid fees for the time after the end.

Lumière imposes on each sub-processor, by contract, data protection obligations that are the same in substance as in this DPA, and remains liable to the Customer for its sub-processors’ performance.

§D6Assisting the Customer

Data subject requests: the Customer can delete Studio projects and compliance jobs and close the account itself, and can export renders, editor exports, transcripts and reports (Terms of Service C17). For anything else Lumière helps, as far as possible, by appropriate technical and organisational measures, and forwards to the Customer any request it receives from a data subject about Customer Personal Data.

Lumière helps the Customer with its obligations under GDPR Articles 32 to 36 (security, breach notification, impact assessments, prior consultation), taking into account the nature of the processing and the information available to Lumière.

§D7Personal data breaches

Lumière notifies the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, by email to the account owner. The notice describes, as far as known, the nature of the breach, the categories and approximate numbers of data subjects and records, the likely consequences, and the measures taken or proposed. Lumière documents every breach.

§D8Deletion and return at the end

Before the end of the service the Customer can export its data (Terms of Service C17). When the account is closed, Lumière erases Customer Personal Data 30 days after closure, as the Privacy Policy describes; copies in backups are overwritten as the backups rotate (at most about six months; backups never contain footage, renders or projects). Lumière keeps only what EU or Member State law requires it to keep.

§D9Information and audits

Lumière makes available to the Customer the information needed to demonstrate compliance with GDPR Article 28 and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates. The Customer gives at least 30 days’ written notice, audits at most once a year unless a breach or a supervisory authority requires more, and bears its own costs; the auditor is bound to confidentiality.

§D10Transfers outside the EU

Lumière transfers Customer Personal Data outside the EU only to the sub-processors in Annex III and only with a safeguard under GDPR Chapter V: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the EU standard contractual clauses (Commission decision 2021/914) with a transfer assessment.

§D11Liability, term and law

Liability follows the Terms of Service, without limiting a data subject’s rights under GDPR Article 82. This DPA lasts as long as Lumière processes Customer Personal Data. Hungarian law governs it, and the courts named in the Terms of Service for business customers have jurisdiction.

§Annex IDetails of the processing

• Subject matter and duration: providing Lumière (AI video editing, compliance checks, LumiVision) for as long as the Customer uses it, plus the erasure period in D8.
• Nature and purpose: storage, transcription, analysis, editing, rendering, AI generation, dubbing, search and delivery of the Customer’s material, as instructed through the features the Customer uses.
• Categories of data subjects: people who appear in, speak in or are named in the Customer’s material; the Customer’s team members as users.
• Categories of personal data: images and video of people, voices, speech and its transcript, names and other information spoken or shown, place names, and any other personal data in the material; team members’ names and email addresses.
• Special categories: only if the Customer’s material contains them (for example health or political opinions mentioned in an interview); Lumière does not look for them. LumiVision has face grouping and speaker separation features that compute face and voice embeddings to group appearances of the same person (biometric data, GDPR Art. 9); they never name anyone by themselves, and they are off unless enabled for the Customer’s organisation.
• Frequency: continuous, while the Customer uses the service.

§Annex IITechnical and organisational measures (as built, checked 2026-10-26)

In place:

• Hosting in a data centre of Hetzner Online GmbH in Germany (EU).
• Encryption in transit: HTTPS (TLS) for every connection to the service.
• Passwords stored only as salted scrypt hashes; password-reset links stored as hashes, single-use, valid 45 minutes.
• Session cookies with the __Host- prefix, HttpOnly, SameSite=Lax and Secure on HTTPS; sessions expire after 30 days.
• Rate limits on sign-in, signup, pairing and support; lockout after repeated failed sign-ins; automated signup-abuse screening.
• Tenant separation: every project, job and LumiVision item is bound to the Customer’s organisation and checked on each request.
• Admin console bound to the server’s loopback interface, behind a password, lockout and an IP allow-list; admin actions are recorded in an audit log.
• AI provider keys stored encrypted (AES-256-GCM).
• AI requests through Lumière’s gateway are routed only to model providers that do not collect the data for their own use; Lumière never trains models on Customer data.
• Data minimisation: each AI step receives only what it needs (for example the audio track, not the video, for transcription); temporary working files are deleted after each compliance job; the original upload is never modified.
• Lumière Local keeps footage on the Customer’s computer and blocks media uploads through its local connection.
• Protection against server-side request forgery for URL-based features, and a network egress filter for URL imports.
• Security records: raw IP addresses and email addresses kept 30 days, then a keyed hash; records deleted after 180 days.
• Nightly backups of account and billing databases, settings and invoices (no footage), file permissions restricted to the service account, rotated 14 daily, 8 weekly, 6 monthly, with a copy on a computer under the operator’s control.
• Uptime monitoring and alerting operated without third-party monitoring services.

