Palaba Self-Serve Business Data Processing Addendum

Last updated: August 25, 2026

This Self-Serve Business Data Processing Addendum (“DPA”) forms part of the Palaba Business SaaS Terms or other agreement that incorporates it (the “Agreement”) between Parsonos Corporation (“Parsonos”) and the business or professional customer identified in the account and acceptance record (“Customer”).

This DPA applies when Parsonos processes Customer Personal Data on Customer’s behalf. It does not replace a signed publisher or enterprise DPA. A signed DPA or master services agreement supersedes this DPA for the services it covers.

1. Definitions

“Applicable Privacy Law” means a privacy, data-protection, or data-security law that applies to a party’s Processing of Customer Personal Data under the Agreement, including where applicable the EU GDPR, UK GDPR, Swiss FADP, California Consumer Privacy Act, Delaware Personal Data Privacy Act, and other applicable United States state comprehensive privacy laws.

“Customer Personal Data” means Personal Data contained in Customer Content, Customer Deliverables, or customer-specific project metadata that Parsonos Processes on Customer’s behalf under the Agreement. It does not include information for which Parsonos independently determines the purposes and means, such as Parsonos’s account, billing, security, legal-compliance, and internal service-health records.

“Data Subject,” “Personal Data,” “Processing,” “Processor,” “Controller,” “Sale,” and “Share” have the meanings given by the Applicable Privacy Law. “Personal Data” includes “personal information” where that term applies.

“Security Incident” means a breach of security that results in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data Processed by Parsonos. It does not include an unsuccessful attempt that does not compromise Customer Personal Data, such as a blocked scan, failed login, or unsuccessful attack. For notice timing, Parsonos becomes aware of a Security Incident when it has a reasonable degree of certainty that an incident meeting this definition has occurred; a completed investigation, final scope, or root-cause determination is not required.

“Subprocessor” means a third party appointed by Parsonos to Process Customer Personal Data on Customer’s behalf.

“EU GDPR” means Regulation (EU) 2016/679. “UK GDPR” has the meaning given in the United Kingdom Data Protection Act 2018. “Swiss FADP” means the Swiss Federal Act on Data Protection.

2. Roles and scope

2.1 Roles

Customer is the Controller of Customer Personal Data, or a Processor acting for another Controller. Parsonos is Customer’s Processor or Subprocessor, as applicable. Each party will comply with Applicable Privacy Law in its role.

Parsonos acts as an independent Controller for personal information where it determines the purposes and means, including account administration, authentication security, billing, service-health telemetry, legal compliance, and its direct business communications. Those activities are described in the Privacy Notice.

2.2 Processing details

The subject matter, nature, purpose, duration, Data Subjects, and categories of Customer Personal Data are described in Annex I. Customer may give additional lawful instructions through its use and configuration of Palaba, project instructions, support requests, and written agreement with Parsonos.

2.3 Customer duties

Customer will ensure that its instructions comply with Applicable Privacy Law and that it has provided required notices and obtained all rights, permissions, consents, and lawful bases for the Processing. Customer will not instruct Parsonos to Process Customer Personal Data in a way that violates Applicable Privacy Law.

3. Documented instructions

Parsonos will Process Customer Personal Data only:

1. to provide, secure, support, and troubleshoot the Service under the Agreement;
2. on Customer’s documented instructions;
3. as needed to prevent or address a Security Incident or serious unlawful use; or
4. as required by applicable law.

If law requires Processing beyond Customer’s instructions, Parsonos will notify Customer before the Processing unless law prohibits notice on important grounds of public interest.

Parsonos will promptly inform Customer if, in Parsonos’s opinion, an instruction violates Applicable Privacy Law. Parsonos may pause the affected Processing while the parties determine a lawful instruction; it will not use this section to make Customer’s legal decisions for it.

Parsonos will not use Customer Personal Data to train, fine-tune, evaluate, or improve a generalized or shared model or algorithm, or for generalized testing, unless Customer gives prior express written permission for a defined purpose. Parsonos will not sell or share Customer Personal Data, use it for cross-context behavioral advertising, or authorize a provider to use it for the provider’s independent model training or unrelated improvement.

4. Confidentiality and personnel

Parsonos will limit access to Customer Personal Data to personnel who need it to provide, secure, support, troubleshoot, or legally administer the Service. Authorized personnel must be bound by contractual or statutory confidentiality obligations, receive appropriate security and privacy instructions, and access the information only for the permitted purpose.

