Data Processing
Agreement.

1. Roles

For personal data in data a customer submits ("Customer Data"), the customer is the controller (or a processor acting for its own controller) and PLLAY is its processor and, under US state privacy laws, its service provider. For account data, PLLAY is an independent controller.

PLLAY will not sell or share Customer Data; will not retain, use or disclose it outside the direct business relationship or for any purpose other than those in this DPA; and will not combine it with other personal data except as the law permits.

2. What we process and why

• Data. Clips and frames, event data and outcomes, evidence frames and records, receipts, and API logs (including the caller IP address).
• People. The customer’s end users who appear in or are named in that data.
• Purpose. Verifying outcomes, issuing receipts, handling holds, reviews and disputes, and securing the Service.
• Instructions. We process Customer Data only on the customer’s documented instructions, including this DPA and the customer’s API calls, and will tell the customer if we believe an instruction breaks the law.
• Confidentiality. Everyone at PLLAY who can access Customer Data is bound by confidentiality obligations.

3. Sub-processors

The customer authorises the sub-processors listed at pllay.io/legal/subprocessors. PLLAY has a written agreement with each that imposes data-protection obligations no less protective than this DPA, and remains responsible for their performance.

We will give at least 30 days’ notice of a new sub-processor by updating that page and emailing customers who ask to be notified. A customer may object on reasonable data-protection grounds within that period; if we cannot address the objection, the customer may end the affected service and receive a refund of prepaid fees for it.

4. International transfers

Data is processed in the United States. Transfers from the EEA, UK and Switzerland are governed by the Standard Contractual Clauses (Module 2 or 3 as applicable), the UK International Data Transfer Addendum and the Swiss amendments, which are incorporated by reference.

5. Security

6. Retention

Raw clips and video are deleted within 90 days of the job unless the customer asks otherwise. Evidence frames and records are kept while the customer’s agreement is active and up to 6 years after for dispute and audit purposes. API request logs are kept up to 12 months.

7. Deletion and return

When the agreement ends, we delete or return Customer Data within 90 days, at the customer’s choice, unless the law requires us to keep it, in which case it stays protected under this DPA.

8. Breach notice

PLLAY will notify the customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data, and will provide the information reasonably available to help the customer meet its own obligations. Notification is not an acknowledgement of fault or liability.

9. Assistance and audits

We will help customers answer data subject requests and complete impact assessments, and make available the information needed to show compliance. Once a year, on 30 days’ notice, a customer may audit our compliance by questionnaire or, where the law requires, by an independent auditor under confidentiality, at the customer’s cost.

10. Order of precedence

If this DPA conflicts with the Terms of Service or the API Terms, this DPA controls for Customer Data. If it conflicts with the Standard Contractual Clauses, the Clauses control.