Data Processing Agreement

These data processing terms apply when incorporated into your order or separately concluded between your organization as controller (Customer) and centerbit UG (haftungsbeschränkt), Ganghoferstraße 67, 83059 Kolbermoor, Germany, as processor (Processor). To conclude the agreement with the service-specific annexes, contact support@jsoncut.com with your legal entity and account reference. Do not submit personal data requiring this agreement before it has been concluded.

1. Subject, duration and scope

The Processor processes customer-controlled personal data to host, edit, transform, render, store, retrieve and deliver the projects and media covered by the service agreement, and to perform optional AI or connected-client tasks only where instructed. Processing lasts for the service term and the agreed return/deletion process. These terms prevail over conflicting general terms for the subject of data protection.

Data may include names, contact details, identifiers, text, photographs, video, audio, voices and other personal information in customer projects and associated instructions. Data subjects may include the Customer's staff, clients, contractors, audiences and people depicted or mentioned in content. The Customer specifies the actual categories and processing purpose in its order/annex. Special-category or criminal-conviction data requires an expressly agreed appropriate processing arrangement.

2. Instructions and confidentiality

The Processor acts only on documented Customer instructions, including authorized product/API commands and transfer instructions, unless Union or Member State law requires otherwise. In that case, the Processor informs the Customer before processing unless the law prohibits that information. The Processor promptly flags an instruction it considers contrary to applicable data protection law and may suspend the affected instruction pending clarification.

Persons authorized to process data are bound by confidentiality or an appropriate statutory duty and receive only the access necessary for their work. Customer content is not used for the Processor's own advertising or general-purpose model training under this agreement.

3. Security

The Processor implements measures appropriate to the risks under Article 32 GDPR. The agreed technical and organizational measures cover access and authorization controls, secure authentication and transport, separation of customer workspaces, operational monitoring, patching, backup/recovery, incident handling and secure deletion. The service-specific annex describes their actual implementation and any contracted restrictions. Measures may evolve while maintaining an equivalent level of protection.

4. Subprocessors and international transfers

The Customer authorizes only the subprocessors and processing arrangements identified in the agreed annex. Where general written authorization is agreed, the Processor gives at least 30 days' advance notice of an intended addition or replacement, enabling the Customer to object on reasonable data-protection grounds. The parties seek a suitable alternative; if none is available, the affected processing must not continue contrary to the Customer's lawful instructions, and the Customer may terminate the affected service.

The Processor imposes materially equivalent data-protection obligations on subprocessors and remains responsible to the Customer for their performance. Transfers outside the EEA require a valid Chapter V GDPR mechanism and any necessary supplementary measures. The service-provider register explains product functions; it does not itself evidence execution of a provider agreement or replace a restricted contractual annex.

5. Assistance and incidents

Taking account of the nature of processing and information available, the Processor assists the Customer with data-subject rights, security obligations, personal-data breach notification, impact assessments and prior consultations under Articles 32–36 GDPR. Requests received directly are forwarded to the Customer where appropriate; the Processor does not decide the Customer's lawful basis for the underlying content.

The Processor notifies the Customer without undue delay after becoming aware of a personal-data breach affecting the contracted processing, provides available information needed for the Customer's assessment and notifications, and supplies further details as they become available. The notice describes the nature, affected categories and approximate extent where known, likely consequences, contact point and measures taken or proposed. The Processor cooperates in containment and remediation.

6. Information and audits

The Processor makes available the information necessary to demonstrate compliance with Article 28 and allows and contributes to audits, including inspections, by the Customer or its mandated auditor. Reasonable arrangements protect confidentiality, other customers and operational security without obstructing the statutory audit right. Certifications or third-party reports can support, but do not automatically replace, a justified audit.

7. Return and deletion

At the Customer's choice, the Processor returns or deletes personal data after the processing services end and deletes existing copies unless applicable law requires retention. Return uses agreed supported formats. Deletion from active systems occurs without undue delay; restricted recovery copies expire according to the agreed backup cycle, no later than 90 days after active deletion. Deleted data is not put back into ordinary use during a restore; deletion instructions are reapplied. Legally retained data remains purpose-restricted.

8. Customer responsibilities and own-controller processing

The Customer determines lawful purposes, provides necessary notices and legal bases, grants only appropriate access and instructs processing consistent with this agreement. Account administration, the Processor's own billing and legal obligations remain separate controller activities described in the Privacy Policy. Liability and remedies follow applicable law and the service agreement without restricting mandatory GDPR rights.

9. Contractual annexes

The concluded agreement identifies the Customer and authorized contacts, contracted features, subject/data categories, retention/return instructions, technical and organizational measures, subprocessors, actual processing locations and transfer safeguards. Optional AI or externally connected client processing is included only within the agreed instructions and provider arrangements.