Blind Editor — Data Processing Addendum (DPA)
Effective date: 31 July 2026
Version: 1.0
This Data Processing Addendum ("DPA") forms part of the Terms & Conditions (the "Agreement") between Argon ehf. ("Processor", "we", "us") and the business customer agreeing to the Terms ("Controller", "you"). It applies where you use Blind Editor (the "Service") to process personal data on behalf of your own users or customers ("Customer Personal Data"). If there is a conflict between this DPA and the rest of the Agreement on data-protection matters, this DPA prevails.
Terms such as "personal data", "processing", "controller", "processor", "sub-processor", "data subject", and "supervisory authority" have the meanings given in the EU General Data Protection Regulation (GDPR) as implemented in Iceland by Act No. 77/2018 ("Data Protection Law").
1. Roles
1.1 For Customer Personal Data, you are the controller (or a processor acting for another controller) and we are the processor (or sub-processor). For personal data we process for our own purposes (such as our billing and account records), we act as controller under our Privacy Policy.
1.2 You are responsible for ensuring you have a lawful basis and all necessary consents and notices for the Customer Personal Data you put through the Service — including, where applicable, an Article 9 condition (such as explicit consent) for any special-category data your footage contains or any processing that uniquely identifies the people in it.
2. Our obligations as processor
We will:
2.1 process Customer Personal Data only on your documented instructions (including as set out in this DPA — the processing is described in Annex 1 — and as needed to provide the Service), unless required to do otherwise by law, in which case we will inform you first unless the law prohibits it;
2.2 ensure that people authorised to process Customer Personal Data are bound by confidentiality;
2.3 implement appropriate technical and organisational security measures (Annex 3);
2.4 respect the conditions for engaging sub-processors (section 4);
2.5 assist you, taking into account the nature of the processing: (a) with responding to data-subject requests (section 5); and (b) with your obligations on security, breach notification, data-protection impact assessments, and prior consultation (Articles 32–36 GDPR);
2.6 at your choice, delete or return all Customer Personal Data at the end of the provision of the Service, and delete existing copies unless the law requires retention (section 6); and
2.7 make available information necessary to demonstrate compliance and allow for and contribute to audits (section 7).
3. International transfers
3.1 We process Customer Personal Data primarily within the EU/EEA. To provide the AI editing function, text and images derived from the customer's video are transferred to our AI sub-processor in the United States (identified in Annex 2).
3.2 Where Customer Personal Data is transferred outside the EEA, the transfer is made under a safeguard permitted by Chapter V GDPR: primarily the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework (DPF) where the recipient is certified under it, and otherwise (or as a fallback should the DPF cease to apply) the Commission's Standard Contractual Clauses (SCCs) with appropriate supplementary measures. The applicable SCCs are incorporated into this DPA by reference and, where required, attached as Annex 4.
4. Sub-processors
4.1 You give general authorisation for us to engage sub-processors to provide the Service. Our current sub-processors are listed in Annex 2.
4.2 We will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for a sub-processor's performance.
4.3 We will give you reasonable prior notice of any intended addition or replacement of a sub-processor. If you have a reasonable, data-protection-based objection, you may raise it within the notice period; we will work with you in good faith, and if we cannot resolve it, you may terminate the affected part of the Service and we will refund the prepaid, unused credits attributable to it.
5. Data-subject requests
5.1 Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection).
5.2 If we receive a request directly from your data subject, we will not respond to it ourselves (except to confirm it should be directed to you) and will forward it to you promptly.
6. Deletion and return
6.1 On termination or expiry of the Service, or on your written request, we will delete or return Customer Personal Data as you choose, and delete existing copies, except to the extent the law requires us to keep it. The account-deletion function in the Service performs this deletion for the data it covers.
7. Audits
7.1 We will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice, confidentiality, and frequency limits, and in a way that does not compromise the security or data of other customers. We may satisfy audit requests by providing third-party certifications or reports where available.
8. Personal-data breach
8.1 We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, and provide the information you reasonably need to meet your own notification obligations to supervisory authorities and data subjects.
9. Liability
9.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement (Terms section 18, including the business-customer liability cap in Terms section 18.4), except where Data Protection Law does not allow those limits to apply — in particular, nothing in this DPA or the Agreement limits a data subject's rights or either party's liability to data subjects under Article 82 GDPR.
10. Duration
10.1 This DPA applies for as long as we process Customer Personal Data on your behalf, and the obligations that by their nature should survive (including confidentiality, deletion, and audit) continue afterwards.
Annex 1 — Details of processing (Article 28(3) GDPR)
- Subject-matter of the processing: AI-assisted editing of video and other media that the Controller uploads to the Service, including the storage of that media and of the derived and output files.
- Duration: for as long as the Controller uses the Service and holds the relevant content in its account, and until deletion under section 6.
- Nature and purpose: hosting, storage, transcoding, speech-to-text transcription, extraction of still frames, automated AI analysis of transcripts and frames to plan and perform the requested edit, production and storage of edited output, and the related conversation and job records.
- Types of personal data: uploaded video/audio/image content and anything it contains; text transcripts of speech; still frames (which may show identifiable people); edit instructions and conversation records; job metadata. The content may include any category of personal data the Controller's footage happens to contain — including, if the Controller uploads it, special categories under Article 9 — which is why section 1.2 requires the Controller to hold a lawful basis for what it uploads.
- Categories of data subjects: the Controller's users, customers, employees, and contractors; and any other people who appear or can be heard in the uploaded footage.
Annex 2 — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic (Claude API) | AI processing of text and images derived from the customer's video to perform edits | United States |
| Amazon Web Services (AWS) | Hosting, storage, and compute | EU/EEA |
| Straumur greiðslumiðlun hf. | Payment processing | Iceland / EEA (card-network transactions may involve transfers outside the EEA under appropriate safeguards) |
| Mixpanel, Inc. | Product analytics — account-level usage events for which Argon is the controller (see the Privacy Policy). Receives no Customer Personal Data from uploaded content: no videos, transcripts, frames, or prompt text. Listed here for completeness. | EU/EEA (EU data residency; US-headquartered provider) |
Annex 3 — Technical and organisational measures (summary)
- Encryption in transit and at rest.
- Strong password hashing for account credentials.
- Measures to isolate and limit access to the environment where content is processed.
- Access controls and the principle of least privilege for operational access.
- Per-job resource and budget limits.
- Security logging and audit records with a defined retention period.
- Isolation of each customer's working data.
Annex 4 — Standard Contractual Clauses
The Standard Contractual Clauses referred to in section 3.2 are those set out in Commission Implementing Decision (EU) 2021/914, in the modules applicable to the transfer. They are incorporated into this DPA by reference and are not reproduced here: transfers currently rely on the EU–U.S. Data Privacy Framework adequacy decision as the primary safeguard, and the Clauses operate as the fallback described in section 3.2, including if the DPF ceases to apply to a recipient.
Where the Clauses apply, the information their own annexes require is supplied by this DPA: Annex 1 (details of the processing), Annex 2 (sub-processors), and Annex 3 (technical and organisational measures). We will provide a copy of the applicable modules on request.