First Pass← firstpass.video

⚠️ Draft for review. A working Article 28 template — have a data-protection solicitor review it before relying on it. It forms part of your Terms for customers who process personal data through First Pass.

Data Processing Agreement

Last updated: [DATE]

This DPA applies where you use First Pass to process footage that contains personal data. It reflects UK/EU GDPR Article 28. In it, you are the Controller and Trick of the Light Ltd is the Processor.

1Roles & scope

You (the “Controller”) determine what footage to process and why. We (the “Processor”, Trick of the Light Ltd) process it only to provide First Pass to you. This DPA governs that processing and prevails over any conflicting term in the main Terms in respect of personal data.

2Details of processing

Subject matter	Transcription and rough-cut assembly of the Controller's footage
Duration	For the term of the subscription; processing is transient (per analysis)
Nature & purpose	Transcription, theme detection, captioning/translation, and sequence assembly, to provide the Service
Types of personal data	Whatever appears in the Controller's footage — typically voices, images, and anything spoken. May include special-category data if the Controller submits it.
Categories of data subjects	Individuals appearing or heard in the Controller's footage (e.g. interviewees), as determined by the Controller

3Our obligations as Processor

Process the footage only on your documented instructions (using the Service is your instruction), and not for our own purposes.
Ensure people who process it are bound by confidentiality.
Apply appropriate technical and organisational security (encryption in transit; access controls; and — importantly — we do not store your footage or transcripts, minimising risk by design).
Assist you, so far as reasonably possible, in responding to data-subject requests and in your security, breach-notification, and DPIA obligations.
Notify you without undue delay if we become aware of a personal-data breach affecting your data.
On the end of the service, delete or return any personal data — noting we don't retain footage in the first place; only usage metadata as described in the Privacy Policy.
Make available information needed to demonstrate compliance and allow for reasonable audits.

4Your obligations as Controller

You warrant you have a lawful basis and all necessary consents/permissions to process the footage (and any personal or special-category data in it) through First Pass.
Your instructions to us will comply with data-protection law. You are responsible for the lawfulness of the footage you submit.

5Sub-processors

You authorise us to use the sub-processors listed in our Privacy Policy (currently AssemblyAI and Anthropic for AI processing, plus our hosting and email providers). We impose data-protection terms on them no less protective than this DPA, and remain responsible for their performance. We'll give reasonable notice of any new sub-processor so you can object.

6International transfers

Where processing involves transfer outside the UK/EEA (e.g. to US-based sub-processors), we rely on Standard Contractual Clauses / the UK IDTA or the provider's Data Privacy Framework certification as appropriate.

7General

This DPA is governed by the laws of England & Wales. For DPA queries or to exercise audit rights, contact hello@totl.media.