Not in place today (stated so the Customer can assess the risk): encryption of stored data at rest (disks, databases, uploaded media, backups); multi-factor authentication for customer accounts (the admin console requires it); a formal certification (such as ISO 27001).

§Annex IIISub-processors

The sub-processors the Customer authorises, what they process, and the transfer safeguard:

• Hetzner Online GmbH (Germany (EU)): hosting of the whole service: servers, storage, databases; all data in this policy. When: always. Safeguard: EU, no transfer.
• Groq, Inc. (USA): speech-to-text: the audio track of footage uploaded to Studio or Compliance (from Lumière Local only in its audio fallback); can also answer text steps as a back-up model. When: always for transcription. Safeguard: EU-US Data Privacy Framework if the company is certified, otherwise the EU standard contractual clauses (2021/914).
• OpenRouter, Inc., and the AI model provider it routes a request to (for example Google, Anthropic or OpenAI) (USA (the model provider may process elsewhere)): the AI text and vision steps: transcripts, your brief and prompts, compliance guidelines, Help chat messages, the audio of LumiVision recordings for transcription, LumiVision summaries, questions and subtitle translations, still frames and reference images when you use a visual feature. Our AI gateway routes requests only to providers that do not collect data for their own use. When: always. Safeguard: EU-US Data Privacy Framework if the company is certified, otherwise the EU standard contractual clauses (2021/914).
• Google (Gemini API), OpenAI and Anthropic, called directly (USA): back-up route for the same AI steps, and image generation for thumbnails and AI images: your prompt and any reference images. When: only when the provider's key is configured on our server and the step uses it. Safeguard: EU-US Data Privacy Framework if the company is certified, otherwise the EU standard contractual clauses (2021/914).
• fal.ai (Features & Labels, Inc.), Replicate, Inc., ElevenLabs, Stability AI Ltd (USA; Stability AI: United Kingdom): AI generation, dubbing, voices, sound and music, and music stem separation: your prompt or text and, for dubbing or separation, the audio concerned. When: only when you use these features. Safeguard: USA: as above; United Kingdom: EU adequacy decision for the UK (renewed December 2025).
• Postmark (ActiveCampaign, LLC); Resend, Inc. as the alternative rail (USA): transactional email: your email address, name and the email's content. When: always (Resend only if we switch to it). Safeguard: EU-US Data Privacy Framework if the company is certified, otherwise the EU standard contractual clauses (2021/914).
• Stripe Payments Europe, Ltd (Ireland (EU); Stripe group companies in the USA): card payments: billing details and payment data; Lumière never sees your full card number. When: when you buy. Safeguard: EU; onward transfers under Stripe's own safeguards.
• KBOSS.hu Kft. (számlázz.hu) (Hungary (EU)): invoicing and the invoice report to the Hungarian tax authority (NAV): the name, address, VAT number and purchase on the invoice. When: when you buy. Safeguard: EU, no transfer.
• European Commission, VIES (EU): checks the VAT number of business customers (recipient, not a processor). When: when a business enters a VAT number. Safeguard: EU, no transfer.
• Telegram (Telegram Messenger Inc.) (outside the EU): alerts to our operator: when a support request is escalated, its severity, whether the sender was signed in, and a link to our admin console. Never your name, email address or message. When: only if configured. Safeguard: no personal data of customers is sent.
• Stock media services (Pexels, Pixabay, Jamendo, Freesound) (EU and outside the EU): search words only, which may come from your brief or transcript; no account data. When: when B-roll or music is searched. Safeguard: recipients of search words, not of account data.
• OpenStreetMap Foundation (Nominatim) (United Kingdom): LumiVision add-on: place names recognised in your footage are looked up. When: only with LumiVision and its place lookup enabled. Safeguard: EU adequacy decision for the UK.
• Blotato (USA): social publishing: the finished video, its title, description and thumbnail. When: only if enabled on our server and you choose to publish through it. Safeguard: EU-US Data Privacy Framework if the company is certified, otherwise the EU standard contractual clauses (2021/914).