Data processing agreement

1. Parties and subject matter

This data processing agreement (the “Agreement”) is between the Ambex Video customer who has registered an account on the platform (the “Customer”, controller) and SIA Ambex, registration No. 40203316992 (“Ambex”, processor). It is part of the terms of service and takes effect when the Customer accepts them.

The Agreement covers personal data that Ambex processes on the Customer's behalf while providing the service: mainly in the videos the Customer uploads and the content made from them. It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR). Data that Ambex processes as controller (account, billing and technical data) is described in the privacy policy.

2. Description of the processing

• Purpose and nature: storing videos, speech recognition, editing, audio processing, creating subtitles, titles, descriptions and cover images, publishing and scheduling to the social networks the Customer chooses, showing statistics of published videos.
• Data subjects: people seen or heard in the Customer's videos or named in their text; the Customer's team members.
• Types of data: image and voice, names and other data spoken in a video or contained in its text; team members' names and email addresses; social network account names and statistics of published videos.
• Special categories of data (GDPR Article 9) are not intended. If the Customer uploads such data, the Customer is responsible for having a legal basis for it.
• Duration: as long as the Customer has an account, and until the data is deleted under section 8.

3. Customer instructions

Ambex processes the data only on the Customer's documented instructions. These are this Agreement, the terms of service and the Customer's actions on the platform (for example uploading, editing, publishing or deleting a video). If Ambex believes an instruction infringes data protection law, it informs the Customer without delay. Ambex may also process data where EU or Latvian law requires it; it then informs the Customer beforehand unless the law prohibits this.

4. Obligations of Ambex

• Ensure that people with access to the data have committed to confidentiality.
• Apply appropriate technical and organisational security measures (GDPR Article 32), including: encrypted connections (HTTPS/TLS), login with a one-time email code, access limited by workspace and role, server access for authorised staff only, backups and activity logs.
• Help the Customer respond to data subject requests (access, rectification, erasure, etc.). Most of these the Customer can handle directly on the platform by editing or deleting content.
• Help the Customer meet its obligations under GDPR Articles 32–36 (security, breach notification, impact assessment) as far as they concern the service.
• Notify the Customer of a personal data breach affecting the Customer's data without undue delay and no later than 48 hours after becoming aware of it, with the information available about the breach and the measures taken.
• Make available the information needed to demonstrate compliance with this Agreement and allow reasonable audits agreed in advance (no more than once a year, except after a breach).

5. Sub-processors

The Customer gives general authorisation for the use of sub-processors. Ambex binds each of them by contract to data protection obligations no less protective than those in this Agreement and remains responsible for their work. Current sub-processors:

Ambex informs the Customer by account email at least 14 days before adding or replacing a sub-processor. During that time the Customer may object on reasonable grounds; if no solution is agreed, the Customer may cancel the subscription and receive a pro-rata refund of the unused paid period.

The social networks the Customer publishes to are not sub-processors of Ambex: they process published content as independent controllers under their own terms.

6. Transfers outside the EEA

Where a sub-processor processes data outside the European Economic Area, Ambex ensures the safeguards of GDPR Chapter V: a European Commission adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's standard contractual clauses.

7. Obligations of the Customer

• The Customer has a legal basis for processing the personal data it uploads and, where required, the consent of the people seen and heard in its videos, including for publishing them on social networks.
• The Customer informs data subjects about the processing as required by GDPR Articles 13 and 14.
• The Customer is responsible for what it instructs to be published and for its team members' access to the account.

8. Deletion when the agreement ends

Before closing the account, the Customer can download its videos. After the account is closed, Ambex deletes the Customer's content within 30 days; copies in backups expire in their normal rotation, within 90 days at most. Ambex may keep data longer only where the law requires it.

9. Liability and precedence

Liability of the parties is governed by the terms of service, except where GDPR Article 82 provides otherwise. If this Agreement and the terms of service conflict on data protection, this Agreement prevails. The Agreement is governed by the laws of the Republic of Latvia.

10. Contact

Questions about data processing and notices under this Agreement: [email protected]. If you need a signed copy, write to us.

Last updated: 30 October 2026.