Data Processing Agreement
DATA PROCESSING AGREEMENT
METADAT-AI LTD | Version 1.5 | November 2026 | www.metadat-ai.com/legal/dpa | Governing law: England and Wales
This Data Processing Agreement ("DPA") is between the Customer, acting as controller (the "Controller"), and METADAT-AI LTD, company number 17486598, of 17 Cowdenbeath Path, London N1 0LE ("Metadat-AI" or the "Processor"). It forms part of the Customer Terms (www.metadat-ai.com/legal/customer-terms) and the Order Form or Reseller Customer Order Form that incorporates them (together, the "Principal Agreement"). In the reseller channel the Controller is the end customer named in the Reseller Customer Order Form, not the reseller. If this DPA conflicts with the Principal Agreement on a data protection matter, this DPA prevails, except that liability is governed by clause 8.
Where the Controller's Affiliates use the Services, the Controller is their single point of contact with Metadat-AI, passes on to them any information Metadat-AI provides under this DPA, and is responsible for their compliance with it. Where the Controller acts as processor for another controller, Metadat-AI is its sub-processor and the Controller warrants that its instructions, including its appointment of Metadat-AI, are authorised by that controller.
1. DEFINITIONS
Terms defined in Part 1 of the Master Definitions Schedule (www.metadat-ai.com/legal/definitions) or in the UK GDPR have the same meanings in this DPA. "Data Protection Laws" includes, where the Controller is subject to it, Regulation (EU) 2016/679 ("EU GDPR"). In this DPA:
| "Personal Data" | Customer Personal Data, that is Personal Data that Metadat-AI processes on the Controller's behalf under the Principal Agreement. |
|---|---|
| "Restricted Transfer" | a transfer of Personal Data (including remote access) to a country outside the United Kingdom and the EEA that is not covered by an adequacy decision or adequacy regulations under Data Protection Laws. |
| "Sub-processor" | a third party engaged by Metadat-AI to process Personal Data on the Controller's behalf. |
2. SUBJECT MATTER AND DETAILS OF PROCESSING
The subject matter, nature, purpose and duration of the processing, and the types of Personal Data and categories of Data Subjects, are set out in Annex 1. Metadat-AI processes Personal Data only as necessary to provide the Services under the Principal Agreement.
3. CONTROLLER OBLIGATIONS
3.1 Lawful basis. The Controller warrants that it has a valid lawful basis under Data Protection Laws for each category of Personal Data it submits to the Services, and will keep evidence of that basis throughout this DPA.
3.2 Accuracy and minimisation. The Controller is responsible for the accuracy of Personal Data it submits to the Services and must not submit more Personal Data than is necessary for its purpose.
3.3 Instructions. The Principal Agreement and this DPA, together with the Controller's configuration and use of the Services, are the Controller's documented instructions. Any further instruction must be in writing, and Metadat-AI may charge for instructions outside the scope of the Services.
3.4 Job metadata. The Controller is responsible for the file names, source links, prompts, job labels, client references and metadata it sends with a job, and should not include Personal Data in them where it can avoid doing so. Source links should expire as soon as practical after the job is submitted. Metadat-AI records this job metadata in job records and activity logs to provide and support the Services.
4. PROCESSOR OBLIGATIONS
4.1 Instructions only. Metadat-AI shall process Personal Data only on the Controller's documented instructions, unless law requires otherwise, in which case it shall tell the Controller first (unless the law prohibits this). Metadat-AI shall tell the Controller if, in its reasonable opinion, an instruction would infringe Data Protection Laws.
4.2 Confidentiality. Metadat-AI shall ensure that persons authorised to process Personal Data are bound by confidentiality and have received appropriate data protection training.
4.3 Security. Metadat-AI shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as described in Annex 2.
4.4 Sub-processors. The Controller gives Metadat-AI general authorisation to engage Sub-processors. The current list is the sub-processor register at www.metadat-ai.com/legal/sub-processors (the "Sub-processor Register"), summarised in Annex 3. Metadat-AI shall (a) bind each Sub-processor by written terms giving protection equivalent to this DPA; and (b) remain liable to the Controller for each Sub-processor's processing as if it were its own. Third-party services that the Controller chooses to connect to the Services (for example its own AI model accounts through its own API keys, Metadat-AI's skills or an MCP connection) act for the Controller and are not Metadat-AI's sub-processors; Metadat-AI sends Customer Content or metadata to them only when the Controller enables it.
