Data Processing Addendum

Last updated: October 13, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between CalmLens Ltd (company number 17518409) ("CalmLens", "we", "us") and the customer that agreed to the Terms ("Customer", "you"). It applies automatically, with no separate signature, whenever CalmLens processes Customer Personal Data on your behalf. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data.

1. Definitions

Data Protection Law means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679), the Swiss Federal Act on Data Protection and any other data protection law that applies to the processing under the Terms.
Customer Personal Data means personal data in Customer Content (as defined in the Terms) that CalmLens processes on your behalf.
Subprocessor means a third party CalmLens engages to process Customer Personal Data.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
"controller", "processor", "data subject", "personal data" and "processing" have the meanings given in Data Protection Law.

2. Roles and scope

You are the controller of Customer Personal Data (or a processor acting for a third-party controller), and CalmLens is your processor (or subprocessor). Annex 1 describes the processing.

This DPA does not cover information CalmLens processes as a controller for its own purposes, such as account, billing, support and security records. Our Privacy Policy covers that.

You are responsible for having a lawful basis, and any notices and consents, for the Customer Personal Data you submit and the instructions you give.

3. Instructions

CalmLens processes Customer Personal Data only on your documented instructions, unless the law requires otherwise; in that case we will tell you before processing unless the law forbids it. Your instructions are the Terms, this DPA, and your use and configuration of the Services, including your moderation policies, retention settings (keepContentAfterProcessing), flagged-content actions, delivery settings and webhook destinations.

We will tell you if we believe an instruction breaks Data Protection Law. We will not sell Customer Personal Data, use it for advertising, or use it to train models. This includes personal data in demo submissions, support attachments, transcripts and embeddings. Before sending Customer Personal Data to an AI Subprocessor, we will ensure that its applicable contract and account settings prohibit use of that data for general model training.

4. Confidentiality

Everyone CalmLens authorises to process Customer Personal Data is bound by a duty of confidentiality. Staff access accounts and Customer Content only where needed for support you request, security, safety or legal reasons, through accounts with the relevant system permissions.

5. Security

CalmLens implements the technical and organisational measures in Annex 2, taking into account the state of the art, costs, and the nature, scope, context and purposes of processing and the risks to people. We may update these measures, but not in a way that materially reduces the overall level of protection.

6. Subprocessors

You give CalmLens general authorisation to engage Subprocessors. The current list is in Annex 3 and on our Trust page.

We bind each Subprocessor by a written contract with data protection obligations that are no less protective than this DPA, and we remain responsible to you for its performance.
We will tell you at least 30 days before a new Subprocessor starts processing Customer Personal Data, by email to your account's email address and by updating Annex 3.
You may object on reasonable data protection grounds within 14 days of that notice. We will discuss your concerns in good faith. If we cannot resolve them, you may stop using the affected Services and terminate the Terms without penalty for the period after the change, and receive a refund of prepaid fees for the unused period of the affected Services, as your sole contractual remedy for the unresolved objection. This does not limit rights that Data Protection Law does not allow us to exclude.

7. Personal Data Breaches

CalmLens will notify you without undue delay after becoming aware of a Personal Data Breach. We will provide the information we reasonably can to help you meet your own obligations, including the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. We may provide information in stages as it becomes available. Notifying you is not an admission of fault.

8. Assistance

Taking into account the nature of the processing and the information available to us, CalmLens will reasonably assist you with:

Data subject requests. The Services let you find, export, remove and delete content and assets yourself. If we receive a request about Customer Personal Data directly, we will forward it to you and will not respond except to direct the person to you, unless the law requires otherwise.
Data protection impact assessments and prior consultations with a supervisory authority.
Security and breach obligations under Data Protection Law.

We may charge reasonable costs for assistance beyond what the Services' self-service features provide, unless the assistance is needed because of our breach.

9. International transfers

CalmLens is based in the United Kingdom, which the European Commission and the Swiss Federal Council recognise as providing adequate protection, so transfers of Customer Personal Data from the EEA and Switzerland to CalmLens rely on those adequacy decisions. Retained content is stored in the regional storage location described on our Trust page. Subprocessors may process Customer Personal Data in other countries, including the United States.

Where a transfer by CalmLens to a Subprocessor is a restricted transfer under Data Protection Law, we rely on a valid transfer mechanism, such as an adequacy regulation or decision (including the UK Extension to the EU-US Data Privacy Framework where the Subprocessor is certified), the EU Standard Contractual Clauses, or the UK International Data Transfer Addendum.

If, for any reason, a transfer from you to CalmLens needs a transfer mechanism, the EU Standard Contractual Clauses (Module 2, or Module 3 where you are a processor) are incorporated into this DPA, together with the UK International Data Transfer Addendum for UK transfers, completed with the information in the Annexes. In those clauses, clause 7 (docking) applies, clause 9 option 2 applies with the notice period in clause 6 of this DPA, clause 11's optional wording does not apply, and clauses 17 and 18 refer to the law and courts of Ireland.

For transfers subject to the Swiss Federal Act on Data Protection (FADP), the EU Standard Contractual Clauses apply with these changes: references to the EU GDPR are read as references to the FADP as far as the transfers are subject to it; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority under clause 13 for those transfers; and "Member State" in clause 18(c) does not exclude data subjects in Switzerland from bringing claims in their place of habitual residence.

