This annex is part of the terms of service and regulates the processing of personal data that Súbelo carries out on behalf of its clients, in accordance with article 28 of Regulation (EU) 2016/679.
It applies when you upload videos that contain personal data of third parties (people who appear or are heard in them) or when you manage accounts of your clients. You do not need to sign it separately: it is accepted with the terms.
For the data of your own account (your email, your billing) I am responsible, and that is governed by the privacy policy, not by this annex.
Roles
You, the client, are data controller. You decide what content you upload and what networks it is published on.
I, Rubén Hernández Alcaraz (NIF 23009135G), am the data processor. I process these data solely to provide you with the service and following your instructions.
Scope of processing
Purpose: temporary hosting and transmission of audiovisual content to the platforms designated by the controller.
Duration: for the duration of the subscription contract.
Data categories: image and voice of the people who appear in the videos; texts that the controller writes; technical metadata of the file.
Categories of data subjects: the controller, the people who appear in its content and, where applicable, the clients whose accounts they manage.
The person responsible must not upload special categories of data (health, ideology, sexual orientation, biometrics for identification purposes) without first having assessed their legality. Súbelo is not designed for that use.
My obligations
I process data only according to your documented instructions, which are the ones you give when using the application. If a rule requires me to do something different, I will notify you beforehand unless that same rule prohibits it.
I guarantee the confidentiality of whoever accesses the data. I work alone, so today I am the only person with access, and any future collaborators will be subject in writing to the same duty.
I apply the security measures of Article 32: encryption in transit (HTTPS) and at rest, additional AES-256-GCM encryption of social network access credentials, isolation by row-level policies in the database, signed download URLs with an expiry time, and daily backups of the database.
I assist you so that you can address the rights of data subjects, report breaches and carry out impact assessments if necessary.
I notify you of any security breach that affects your data without undue delay and, in any case, within 24 hours of detecting it, with the information at my disposal.
Upon termination of the contract, I delete the personal data processed on your behalf, except for what must be kept by legal obligation.
I make available to you the information necessary to demonstrate compliance and allow reasonable audits, giving 30 days' notice and a maximum of once a year, unless an authority requires otherwise.
Subprocessors
You generally authorize the use of these subprocessors:
| Subprocessor | Function | Location |
|---|---|---|
| Supabase | Database and authentication | European Union (Paris) |
| Cloudflare | Video Storage (R2) | European Union |
| Vercel | Application Hosting | European Union |
| Stripe Payments Europe | Payments and billing | Ireland |
If I incorporate or replace any, I will notify you 30 days in advance. If you are not satisfied, you can terminate the subscription without penalty and with a refund of the unconsumed portion.
All subprocessors are contractually subject to obligations equivalent to those in this annex, and I am responsible to you for their actions.
International transfers
Ordinary processing occurs within the European Economic Area. When any operation involves a transfer outside the EEA, it is covered by the Standard Contractual Clauses approved by the European Commission.
Apart from that, publishing on Instagram, TikTok, YouTube or LinkedIn means sending the content to those platforms, which act as independent controllers with their own policies. You order that transfer when choosing where to publish.