Legal

Data Processing Agreement

Last updated: Oct 14, 2026

This Data Processing Agreement (DPA) forms part of the Terms of Service between Mimet Tech Solutions (“processor”) and the business customer using Reelamo (“controller”). It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR) and applies automatically when you accept the Terms of Service as a business customer.

Scope and roles

This DPA covers the personal data that the controller puts into Reelamo or generates with it, such as photos, videos or voices of people, names in briefs, and feedback from reviewers on share links. For this data, the customer is the controller and Reelamo is the processor. For account and billing data, Reelamo is itself the controller, as described in the Privacy Policy.

Details of the processing

Subject matter and purpose

Creating, storing and delivering video ads and related storyboards, and providing the app, API, share links and support.

Nature of the processing

Storage, analysis by AI models, editing, rendering, transmission to the controller and deletion.

Duration

For the term of the agreement, plus the deletion periods stated below.

Categories of data subjects

People shown or named in the controller's content (such as employees, customers, models), users invited to the workspace, and reviewers of shared ads.

Categories of personal data

Images, video and voice recordings, names, contact details and any other personal data the controller includes in briefs or uploads. The controller does not upload special categories of personal data unless strictly necessary and lawful.

Instructions and confidentiality

Reelamo processes personal data only on the controller's documented instructions, which consist of the agreement, this DPA and the controller's use of the service's features. If Reelamo believes an instruction infringes the GDPR, it will inform the controller. Reelamo does not process the data for its own purposes, does not sell it and does not use it to train AI models.

Everyone at Reelamo with access to personal data is bound by confidentiality and only has access where needed for their work.

Security measures

Reelamo implements appropriate technical and organizational measures under Article 32 GDPR, including:

• encryption of all connections (TLS) and encryption at rest of stored files and backups;
• separation of customer data per workspace and private storage accessible only through short-lived signed links;
• securely hashed passwords, optional two-step sign-in, breached-password checks, rate limiting and bot protection;
• access to production systems limited to authorized staff with strong authentication, and logging of security events;
• automatic deletion of ad files after 7 days, daily backups and tested restore procedures;
• timely security updates and automated content moderation against abuse.

Subprocessors

The controller gives general authorization for the use of the subprocessors below. Reelamo imposes data protection obligations on each subprocessor that are at least as protective as this DPA and remains responsible for their performance.

Reelamo will announce new or replaced subprocessors at least 30 days in advance by email to the account owner and on this page. The controller may object on reasonable grounds; if we cannot find a solution together, the controller may cancel the affected service with a refund of prepaid amounts for the remaining period.

International transfers

Reelamo hosts data in the EU. Where a subprocessor processes personal data outside the European Economic Area, Reelamo ensures an adequate level of protection through an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, supplemented by additional measures where necessary.

Assistance and data subject requests

Taking into account the nature of the processing, Reelamo helps the controller to respond to requests from data subjects, for example by offering export and deletion features in the app. If Reelamo receives such a request directly, it forwards it to the controller without responding itself, unless instructed otherwise. Reelamo also assists with data protection impact assessments and prior consultations where reasonably required.

Personal data breaches

Reelamo notifies the controller without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting the controller's data. The notification includes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Reelamo provides updates as more information becomes available and supports the controller in notifying the supervisory authority and data subjects.

Information and audits

Reelamo makes available the information needed to demonstrate compliance with this DPA. The controller may have an audit carried out once a year by an independent auditor bound by confidentiality, at the controller's expense, after at least 30 days' notice, and without disproportionately disrupting the service. Reelamo may first offer documentation or existing audit reports where these are sufficient.

Deletion at the end of the service

Before the account is closed, the controller can download its data. After the account is closed, Reelamo deletes the controller's personal data within 30 days and from backups within the backup cycle of 14 days, unless EU or Dutch law requires longer storage.

Liability and precedence

The limitations of liability in the Terms of Service apply to this DPA, as far as the GDPR allows. If this DPA conflicts with the Terms of Service, this DPA prevails with respect to the processing of personal data. This DPA is governed by Dutch law.

Signed copy

Need a signed copy for your records? Email [email protected] with your company name, address and the email address of your Reelamo account, and we'll send you a copy to sign.