10. Audits

CalmLens will make available the information reasonably necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires once a year. If that information is not enough to demonstrate compliance, or a supervisory authority requires it, you may audit our processing of Customer Personal Data once a year, on at least 30 days' written notice, during business hours, at your cost, through an independent auditor bound by confidentiality, and in a way that does not compromise other customers' data or our security.

CalmLens does not currently hold SOC 2 or ISO 27001 certification.

11. Deletion and return

You can export and delete Customer Content through the Services at any time. Export any content you need before requesting deletion or ending the Terms; we do not promise an additional export window after deletion. When the Terms end, or when you delete your account, CalmLens deletes Customer Personal Data, except:

copies in caches and queues, which expire through normal operation;
content under a safety hold and its incident records, which we keep for as long as our incident process or the law requires; and
data we must keep by law.

Content you configure not to be retained is deleted after processing unless a hide action or safety hold applies.

12. Liability and general terms

Each party's liability arising out of or relating to this DPA, including the Standard Contractual Clauses incorporated into it, is subject to the exclusions and limitations of liability in section 13 of the Terms. That is one aggregate limit for the Terms and this DPA together, not a separate limit for each. This does not limit liability that Data Protection Law does not allow to be limited, or either party's liability to data subjects under the Standard Contractual Clauses. This DPA ends when CalmLens no longer processes Customer Personal Data for you. It is governed by the law that governs the Terms.

Questions about this DPA: contact@calmlens.com.

Annex 1: Description of processing

Parties: the Customer (data exporter; controller or processor) and CalmLens Ltd, 79 Duke of York Avenue, Wakefield WF2 7DA, United Kingdom, contact@calmlens.com (data importer; processor or subprocessor).
Data subjects: people whose personal data appears in content the Customer submits, typically the Customer's end users and anyone depicted or named in that content; and the Customer's team members whose details appear in project records.
Categories of personal data: whatever personal data the Customer chooses to submit in images, audio, video, text, documents and websites, including names, images of people, contact details and identifiers within that content; file names and metadata; extracted text, speech transcripts, previews, transformed variants and semantic search embeddings; and moderation results.
Special category data: Customer Content may, by its nature, contain special category data (for example, data revealing health, sex life, religious beliefs or ethnic origin). It is protected by the measures in Annex 2 and processed only to provide the Services.
Frequency: continuous, for as long as the Customer uses the Services.
Nature and purpose: receiving, storing, classifying (moderation, and OCR when enabled), transcribing audio and video speech, creating and searching semantic embeddings, transforming and delivering content, applying the Customer's moderation policies and actions, and sending events and webhooks, all to provide the Services.
Duration and retention: for the term of the Terms. Retention is controlled by the Customer's settings and actions, as described in clause 11.
Supervisory authority: the UK Information Commissioner's Office, or for EU Standard Contractual Clauses the authority determined under their clause 13 (the Swiss Federal Data Protection and Information Commissioner for transfers subject to the FADP).

Annex 2: Technical and organisational measures

Access control: assets are private by default. Private content needs an authorised session with the right project permission, a project API key with the download permission, or a time-limited signed URL. Project access uses per-project roles and folder-scoped permissions.
Credentials: API keys are stored hashed, are scoped to one project, can only be created or changed by a signed-in user, and are checked for revocation on every request. Webhook signing secrets are stored encrypted.
Signed URLs: expire after at most 24 hours (15 minutes by default) and are bound to the project, asset, resource, transformation and expiry time.
Encryption: data is encrypted in transit with TLS. Stored content and databases are encrypted at rest by our storage and database providers.
Logging: application request logs remove credentials, cookies and authentication headers.
Staff access: limited to accounts with the relevant system permissions, used only for support, security, safety and legal reasons.
Data minimisation and retention: API uploads default to deleting content after successful processing; portal uploads default to keeping it unless the Customer switches retention off; the Customer controls retention, hiding and purging; account deletion removes the Customer's projects and assets as described in clause 11.
Safety holds: content reported as suspected illegal material can be held so it cannot be delivered or deleted while the report is handled.
Infrastructure: the Services run on Cloudflare's network with its DDoS and security protections. Our providers' own measures are described in their data processing terms.

Annex 3: Subprocessors

Last changed: October 11, 2026.

Cloudflare for edge hosting, security, storage, database connections, queues and background processing, image processing, website rendering (Browser Rendering), document conversion and audio/video decoding (Containers), transactional email sending and CDN delivery, for semantic asset search indexing through Vectorize, and for image moderation through Cloudflare Workers AI.
Cockroach Labs (CockroachDB Cloud, hosted on Amazon Web Services) for database hosting of account, project, asset, usage and billing records, in Singapore, London, Frankfurt and Ohio (US).
Google, including Firebase and Google Cloud for identity services, configuration storage and OCR (Google Cloud Vision).
Typesafe for text moderation.
Voyage AI for image, sampled video frame, speech transcript and query embeddings used in semantic asset search.
OpenAI for text and image moderation and audio/video speech transcription.
Amazon Web Services as infrastructure for our database provider.
Stripe for subscriptions, invoicing and payment processing.