Customer Content and Customer Deliverables are Customer Confidential Information under the Agreement regardless of whether they are marked confidential. Parsonos will protect them using at least the same care it uses for its own information of similar sensitivity and no less than reasonable care.

5. Security

5.1 Safeguards

Parsonos will implement and maintain appropriate administrative, technical, and physical safeguards designed to protect Customer Personal Data, taking into account the state of the art, implementation costs, scope and context of Processing, and the likelihood and severity of risk. The minimum measures for this DPA are in Annex II.

Parsonos will not materially reduce the overall security of the Service during the applicable service period. It may update individual controls where the replacement provides materially equivalent or stronger protection.

5.2 Security Incident notice

Parsonos will notify Customer without undue delay and in any event within 72 hours after becoming aware of a Security Incident. The 72-hour outer limit does not extend a shorter period required by Applicable Privacy Law or prevent an earlier preliminary notice based on information then available. Notice will be sent to Customer’s account administrator or designated security contact.

To the extent known, the initial or supplemental notices will describe:

• the nature and approximate time of the Security Incident;
• the categories of Customer Personal Data and Data Subjects affected;
• likely consequences;
• containment, investigation, remediation, and protective measures taken or planned;
• information reasonably needed for Customer’s legal assessment and notification duties; and
• a Parsonos incident contact.

Parsonos may provide information in phases as the investigation develops and will give material updates through containment and remediation. It will preserve relevant evidence, reasonably cooperate with Customer, and take prompt steps to contain, investigate, and remediate the Security Incident.

Parsonos will not identify Customer in a public statement or notify Customer’s affected Data Subjects or regulators on Customer’s behalf without Customer’s prior approval, unless law independently requires Parsonos to do so. Where legally permitted, Parsonos will consult Customer first.

Each party bears its own ordinary compliance costs. Parsonos is responsible for reasonable investigation, containment, remediation, and required cooperation costs to the extent the Security Incident was caused by Parsonos’s breach of this DPA, subject to the Agreement’s applicable liability terms and non-waivable law.

6. Data Subject requests

Taking into account the nature of the Processing, Parsonos will provide reasonable technical and organizational assistance for Customer to respond to requests to access, correct, delete, restrict, object to, or port Customer Personal Data and to requests concerning consent, sale, sharing, targeted advertising, or qualifying profiling where applicable.

If Parsonos receives a request directly concerning Customer Personal Data, it will not disclose, alter, or delete Customer’s project solely in response. It will authenticate only as necessary to route the request, promptly notify Customer, and act on Customer’s documented instruction unless law requires Parsonos to respond directly. Parsonos will not confirm confidential project details to the requester without authorization.

7. Compliance assistance

Taking into account the nature of Processing and information available to Parsonos, Parsonos will reasonably assist Customer with:

• security-of-processing obligations;
• breach assessment and legally required notices;
• data-protection, privacy, or high-risk-processing assessments;
• prior consultation with a supervisory authority; and
• information needed to demonstrate Customer’s compliance for the Processing.

Parsonos may charge reasonable fees for unusual, extensive, or custom assistance not caused by Parsonos’s breach, after giving Customer an estimate. Ordinary request routing, security information, and incident cooperation are included in the Service.

8. Return and deletion

During the term, Customer may delete projects using available controls or send an authenticated deletion instruction. Following termination, the retrieval period in the Agreement applies. At Customer’s choice, Parsonos will return or securely make available all Customer Personal Data then in its possession or control before deletion, in the then-existing format or another reasonably usable format. Parsonos need not recreate information already validly deleted or restore an isolated backup solely for return. If Customer does not request return before the retrieval period ends, Customer instructs Parsonos to delete the data as stated below.

After the retrieval period or a valid earlier deletion instruction, Parsonos will delete Customer Personal Data from active systems without undue delay and allow it to expire from isolated backups through the documented backup lifecycle, unless law requires retention. Parsonos will not restore a backup solely to respond to an ordinary return request.

If disaster recovery restores a copy containing Customer Personal Data previously subject to a valid deletion instruction, Parsonos will use its deletion record to reapply that instruction before the affected data is returned to ordinary production use where reasonably feasible. Until overwritten, backup data remains protected, isolated from ordinary use, and Processed only for security and disaster recovery.

On Customer’s reasonable request, Parsonos will certify completion of active-system deletion and describe the protected backup-expiration status. A certification will not state that an isolated backup copy has already been overwritten if it has not.

Parsonos may retain records independently required for billing, security, legal compliance, claims, or proof of instructions, but will access-restrict them and not use them for marketing, generalized training, or unrelated improvement.

