VFXBoi Data Processing Agreement (template version 2026-07-12)

This Data Processing Agreement ("DPA") supplements the VFXBoi End User License Agreement or other written agreement between the Customer ("Controller") and VFXBoi ("Processor").

1. Definitions
"Personal Data" means information relating to an identified or identifiable natural person processed by Processor on behalf of Controller through the App Suite.
"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.

2. Subject matter and duration
Processor will process Personal Data only to provide the App Suite, related support, billing, security monitoring, and as otherwise instructed by Controller, for the term of the main agreement.

3. Nature and purpose
Processing includes hosting account profiles, studio metadata, audit logs, and operational telemetry needed to run pipeline workflows, render farm coordination, review, delivery, and vendor fleet visibility.

4. Types of data and data subjects
Data subjects may include Controller's employees, contractors, and clients. Categories include contact details, authentication data, usage logs, and production metadata that may incidentally identify individuals.

5. Processor obligations
Processor shall:
(a) process Personal Data only on documented instructions from Controller, unless required by law;
(b) ensure personnel with access are bound by confidentiality;
(c) implement appropriate technical and organizational security measures;
(d) assist Controller with data-subject requests where feasible;
(e) delete or return Personal Data on termination, subject to legal retention;
(f) make available information necessary to demonstrate compliance and allow audits on reasonable notice.

6. Confidentiality
Processor treats Controller production data and Personal Data as confidential. Processor will not access, use, or disclose such data except to operate the service, as instructed, or as required by law.

7. Security
Processor maintains access controls, encryption in transit where supported, logging, and backup practices appropriate to the deployment tier. Controller is responsible for credentials, network access, and backups of their own project files.

7a. Security features and diagnostics
Where Controller enables protected review or delivery links, Processor operates content-security (forensic) monitoring on Controller's behalf, logging viewer, device, timestamp, and access-count data for that media so Controller can detect and trace unauthorised sharing; Controller is the controller of that security data and sets the retention window. Processor also runs automated diagnostics and health monitoring to operate and secure the Service; basic diagnostics are anonymized and exclude Controller production content and personal data, and Processor does not use Controller content to train AI models. Deeper diagnostics that include limited identifiers are used only on Controller instruction or opt-in, for example to resolve a support case.

8. Subprocessors
Controller authorizes Processor to engage subprocessors for hosting, email, and monitoring. Processor remains responsible for subprocessors and will notify Controller of material changes when practicable.

9. Personal data breach
Processor will notify Controller without undue delay after becoming aware of a Personal Data breach affecting Controller data, and will provide reasonable cooperation for mitigation and regulatory notices.

10. International transfers
Where Personal Data is transferred outside the Controller's country, Processor will implement appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

11. Liability
Liability under this DPA is subject to the limitation of liability in the main agreement. Nothing in this DPA limits either party's liability where limitation is not permitted by law.

12. Governing law
This DPA follows the governing law of the main agreement unless otherwise agreed in writing.

Annex: contact privacy@vfxboi.in to execute this template or request the current subprocessor list.