# Data Processing Agreement | Vodlix

**Source:** https://vodlix.com/data-processing-agreement  
**Summary:** Every publisher: how Vodlix processes their viewers' data, with the sub-processor list.  
**Publisher:** Vodlix

---

## Data Processing Agreement

This Agreement forms part of the Terms of Service between **Fast OTT Ltd** (trading as **Vodlix**), registered in England and Wales under number **15157138**, registered office Office 7, 480 Larkshall Road, London, England, E4 9HH ("**Vodlix**", "**we**") and the Customer ("**you**").

It applies where we process personal data on your behalf.

## 1. Definitions {#1-definitions}

**Data Protection Law** means UK GDPR and the Data Protection Act 2018; Regulation (EU) 2016/679 and its national implementations; PECR and equivalent ePrivacy law; and any other applicable data protection law.

**End User Data** means personal data relating to End Users of your Customer Platform that we process on your behalf.

**Sub-processor** means a processor we engage to process End User Data.

**Services**, **Authorized User**, **Customer Platform**, **Customer Content**, **End User** and **Subscriber** have the meanings given in the Terms of Service.

Other capitalized terms have the meanings given in the UK GDPR.

## 2. Roles {#2-roles}

| Data | Controller | Our role |
| --- | --- | --- |
| **End User Data**: your End Users' accounts, viewing activity, subscription records | **You** | **Processor** |
| **Your account data**: your details, Authorized Users, billing, support history | **Vodlix** | **Controller** |

For End User Data you decide the purposes and means. You are responsible for having a lawful basis, for your own privacy notice to your End Users, for any consent required for cookies on your Customer Platform, and for responding to your End Users' rights requests. We act only on your instructions.

For your account data our Privacy Policy applies; this Agreement does not govern it.

**Neither of us is a joint controller of the other's data.**

## 3. Our obligations {#3-our-obligations}

We will:

(a) process End User Data **only on your documented instructions** (this Agreement, the Terms of Service, your configuration, and any further written instruction) unless required otherwise by law, in which case we will tell you first unless the law prohibits it;

(b) **not sell or share End User Data, and not use it for our own purposes**, including advertising, profiling or model training;

(c) ensure people authorized to process End User Data are bound by confidentiality;

(d) implement appropriate technical and organizational measures (**Annex 2**);

(e) engage Sub-processors only under clause 4;

(f) assist you with data subject rights, security, breach notification and impact assessments, taking into account the nature of the processing;

(g) delete or return End User Data under clause 7; and

(h) make available the information reasonably necessary to demonstrate compliance with Article 28, and allow audits under clause 8.

**If we consider an instruction to infringe Data Protection Law we will tell you.**

**Instructions we consider unlawful.** We will tell you immediately after we form that view, and give our reasons. We are not required to carry out an instruction that we reasonably believe infringes Data Protection Law, and we may suspend it until you withdraw it or change it so that it no longer infringes. Declining or suspending an instruction under this paragraph is not a breach of this Agreement or of the Terms of Service.

**Your instructions.** You are responsible for ensuring that your instructions comply with Data Protection Law. Your instructions include instructions about transfers of End User Data to a third country or an international organization, which are set out in clause 9 and Annex 3. An instruction that falls outside the Services as described in the Terms of Service, or that changes how we provide them, takes effect only once we have agreed it with you in writing, including any fees.

**Changes to the measures.** The measures in Annex 2 are subject to technical progress and development. We may update them from time to time, provided that an update does not reduce the overall level of security of End User Data.

## 4. Sub-processors {#4-sub-processors}

You give us general authorization to engage Sub-processors. The current list is **Annex 3**, provided with this Agreement and available at any time from privacy@vodlix.com.

We give **at least 30 days' notice** before adding or replacing a Sub-processor. If you reasonably object on data protection grounds and we cannot offer an alternative, **you may terminate the affected Services without penalty**, with a pro-rata refund.

We impose data protection obligations on each Sub-processor no less protective than these, and **remain fully liable to you for their acts and omissions**.

**Sub-processor contracts.** We engage each Sub-processor under a written contract that requires it to provide sufficient guarantees to implement appropriate technical and organizational measures and to meet the obligations in Article 28(3). On your written request we will give you a copy of the data protection terms of that contract, from which we may remove commercial information that is not relevant to data protection.

