Data Processing Agreement

This Data Processing Agreement (DPA) outlines how Aldo Ads SRL processes personal data on behalf of Reelit users (Controllers).

Last updated: November 25, 2025

Parties

Processor: Aldo Ads SRL, Strada Islaz nr. 29, Sector 1, Bucuresti, Romania · CUI 50594970 · Registration No. J2024024848008

Controller: The Reelit user or organization operating an account on the Service.

1. Purpose

The Processor handles personal data solely to operate Reelit, convert videos to reels, and deliver AI-generated enhancements requested by the Controller.

2. Categories of data

  • Uploaded videos
  • AI-generated transcripts and metadata
  • Account email address
  • Usage and audit logs

3. Duration

  • Uploaded videos are removed immediately after processing concludes
  • Generated reels stay available until the user deletes them
  • Account data is retained until the user closes their account
  • Relevant logs are preserved for a limited duration for security and compliance

4. Security measures

The Processor maintains appropriate technical and organizational measures, including:

  • Encrypted cloud storage and encrypted network transport (HTTPS/TLS)
  • Granular access control and least-privilege principles
  • Continuous monitoring, alerting, and logging of system activity
  • Regular reviews of platform security posture

5. Sub-processors

The Processor may rely on vetted sub-processors such as:

  • Trusted cloud infrastructure providers (for example, Microsoft Azure or equivalent vendors)
  • Trusted AI technology providers (for example, OpenAI or comparable AI platforms)

All sub-processors are bound by written agreements requiring GDPR-compliant safeguards.

6. Responsibilities

Processor obligations

  • Act solely on documented instructions from the Controller
  • Ensure confidentiality for all personnel handling personal data
  • Assist the Controller with GDPR data subject rights upon request
  • Delete or return personal data upon instruction or account closure

Controller obligations

  • Upload only lawful content and personal data
  • Confirm that all necessary consents and rights are in place

7. Termination

When a Controller deletes their account or instructs the Processor to cease processing, all associated personal data and stored reels are deleted in line with Section 3.