4.5 Sub-processor changes. Metadat-AI shall give the Controller at least 30 days' written notice of any new or replacement Sub-processor. If the Controller objects on reasonable data protection grounds within that period, the parties shall discuss the objection in good faith. If they cannot resolve it within 30 days of the objection, the Controller may terminate the Principal Agreement by written notice, without penalty for the termination itself, and must stop using the Services by the date termination takes effect. Prepaid fees are not refundable.
4.6 Assistance. Taking into account the nature of the processing and the information available to it, Metadat-AI shall give the Controller reasonable assistance with its obligations under Data Protection Laws, including Data Subject requests, security, breach notification, data protection impact assessments and prior consultation with a Regulator.
4.6A Charges for assistance. Metadat-AI may charge for its reasonable time and materials, at rates notified in advance, for assistance under this DPA beyond the ordinary provision of the Services, including material work on Data Subject requests, data protection impact assessments, authority requests under clause 4.9 and audits under clause 4.8. It shall not charge for assistance needed because of its own breach of this DPA.
4.7 Return and deletion. At the end of the Principal Agreement, Metadat-AI shall make Personal Data available for retrieval and then delete it, as set out in clause 4.7B, unless law requires it to be kept. For the purposes of Article 28(3)(g) of the UK GDPR and the EU GDPR, the Controller chooses in advance that galleries, Facial Data, Embeddings and other gallery data (including names attached to gallery entries and Tagging Information derived from galleries) are deleted and not returned or exported, on termination or on withdrawal of the Facial Recognition Features. They are Biometric Data about the people in the gallery: deleting them rather than exporting them protects those people and limits the risk of misuse, in line with the data minimisation, storage limitation and security principles of the UK GDPR and EU GDPR. They are also specific to Metadat-AI's models and of no use outside the Platform. They originate from the reference images and names the Controller supplied, so the Controller must keep its own copy of those, from which it can re-create a gallery elsewhere. Metadat-AI does not keep this data after termination for retrieval. Once deletion is complete, Metadat-AI shall confirm it in writing at the Controller's request.
4.7A Backups and deletion record. Deletion includes backup copies, which are overwritten as set out in clause 4.7B. Metadat-AI keeps a record of deletions.
4.7B Deletion timetable. This clause is the single deletion rule for the Services: (a) media submitted for a job is not stored: it is processed from the Controller's own storage or source link, and Metadat-AI deletes any working copy as soon as practicable after processing completes (normally immediately) and in any event within 30 days; hosted job content (AI Output and job records, including job metadata under clause 3.4) is available for retrieval on completion of the job; Metadat-AI may delete it at any time after completion and in any event deletes it within 30 days of processing, unless the Controller has bought managed storage, in which case it is treated as stored data under (b); (b) stored data (galleries, Facial Data, Embeddings, Custom Models and account data) is kept for the term of the Principal Agreement. During the term, the Controller is responsible for deleting stored data, using the deletion functions of the interface or API where they are available, which remove it immediately from live systems. Metadat-AI does not delete stored data on its own initiative during the term, but shall delete it on the Controller's written instruction, and may charge under clause 4.6A where the Controller could have deleted it through those functions; (c) on termination or expiry of the Principal Agreement, the Controller may retrieve stored data (other than Custom Models, which belong to Metadat-AI, and the gallery data described in clause 4.7, which is deleted and not returned or exported) for 30 days, after which Metadat-AI deletes it from live systems; (d) backup copies are overwritten within 30 days of deletion from live systems; (e) for customer-hosted deployments, and where the Controller uses its own storage or database (the default for galleries, Facial Data, Embeddings and AI Output), data held on the Controller's own infrastructure is the Controller's responsibility, including its retention and deletion; (f) usage records (job, account, Authorised User and asset IDs, timings, media duration, models used, job status and fees, but not media, AI Output or job metadata) are kept for the term of the Principal Agreement and 6 years after it, for billing, accounting, tax and claims; (g) activity, application, security and audit logs (which identify individuals by internal ID and may include job metadata under clause 3.4) are kept for 12 months, or longer where needed for an open investigation; and (h) Metadat-AI may keep data for longer only where law requires it, and only for that purpose. In the reseller channel this clause applies whether or not any fees have been paid.