**How to object.** You object by writing to privacy@vodlix.com within the notice period, giving your reasons. We will consider the objection in good faith and discuss it with you. If you do not object within the notice period, you are treated as having authorized the change.

**Integrations you configure.** Where you connect a third-party service using your own account or API key, that provider is **your** processor, not our Sub-processor. We do not contract with it and do not list it in Annex 3.

## 5. Data subject rights {#5-data-subject-rights}

The Services let you access, correct, export and delete End User Data yourself. Where you cannot, we will provide reasonable assistance and respond to a written request within **10 business days**.

If an End User contacts us directly we will not respond substantively; we will direct them to you and tell you within **5 business days**.

## 5A. Impact assessments and prior consultation {#5a-impact-assessments-and-prior-consultation}

Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance with any data protection impact assessment you carry out under Article 35, and with any prior consultation of a supervisory authority under Article 36, so far as either relates to the Services.

We will provide that assistance mainly through the information in this Agreement and its Annexes, together with any further information you reasonably request about how the Services process End User Data.

Assistance beyond that, or assistance needed because of your own act or omission, may be charged at a reasonable cost that we will agree with you before we begin.

## 6. Personal data breach {#6-personal-data-breach}

We will notify you of a personal data breach affecting End User Data **without undue delay and in any event within 72 hours** of becoming aware of it, with the nature of the breach, the categories and approximate numbers affected, the likely consequences, the measures taken, and a contact point, in phases if we cannot provide everything at once.

We will assist you with your own obligations under Articles 33 and 34. **We will not notify your End Users or a supervisory authority on your behalf** without your written instruction.

**Our response.** We will take reasonable steps to contain and investigate the breach and to reduce its effects, keep you informed of material developments, and keep a record of the breach that gives you the information you need to document it under Article 33(5).

**Where we send the notice.** We send notices under this clause to the email address of the owner of your Vodlix account and to any security contact you give us in writing. You are responsible for keeping those details up to date.

**Not an admission.** Our notice of a personal data breach, and our assistance with it, is not an admission of fault or liability.

## 7. Deletion and return {#7-deletion-and-return}

**Before you cancel**, you can export End User Data through the Services or, on request, in a commonly used machine-readable format at no charge.

**When you cancel**, we email you, then delete your data, including End User Data, automatically within **60 days of cancellation**, including from Sub-processors. We keep only your contact and communication details, and anything the law requires us to keep, in which case we will tell you what, why and for how long.

Deleted data may persist in backups until those expire on the normal cycle. It is not restored and is not used for any other purpose.

**Confirmation of deletion.** On your written request, we will confirm in writing when deletion under this clause is complete, and tell you what End User Data, if any, we still hold because the law requires us to retain it or because it remains in backups.

## 8. Audit {#8-audit}

We will make available the information reasonably necessary to demonstrate compliance with Article 28.

You may audit no more than **once every 12 months**, on **30 days'** written notice, during business hours, without unreasonable disruption and subject to confidentiality (more often where a supervisory authority requires it or following a breach affecting your End User Data). Where we hold a current third-party certification or report covering the scope, providing it satisfies this clause.

**Who may audit, and costs.** An audit may be carried out by you or by an independent auditor you appoint, provided the auditor is not our competitor and has agreed in writing to keep our information confidential. Each of us bears its own costs of an audit. If an audit shows that we have materially breached this Agreement, we will remedy the breach promptly at our own cost.

## 9. International transfers {#9-international-transfers}

**Some of our infrastructure is in the United States.** Where End User Data is transferred out of the UK or EEA to a country without an adequacy decision, we rely on:

- the **EU-US / UK Extension Data Privacy Framework** for Sub-processors certified under it; or
- the **Standard Contractual Clauses** (2021/914), **Module Three**, with the selections in Annex 4, together with the **UK International Data Transfer Addendum** where UK GDPR applies.

Both are incorporated by reference and treated as executed on the effective date of this Agreement.

## 9A. If a transfer mechanism stops applying {#9a-if-a-transfer-mechanism-stops-applying}

If a mechanism we rely on under clause 9 ceases to be a lawful basis for a transfer, for example because an adequacy decision or the Data Privacy Framework is withdrawn or invalidated, or a Sub-processor's certification lapses, we will promptly put in place an alternative mechanism recognized by Data Protection Law, such as the Standard Contractual Clauses together with the UK International Data Transfer Addendum.

