How this applies
This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer") and Smith & Johnson, Inc., a Delaware corporation ("Sundream"). It applies automatically, with no separate signature, where Sundream processes personal data on your behalf and that processing is subject to the EU or UK GDPR or comparable law.
Where this DPA conflicts with the Terms of Service, this DPA governs for matters of data protection. A separate negotiated agreement, if we have one with you, governs over both.
If your procurement process requires a countersigned copy, request one at support@sundreamstudio.com.
Roles
For workspace content and account data you upload or generate, you are the controller and Sundream is the processor. You are responsible for having a lawful basis for the personal data you put into the service, and for any notices or consents your own users require.
For data we process to run our business — account administration, billing, security, and product analytics of our own service — Sundream acts as a controller, and our Privacy Policy governs.
Scope of processing
- Subject matter: provision of the Sundream AI film production service.
- Duration: the term of your subscription, plus the retention and deletion periods described in our Privacy Policy.
- Nature and purpose: hosting, storage, transmission, generation of media, and the support and security operations needed to deliver those.
- Types of personal data: account identifiers and contact details, and any personal data contained in workspace content you upload or generate — including likenesses in reference images and generated media.
- Categories of data subjects: your personnel and collaborators with workspace access, and any individuals appearing in or identified by the content you submit.
Our obligations
- Process personal data only on your documented instructions, which your use of the service and the Terms constitute, except where law requires otherwise — in which case we will tell you unless legally prohibited.
- Ensure personnel authorised to process personal data are bound by confidentiality.
- Implement appropriate technical and organisational measures as described below.
- Assist you, taking into account the nature of processing, in responding to data subject requests, and in your obligations for security, breach notification, and data protection impact assessments.
- Notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information we reasonably have at the time.
- Delete or return personal data at the end of the service, subject to the retention described in our Privacy Policy and any legal obligation to retain.
- Make available the information reasonably necessary to demonstrate compliance with this DPA.
Security
We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls and authentication, tenant isolation, logging and monitoring, review of subprocessors, and restriction of production access to personnel who require it.
Security measures evolve. We may update them provided the overall level of protection is not reduced.
Subprocessors
You give general authorisation for Sundream to engage subprocessors. Our current subprocessors are listed on the Subprocessors page, which we keep current.
We impose data protection obligations on each subprocessor no less protective than those in this DPA, and remain liable for their performance. To be notified before we add or replace a subprocessor, and to have the opportunity to object on reasonable data protection grounds, subscribe by writing to support@sundreamstudio.com.
International transfers
Sundream and its subprocessors are located in the United States, so personal data you submit will be transferred outside the EEA and the UK.
Where such a transfer is subject to the EU GDPR, the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference and apply to that transfer. Where it is subject to the UK GDPR, the UK International Data Transfer Addendum to those clauses applies. This DPA and the Subprocessors page supply the details their annexes require.
We carry out transfer risk assessments where required and will cooperate with you on any supplementary measures reasonably needed.
Audits
We will respond to reasonable written requests for information needed to verify compliance with this DPA, including summaries of our security measures and any third-party reports we hold.
Where that is genuinely insufficient to satisfy a supervisory authority or a legal obligation, you may conduct an audit no more than once in any twelve-month period, on at least thirty days' written notice, during business hours, without unreasonably disrupting our operations, and subject to confidentiality. You bear your own costs.
AI providers
Delivering generation features requires transmitting your prompts, references, and related project context to the AI subprocessors listed on the Subprocessors page. This is processing on your instruction: it happens only when you invoke a feature that requires it.
We do not use your workspace content to train Sundream-owned models. Third-party providers process submitted content under their own terms; we select providers whose terms are consistent with this DPA, but you should review the list if you have specific restrictions.
Liability and term
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service.
This DPA takes effect when you begin using the service and continues until all personal data processed on your behalf has been deleted or returned in accordance with it.
Contact
Data protection enquiries, subprocessor change notifications, and requests for a countersigned copy: support@sundreamstudio.com, or by post to Smith & Johnson, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.