4.8 Audit. Metadat-AI shall make available the information reasonably necessary to demonstrate its compliance with this DPA. The Controller shall rely first on that information and on any third-party reports or certifications Metadat-AI makes available. If these are not sufficient, the Controller (or an independent auditor bound by confidentiality) may audit Metadat-AI's relevant processing on at least 30 days' notice, during Business Hours, not more than once in any 24 months, unless a Regulator requires otherwise or the Controller has reasonable grounds to suspect a material breach of this DPA. Audits do not extend to pricing or other commercially sensitive information unrelated to data protection. The Controller bears its own audit costs and Metadat-AI may charge under clause 4.6A, unless the audit reveals a material breach by Metadat-AI.
4.9 Authority requests. If a government authority, Regulator or law enforcement body contacts Metadat-AI about Personal Data (other than in a routine inspection of Metadat-AI's operations generally), Metadat-AI shall notify the Controller without undue delay unless law prohibits it. At the Controller's request Metadat-AI shall give reasonable assistance with the response, and it shall not respond in the Controller's name without the Controller's written consent.
4.10 EU AI Act and EU Data Act. Metadat-AI's assistance with the Controller's obligations under Regulation (EU) 2024/1689 (EU AI Act) is set out in the Regulatory Compliance Terms (www.metadat-ai.com/legal/policies/regulatory-compliance). Switching and data export under Regulation (EU) 2023/2854 (EU Data Act) are dealt with in the exit provisions of the Customer Terms.
4.11 Biometric Data. Biometric Data is processed only where the Facial Recognition Features or the Age and Gender Estimation Features are activated under the Biometric Addendum, which prevails for that processing.
4.12 Anonymised data. The Controller instructs Metadat-AI that it may anonymise and aggregate Personal Data (other than Biometric Data) to create Usage Data, which Metadat-AI may use under clause 5.5 of the Customer Terms, provided the result cannot identify the Controller, any Data Subject or any specific item of content.
5. DATA SUBJECT RIGHTS
5.1 The Controller is responsible for responding to Data Subject requests. Metadat-AI shall tell the Controller without undue delay (and aims to do so within five Business Days) if it receives such a request and shall not respond to it unless the Controller instructs it to or law requires.
5.2 The Services allow the Controller to export, correct and delete Personal Data held in them, and the Controller is responsible for using these functions to respond to Data Subject requests (including erasure requests and withdrawals of consent) where they are available. Where they are not, Metadat-AI shall give such further technical assistance as is reasonably within its capabilities.
5.3 Where the Controller needs Metadat-AI's help with a request, it shall notify Metadat-AI in writing with enough information to identify the Data Subject and the processing concerned. Metadat-AI shall provide reasonable assistance, including a copy of relevant Personal Data it holds, and aims to do so within 15 Business Days. Assistance with anything the Controller could do itself through the interface or API, and any other assistance beyond routine export, is chargeable under clause 4.6A.
6. PERSONAL DATA BREACHES
6.1 Metadat-AI shall notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Personal Data.
6.2 Notification shall include, to the extent then known: (a) a description of the nature of the breach; (b) the categories and approximate number of Data Subjects and Personal Data records concerned; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach.
6.3 Metadat-AI shall take reasonable steps to contain the breach and shall give the Controller reasonable assistance in investigating and remedying it and in meeting the Controller's obligations to notify Regulators and Data Subjects.
7. INTERNATIONAL TRANSFERS
7.1 The Controller authorises the Restricted Transfers to the Sub-processors and locations described in Annex 1 and the Sub-processor Register. Metadat-AI shall not make any other Restricted Transfer unless the Controller has authorised it (including by not objecting under clause 4.5).
7.2 Each Restricted Transfer by Metadat-AI is made under the EU Standard Contractual Clauses (Module 3, processor to processor) with the UK Addendum, as described in Annex 4, or under another transfer mechanism permitted by Data Protection Laws.
7.3 Where Metadat-AI hosts processing or stores Personal Data, production processing and storage take place in Ireland (AWS eu-west-1) or at Metadat-AI's office in London, United Kingdom. Transfers of Personal Data from the EEA to Metadat-AI in the United Kingdom rely on the European Commission's adequacy decision for the United Kingdom; if that decision ceases to apply, the EU Standard Contractual Clauses described in Annex 4 apply.
8. LIABILITY
8.1 This DPA does not create any separate or additional liability. All liability of either party under or in connection with this DPA forms part of, and is subject to, the exclusions and aggregate caps in the Principal Agreement. Metadat-AI's liability for breach of its data protection or biometric obligations (including under this DPA and the Biometric Addendum) is subject to the separate aggregate data protection cap in the Customer Terms (two times the annual fees), and is not in addition to it.