If we cannot do so, we will tell you without undue delay, and you may require us to suspend the affected transfer or terminate the affected Services without penalty, with a pro-rata refund.

We will give you the information you reasonably need to carry out a transfer risk assessment for any transfer of End User Data under this Agreement.

## 9B. Requests from public authorities {#9b-requests-from-public-authorities}

If we receive a legally binding request from a public authority, including a court or a law enforcement body, for disclosure of End User Data, we will tell you promptly, unless the law prohibits it, and where possible ask the authority to direct its request to you.

We will assess whether the request is lawful, challenge it where, after careful assessment, we conclude that there are reasonable grounds to consider it unlawful, and disclose only the minimum End User Data the request requires.

Where the Standard Contractual Clauses apply to the transfer, their Clause 15 governs.

## 10. Voice, likeness and face recognition {#10-voice-likeness-and-face-recognition}

Where you use AI dubbing, voice or likeness features, a **synthetic voice or likeness of a real person may be created** from your content. **Dubbing creates a voice model for every identifiable speaker in the video**, as part of the translation.

**You confirm that you hold all rights and consents required** from every person whose voice, face or performance appears in content you upload or dub, covering the creation and use of a synthetic voice or likeness derived from them. We do not verify this and rely on your confirmation.

Where any applicable law treats such data as biometric or special category, including Article 9 UK/EU GDPR and US biometric statutes, establishing the lawful basis is your responsibility.

We create voice or likeness models only at your instruction, do not reuse them for another Customer, and will delete a model on your instruction or on termination.

**Cast linking.** If you use cast linking, Vodlix Intel recognizes faces across your videos to suggest artist tags. To do this we keep a numerical signature of each face, not an image, so that a face in a later upload can be matched to one you have already named. We do not store images of faces. You are responsible for having the consent of the people in your videos. We do not use this data to train any model, and we delete it when your cloud is deleted, or earlier on request.

## 11. Special category data and children {#11-special-category-data-and-children}

The Services are not designed for special category data or criminal offense data, and you should not send it beyond what clause 10 contemplates without agreeing it with us in writing first.

**Services for children.** You may run a Customer Platform for children. If your service is directed at children, you are responsible for its age-appropriate design, for any parental consent that is required, and for the other duties that apply to a service directed at children.

## 12. General {#12-general}

Liability under this Agreement is subject to the limitations in the Terms of Service, except that nothing limits either party's liability to a data subject under Article 82 or any liability that cannot be limited by law.

**Apportionment.** Where both of us are responsible for damage caused by the processing of End User Data, each of us is responsible, as between us, for the part of the damage that corresponds to its share of responsibility, as provided in Article 82. You are responsible to us for claims, fines and costs to the extent that they arise from your instructions or from your own breach of Data Protection Law.

This Agreement **prevails over the Terms of Service** on data protection. It runs for as long as we process End User Data on your behalf, and clauses 7, 8, 9 and 12 survive.

**Order of precedence.** If the documents that govern End User Data conflict, they apply in this order:

(a) the Standard Contractual Clauses and the UK International Data Transfer Addendum, where they apply;

(b) this Agreement, including its Annexes; and

(c) the Terms of Service, including any Order Form.

**Effective date.** This Agreement takes effect on the date you accept the Terms of Service or, if later, the date we first process End User Data on your behalf.

We may update it on **30 days' notice** where the update does not materially reduce your protection.

---

## Annex 1: Details of processing {#annex-1-details-of-processing}

**Subject matter**: provision of the Vodlix white-label video platform.

**Duration**: the term of the Terms of Service, plus clause 7.

**Nature and purpose**: hosting, encoding, storage, delivery and analysis of Customer Content and the operation of a Customer Platform, including End User account management, subscription and access control, and delivery analytics.

**Further processing where you enable it**: consent management through Cookie Panda; CRM, transactional email and voice agents through Vertex CRM; and transcription, translation, subtitling, dubbing and metadata generation through Vodlix Intel (Annex 3).

**Categories of data subject**: End Users of your Customer Platform, including Subscribers, registered free users and unregistered visitors.

**Further categories of data subject, where you enable the relevant feature**: people who contact you through Vertex CRM, including by voice call; and people whose voice, face or performance appears in Customer Content that you dub or use with voice or likeness features (clause 10).

