Last Updated: 2026-05-29
This Data Processing Agreement (DPA) forms part of the Terms of Service between you and UnMark and governs the processing of Personal Data by UnMark on your behalf.
In this Data Processing Agreement (DPA), 'Data Controller' refers to you (the user), 'Data Processor' refers to UnMark, 'Personal Data' means any information relating to an identified or identifiable natural person, and 'Processing' means any operation performed on Personal Data.
UnMark processes Personal Data solely for the purpose of providing video processing services as described in our Terms of Service. The categories of data subjects include: users of the Service (Data Controller's customers). The categories of Personal Data processed include: account information (email, username), uploaded content metadata, processing results, and usage analytics. The duration of processing is for the term of the agreement between Data Controller and Data Processor, unless otherwise agreed in writing.
UnMark shall: (a) process Personal Data only on documented instructions from the Data Controller; (b) ensure that persons authorized to process Personal Data have committed themselves to confidentiality; (c) implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk; (d) not engage another processor without prior written authorization. The Data Controller hereby provides general written authorization for the sub-processors listed in Section 5. For any new sub-processor not listed in Section 5, UnMark shall provide prior written notice and the Data Controller may object on reasonable data protection grounds.
UnMark implements industry-standard security measures including encryption at rest and in transit, access controls, regular security audits, and incident response procedures. We maintain a security program designed to protect the confidentiality, integrity, and availability of your data. Upon the Data Controller's request, UnMark shall provide reasonable assistance to the Data Controller in carrying out any data protection impact assessments (DPIAs) and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to UnMark.
UnMark engages the following approved sub-processors to deliver the Service: Vercel (cloud hosting, edge functions, and content delivery), AWS (video processing compute and temporary file storage), Creem (payment processing and subscription management), Axiom (log management and application monitoring), and transactional email delivery services. All sub-processors are contractually bound to provide sufficient guarantees to implement appropriate technical and organizational measures. Before engaging any new sub-processor not listed above, UnMark shall provide prior written notice, and the Data Controller shall have the right to object on reasonable data protection grounds within fourteen (14) days of such notice. An up-to-date list of sub-processors is maintained on our Sub-processors page and in our Privacy Policy.
UnMark shall reasonably assist the Data Controller in fulfilling its obligations to respond to requests from data subjects exercising their rights under the GDPR, taking into account the nature of the processing and the information available to UnMark. Deletion or return of Personal Data upon termination is addressed in Section 9 of this DPA.
In the event of a personal data breach, UnMark shall notify the Data Controller without undue delay and no later than 72 hours after becoming aware of the breach. The notification shall include the nature of the breach, categories and approximate number of data subjects concerned, and measures taken or proposed.
The Data Controller has the right to audit UnMark's compliance with this DPA, subject to reasonable notice and during normal business hours. UnMark shall make available all information necessary to demonstrate compliance.
This DPA shall remain in effect for the duration of the agreement between Data Controller and Data Processor. Upon termination of the processing services, UnMark shall, at the choice of the Data Controller, delete or return all Personal Data to the Data Controller, and delete existing copies unless applicable law requires continued storage. UnMark shall certify the completion of such deletion or return in writing upon the Data Controller's request. The obligations of confidentiality and any provisions intended by their nature to survive termination shall continue in effect.
This DPA shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of law principles. Any dispute arising out of or in connection with this DPA shall be subject to the dispute resolution provisions set forth in the Terms of Service. Each party's liability arising out of or related to this DPA shall be subject to the limitations and exclusions of liability set forth in the Terms of Service. Nothing in this DPA shall limit either party's liability for breaches of data protection laws to the extent such liability cannot be limited by applicable law.