8.2 Fines, penalties and compensation under Article 82 UK GDPR (or EU GDPR) are recoverable from Metadat-AI only to the extent caused by Metadat-AI's breach of this DPA or of its own obligations under Data Protection Laws, and only within the caps referred to in clause 8.1. Metadat-AI gives no indemnity under this DPA.
8.3 The Controller shall indemnify Metadat-AI against all losses, liabilities, fines, claims and reasonable costs arising from (a) any Controller instruction that is unlawful or that causes Metadat-AI to breach Data Protection Laws by following it; or (b) Customer Content or Personal Data that the Controller collected, submitted or used without a lawful basis or otherwise in breach of Data Protection Laws. This indemnity is not limited by the caps in the Principal Agreement.
9. TERM AND TERMINATION
9.1 This DPA applies for as long as Metadat-AI processes Personal Data for the Controller under the Principal Agreement. Metadat-AI may update it as a Living Document under section 13 of the Standard Legal Terms (www.metadat-ai.com/legal/standard-terms).
9.2 Clauses 4.7 to 4.7B, 6, 8 and 10 survive termination of this DPA.
10. GOVERNING LAW
This DPA and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the law of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any dispute.
ANNEX 1 - DETAILS OF PROCESSING
This Annex describes the processing. Controller details, and any Controller-specific details of the processing, are as stated in the Order Form or Reseller Customer Order Form.
| Controller name | The Customer named in the Order Form or Reseller Customer Order Form |
|---|---|
| Controller address | As stated in the Order Form |
| Controller contact (DPO or privacy lead) | As stated in the Order Form |
| Metadat-AI contact | Data Protection Lead, legal@metadat-ai.com |
| Subject matter of processing | Processing of video, audio, and image content submitted by the Controller to the Metadat-AI Platform for the purpose of AI-driven metadata extraction, transcription, tagging, classification, and content search indexing. |
| Duration of processing | For the term of the Principal Agreement and until deletion under clause 4.7B. |
| Nature of processing | Automated analysis of audio-visual content, including speech-to-text transcription; object, scene and face detection; content classification and tagging; metadata extraction; and, where activated under the Biometric Addendum, facial recognition. |
| Purpose of processing | Providing the Services to the Controller under the Principal Agreement (for example media asset management, archive indexing and content search), as further described in the Order Form. |
| Types of Personal Data | Video, audio and still images containing identifiable individuals (including faces, voices, names spoken or shown, and vehicle registration plates); transcripts, tags and other AI Output relating to them; job metadata the Controller supplies (file names, source links, prompts, job labels, client references and metadata), which may contain Personal Data; and Authorised User account and usage data. In job records and logs, Authorised Users and individuals in a gallery are identified by an internal ID, not by name. |
| Special category data (if any) | Where the Controller activates the Facial Recognition Features: Biometric Data (facial geometry), processed under the Biometric Addendum on the Article 9 condition the Controller identifies there. Otherwise none intended. |
| Categories of Data Subjects | Individuals who appear or are heard in Customer Content (for example employees, contributors, interviewees and members of the public), and Authorised Users. |
| Approximate volume of Data Subjects | Variable, depending on the Customer Content submitted. |
| Retention period | As set out in clause 4.7B. |
| Countries in which processing will occur | Production processing in Ireland (AWS eu-west-1) or at Metadat-AI's office in London, United Kingdom, where Metadat-AI hosts it. In a Customer-Hosted Deployment, media is processed on the Controller's own hardware, under its control. By default, galleries, Facial Data, Embeddings and AI Output are held in storage or a database the Controller controls; where the Order Form provides for Metadat-AI storage, they are stored in AWS eu-west-1 or at Metadat-AI's office in London, United Kingdom, and job records and usage records may be held in AWS eu-west-1 for retrieval through the API. Remote access by Metadat-AI from the United Kingdom and by development and support contractors from the United States and India, and limited system log data reviewed with Anthropic's Claude in the United States (see Annex 3). Development, demonstration and trial environment on Metadat-AI's own Mac Studio hardware at its registered office in London, United Kingdom: never used for production; Personal Data is processed there only for authorised trials and demonstrations under the Demonstration and Trial Policy. Restricted Transfers are made under clause 7 and Annex 4. |
ANNEX 2 - TECHNICAL AND ORGANISATIONAL SECURITY MEASURES
Metadat-AI maintains technical and organisational measures appropriate to the risk, including those described below. It reviews them regularly and may update them, provided the overall level of protection is not materially reduced.