**Categories of personal data**

| Category | Examples |
| --- | --- |
| Account | Name, email, password hash, status, preferences |
| Subscription | Plan, status, dates, renewal, cancellation |
| Payment | Transaction records and card last four digits. **Full card data is never processed by Vodlix** |
| Viewing | Titles, timestamps, duration, position, device, quality |
| Technical | IP address, user agent, device and advertising identifiers, approximate location |
| Consent | IP address, user agent, page URL, subject identifier, advertising identifier, country, region, device type, TCF and GPP strings, consent records (where Cookie Panda is used) |
| CRM and messaging | Ticket and conversation content, message bodies, campaign recipients, email sent, open, click and bounce events (where you enable Vertex CRM) |
| Voice calls | Call audio and transcripts (where you enable voice agents in Vertex CRM) |
| Voice and likeness | Where you use AI dubbing or voice features (clause 10) |
| Face data (biometric) | Where you use cast linking (clause 10) |

**Frequency**: continuous, for the term.

---

## Annex 2: Technical and organizational measures {#annex-2-technical-and-organizational-measures}

**Access control**: two-factor authentication; access on a need-to-know basis; access removed on departure.

**Encryption**: TLS in transit; on eligible plans, multi-DRM.

**Resilience**: backups; multi-CDN delivery.

**Security scanning**: regular security scanning.

**Personnel**: confidentiality obligations for everyone with access.

**Incident response**: documented process; notification under clause 6.

**Certification**: we do not currently hold ISO 27001 or SOC 2.

---

## Annex 3: Sub-processors {#annex-3-sub-processors}

### Our own services (not sub-processors) {#our-own-services-not-sub-processors}

Cookie Panda, Vodlix Intel and Vertex CRM are services of Fast OTT Ltd itself, not separate companies, so they are not sub-processors. We list them so you can see where your data goes. Their outside providers are sub-processors and are in Table A.

| Service | What it does | Personal data it handles | Where it runs |
| --- | --- | --- | --- |
| **Fast OTT Ltd** t/a **Cookie Panda**, UK | Consent management (IAB TCF CMP, vendor ID 515) on Customer Platforms | IP address (truncated when the consent is recorded), user agent, page URL, subject\_id (first-party cookie + localStorage), advertising identifier (IDFA / AAID / RIDA / TIFA) on mobile and CTV, country, region, device type, TCF string, GPP string, consent hash, signature | **Hetzner Online GmbH, us-west, Hillsboro, Oregon, USA** (single instance) |
| **Fast OTT Ltd** t/a **Vodlix Intel**, UK | AI features: transcription, translation, subtitling, dubbing, metadata generation | **Customer Content only.** End User personal data is not submitted to Intel. **May include talent voices where dubbing is used** | Vodlix servers in the United States and the European Union |
| **Fast OTT Ltd** t/a **Vertex CRM**, UK | Customer-facing CRM and transactional email. **Subscribers only** sync as contacts | Where a Customer enables the CRM bundle: End User name, email, subscription status, ticket and conversation content, message bodies, campaign recipients, email engagement events | **Hetzner Cloud, us-east, ash-dc1, Ashburn, Virginia, USA.** PostgreSQL on the same host, localhost-bound |
| **Fast OTT Ltd**, stats.vodlix.com (ClickHouse) | Email and engagement analytics for Vertex CRM | contact\_id plus email sent / open / click / bounce events | **Subhosting, Dallas, Texas, USA** |

### Table A: Sub-processors (End User personal data) {#table-a-sub-processors-end-user-personal-data}

Engaged to process personal data on behalf of Customers.

