Serialoom Data Processing Addendum (Business / Studio Customers)

This DPA forms part of the agreement between Customer (controller) and [LEGAL NAME] operating as Serialoom (processor) when Customer uses Serialoom to process personal data contained in Customer Content on Customer’s documented instructions.

If Customer is an individual using Serialoom solely for personal purposes, the Privacy Policy applies and this DPA may not be required.

1. Subject matter and duration

Processing of personal data in Customer Content (scripts, media, member data Customer enters) for the term of the service and until deletion/return per this DPA.

2. Nature and purpose

Hosting, storage, transmission, transformation (including AI generation via subprocessors), rendering, collaboration, support, security, and abuse prevention as needed to provide Serialoom.

3. Types of data and data subjects

May include names, images, voices, scripts identifying persons, member emails, and other data Customer chooses to upload. Data subjects may include Customer’s users, talent, clients, or other individuals appearing in content. Customer shall not submit special-category/sensitive data except as needed and lawful for productions, and shall obtain required consents.

4. Instructions

Serialoom processes Customer Content only on Customer’s documented instructions (including configuration in the product) unless required by law. These Terms + product features constitute instructions. Unlawful instructions may be refused.

5. Confidentiality

Personnel with access are bound by confidentiality obligations.

6. Security

Serialoom implements technical and organizational measures appropriate to risk (access control, tenancy isolation, TLS, logging). Certifications are not warranted unless attached in writing.

7. Subprocessors

Customer authorizes Serialoom to use subprocessors listed in the Subprocessor List. Serialoom will impose data-protection terms no less protective than this DPA in material respects. Serialoom will provide notice of material new subprocessors (email or status page) and a reasonable objection window for enterprise customers who subscribe to notices. If Customer reasonably objects on data-protection grounds and no workaround exists, Customer may terminate the affected service as sole remedy.

8. Assistance

Serialoom will reasonably assist with data-subject requests, DPIAs, and breach notifications affecting Customer Content, taking into account the nature of processing. Customer remains responsible for responding to data subjects who contact Customer directly.

9. Breach

Serialoom will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Content, with information reasonably available.

10. Deletion or return

Upon termination or request, Serialoom will delete or return Customer Content from primary systems within the Privacy Policy timelines, except data retained as required by law or isolated backups until expiry. Certified deletion available upon written request where feasible (not a SOC2 claim).

11. Audits

Customer may request annually a security summary / questionnaire response. On-site audits only if mandated by law or mutual written agreement, at Customer’s expense, without compromising other customers’ security. No obligation to disclose exploit details.

12. International transfers

Where Serialoom transfers personal data internationally, it will use lawful transfer mechanisms (e.g., SCCs) as applicable. Modules to be attached after counsel confirms Serialoom roles and destinations.

13. Liability

Liability under this DPA is subject to the limitations in the Terms, except where prohibited.

14. Order of precedence

DPA controls over Terms for conflicting data-processing terms for Customer Content; Paddle remains independent controller for payment data.

*Counsel-ready draft — 2026-08-05. Transfer modules and signature block to be completed by counsel.*