| Security measure | Description |
|---|---|
| Access controls | Role-based access control. Access to Personal Data is limited to personnel with a business need and is reviewed periodically. Multi-factor authentication is used for privileged and remote access. |
| Encryption | Personal Data is encrypted in transit and at rest using appropriate industry-standard encryption, and encryption keys are managed securely. |
| Pseudonymisation | Where technically feasible and consistent with the processing purpose, Metadat-AI applies pseudonymisation techniques to Personal Data before it is accessed by development or support personnel. |
| Availability and resilience | Metadat-AI aims to build appropriate resilience into the Services and takes regular backups (retained as set out in clause 4.7B). No recovery time or recovery point objectives are committed. |
| Monitoring and logging | Access to systems processing Personal Data is logged, and logs are kept for 12 months (clause 4.7B(g)) and monitored for anomalous activity. Logs identify Authorised Users and individuals in a gallery by an internal ID, not by name. |
| Incident response | Metadat-AI maintains a documented incident response plan covering detection, containment, notification (including notifying the Controller without undue delay) and remediation. |
| Supplier assessment | Sub-processors are assessed for data protection compliance before engagement and are subject to written data processing agreements imposing equivalent obligations. |
| Personnel training | Personnel with access to Personal Data receive data protection training on joining and periodically after that. |
| Penetration testing | Metadat-AI aims to have the Services security tested periodically, using independent testers where appropriate, and to remediate significant findings within a reasonable period. |
| Physical security | Production infrastructure is hosted by AWS in data centres with ISO 27001 certification or equivalent physical security controls. Customer data processed or stored at Metadat-AI's London office is held on encrypted equipment in a locked area, accessible only to named personnel, with access logged. The development, demonstration and trial environment at Metadat-AI's London office is never used for production; where Personal Data is processed there for an authorised trial or demonstration, access is restricted to authorised personnel and the data is deleted as set out in clause 4.7B. |
ANNEX 3 - APPROVED SUB-PROCESSORS
The Sub-processors approved at the date of this DPA are those listed in the Sub-processor Register on that date, and changes follow clause 4.5. At November 2026 they are: Amazon Web Services EMEA SARL (hosting, storage, compute, monitoring and email, Ireland, eu-west-1); MongoDB, Inc. (MongoDB Atlas application database, hosted in AWS eu-west-1); Microsoft Ireland Operations Limited (Microsoft 365, used for support correspondence, EU); Anthropic, PBC (Claude, used to review code and system logs, maintain CRM records and handle business email, United States); Mediate Solutions Ltd (development, maintenance and support, United Kingdom); Butalia Media, engaged through Mediate Solutions Ltd (development, maintenance and support, with remote access to production systems from the United States and India); Google LLC (Google Gemini API, AI-assisted processing of support tickets, United States); and SpaceXAI LLC (xAI Grok API, used to maintain CRM records and handle business email, United States).
ANNEX 4 - INTERNATIONAL TRANSFER MECHANISMS
1. Transfers to Sub-processors. Restricted Transfers by Metadat-AI to Sub-processors (including remote access from the United States and India) are made under the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 ("EU SCCs"), Module 3 (processor to processor), with Metadat-AI as data exporter and the Sub-processor as data importer, together with the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner under section 119A of the Data Protection Act 2018 (the "UK Addendum") for transfers subject to the UK GDPR, or under any other mechanism permitted by Data Protection Laws (for example a Sub-processor's own transfer terms).
2. EEA Controllers. If the Controller is subject to the EU GDPR and the European Commission's adequacy decision for the United Kingdom ceases to apply, the EU SCCs, Module 2 (controller to processor), apply to transfers from the Controller to Metadat-AI and are incorporated by reference, with these elections: Clause 7 (docking) does not apply; Clause 9 Option 2 (general authorisation), with notice as in clause 4.5; the optional wording in Clause 11 does not apply; Clauses 17 and 18: the law and courts of Ireland.
3. Appendix information. For the EU SCCs and the UK Addendum: the parties and the description of the transfer are as set out in Annex 1 (transfers are continuous); the technical and organisational measures are those in Annex 2; and the Sub-processors are those in Annex 3. If this DPA conflicts with the EU SCCs or the UK Addendum, those clauses prevail to the extent of the conflict.