| # | Entity | What it does for us | Personal data it sees | Hosting | Transfer basis (from UK/EU) |
| --- | --- | --- | --- | --- | --- |
| A3.1 | **ActiveCampaign, LLC** (Postmark), USA | Outbound email for Vertex CRM | **Recipient address and full message body** | USA | EU-U.S. Data Privacy Framework and UK Extension (ActiveCampaign, LLC); Standard Contractual Clauses |
| A3.4 | **Cloudflare, Inc.**, USA | Proxies app.vertexcrm.io, terminates TLS | IP address, request metadata, TLS termination | Global edge | **Data Privacy Framework** (certified) |
| A3.5 | **OpenAI, L.L.C.** and **Google LLC** (Gemini) | Voice agents in Vertex CRM, **only where a Customer enables voice** | **Call audio and transcripts**, which may contain anything the caller says | USA | OpenAI: EU-U.S. Data Privacy Framework and UK Extension (OpenAI); Standard Contractual Clauses in OpenAI's data processing addendum. Google: **DPF** |
| A4 | **Cloudflare, Inc.**, USA | CDN, WAF, DNS, Workers. Proxies vodlix.com, Customer Platforms and cookiepanda.app | IP address, request metadata, TLS metadata. Transient, not retained as a record | Global edge; US-headquartered | **EU-US / UK-US Data Privacy Framework** (certified) |
| A5 | **BunnyWay d.o.o.** (Bunny CDN), Slovenia | Video delivery CDN; also serves Cookie Panda banner assets | IP address, request metadata for delivery | EU (Slovenia) + global edge | **EU-based.** UK→EU adequacy. No SCCs needed for the EU leg |
| A5a | **DataCamp Limited** (CDN77), UK, company 07489096 | Content delivery | IP address, request metadata | United Kingdom and its global edge network | **UK company.** UK adequacy decision for EEA data |
| A6 | **Google LLC / Google Ireland Ltd** (Gemini) | AI model provider behind Vodlix Intel | Customer Content submitted for processing. **Not End User personal data** | US / EU | **Data Privacy Framework** (certified) |
| A7 | **ElevenLabs Inc.**, USA | Voice synthesis, **voice cloning**, and **end-to-end dubbing which clones every speaker** | Customer Content (audio, text), **and a voice model of every identifiable speaker in any dubbed video** | USA | **SCCs + UK Addendum** |
| A9c | **OVH SAS**, France | Hosting for the platform's EU servers and media rendering | Platform data held on the EU servers, and media in transit, including faces and voices | European Union | None needed (EEA) |
| A9 | **Hetzner Online GmbH**, Germany | Compute and storage hosting for Cookie Panda | All Cookie Panda consent data at rest, plus signing keys | **Hillsboro, Oregon, USA** (German company, US region) | **SCCs + UK Addendum.** The processor is EU; the *hosting region* is US, which is what triggers the transfer |
| A10 | **Subhosting** | Hosting for the platform's US servers, vodlix.com and stats.vodlix.com | Platform data held on the US servers, and server logs including IP | USA, including Dallas, Texas; upstream network is Hivelocity (AS29802), which is **Subhosting's** sub-processor, not ours | **SCCs + UK Addendum** |
| A11 | **IAB Europe**, Belgium | Global Vendor List, fetched by the Cookie Panda SDK | **The End User's own device contacts IAB directly**, so IAB sees the End User's IP | EU (Belgium) | EU-based; UK→EU adequacy. |

### Change notification {#change-notification}

We give Customers **at least 30 days' notice** before adding or replacing a Table A sub-processor, by email and by updating this page. A Customer who reasonably objects on data protection grounds may terminate the affected Services without penalty.

To be notified of changes, email privacy@vodlix.com and we will add you to the notification list.

---

## Annex 4: SCC and UK Addendum selections {#annex-4-scc-and-uk-addendum-selections}

**Module Three** (processor to processor). Module Two applies where you are established outside the UK/EEA and are yourself the exporter.

| Clause | Selection |
| --- | --- |
| 7: Docking | Included |
| 9: Sub-processors | **Option 2**, general authorization, **30 days** |
| 11(a): Independent redress | Not selected |
| 13 / Annex I.C | Determined by your establishment; **ICO** where UK-established |
| 17 / 18: Law and forum | **Ireland** |

Ireland because the EU SCCs require the law of an EU member state. The Terms of Service remain governed by England and Wales.

**UK Addendum (ICO version B1.0)**. Table 1: exporter is you, importer is Fast OTT Ltd t/a Vodlix. Table 2: Module Three with the selections above. Table 3: Annex I = Annex 1, Annex II = Annex 2, Annex III = Annex 3. Table 4: **Neither Party** may end the Addendum when the Approved Addendum changes.

October 22, 2026

October 22, 2026

3.10.22

en

- 3.10.22 — October 22, 2026 — Cookie Panda records a truncated IP address, not a full one.
- 2.10.22 — October 22, 2026 — First version published from the Hub