9. Subprocessors

9.1 General authorization

Customer generally authorizes the Subprocessors identified on the Subprocessor List as of the date Customer accepts this DPA. Parsonos will use a written agreement requiring each Subprocessor to protect Customer Personal Data to the standard required for the Subprocessor’s assigned Processing. Parsonos remains responsible to Customer for each Subprocessor’s performance of its data-protection obligations to the same extent as if Parsonos performed them itself.

If Customer is a Processor for another Controller, Customer represents that the Controller has authorized Customer to appoint Parsonos and the listed Subprocessors. Customer will provide the Controller’s notice contact or promptly forward Parsonos’s Subprocessor notices and any responsive objection. Parsonos will provide information reasonably needed for that authorization and will honor the Controller’s rights required by Module 3 of the EU SCCs.

9.2 Changes and objections

Parsonos will give at least 30 days’ advance notice to Customer’s account email or designated privacy contact before authorizing a new Subprocessor to Process Customer Personal Data. A shorter period applies only if Customer gives documented authorization for the expedited appointment or applicable law requires the appointment on shorter notice. For an urgent security or continuity need, Parsonos may request expedited authorization, but absent that authorization or legal requirement the new Subprocessor will not begin Processing before the notice period ends. Mandatory prior-authorization and notice terms in the EU SCCs or UK Addendum control.

Customer may object during the notice period on reasonable and documented data-protection grounds. The parties will work in good faith on a reasonable alternative, configuration, or other mitigation. If no reasonable solution is available, Customer may stop the affected Processing and terminate the affected Service by notice before the new Subprocessor begins Processing. Parsonos will refund unused prepaid fees allocable to the terminated portion. This is Customer’s exclusive remedy for an objection to a compliant Subprocessor appointment, but not for a separate breach.

10. Audits and compliance information

Parsonos will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may submit one reasonable written security or privacy questionnaire in any 12-month period.

If that information is reasonably insufficient to address a specific documented compliance concern, a Security Incident materially affects Customer Personal Data, or a regulator requires more, Customer may conduct a further audit through an independent qualified auditor bound by confidentiality. The parties will agree reasonable scope, timing, duration, evidence-handling, and safeguards to avoid disrupting the Service or exposing another customer’s information or Parsonos trade secrets. Remote documentary review will be used where reasonably sufficient.

Except where a regulator or non-waivable law requires otherwise, an audit will not include access to source code, another customer’s information, or production systems, and Customer and its auditor will not perform intrusive technical testing without Parsonos’s prior written agreement. Customer bears its audit costs. Audit rights under the Standard Contractual Clauses and a regulator’s powers are not reduced by this section.

11. United States state privacy terms

To the extent an Applicable Privacy Law treats Parsonos as a service provider, contractor, or processor, the parties agree:

1. Customer discloses Customer Personal Data to Parsonos only for the limited and specified purposes in the Agreement, this DPA, and Customer’s lawful documented instructions.
2. Parsonos will comply with applicable obligations imposed on a service provider, contractor, or processor and provide the level of privacy protection required by the applicable law.
3. Parsonos will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship; or retain, use, or disclose it for a commercial purpose other than the specified purposes, except as permitted by applicable law.
4. Parsonos will not combine Customer Personal Data received from Customer with personal information received from another person or collected from Parsonos’s own interaction with a consumer, except where the applicable law permits a service provider or processor to do so for the specified business purpose.
5. Customer may take reasonable and appropriate steps under Section 10 to help ensure Parsonos uses Customer Personal Data consistently with Customer’s obligations.
6. Parsonos will notify Customer if it determines it can no longer meet an applicable obligation and will take reasonable and appropriate steps with Customer to stop and remediate unauthorized use.
7. Parsonos will assist with authenticated consumer requests, security and breach duties, and required assessments as described in this DPA.
8. Each Subprocessor will be engaged under a written contract that imposes the legally required equivalent restrictions and obligations.
9. Parsonos will delete or return Customer Personal Data as described in Section 8 at Customer’s choice, subject to legal retention and backup limitations.

The parties intend this section to satisfy applicable processor-contract requirements, including California Civil Code section 1798.100(d) and applicable regulations and 6 Delaware Code section 12D-107. A statutory term or restriction controls to the extent it applies and requires more.

12. International transfers

12.1 EEA transfers

If Customer transfers Customer Personal Data subject to the EU GDPR to Parsonos in a country not recognized as providing an adequate level of protection, no other lawful transfer mechanism applies, and Parsonos’s relevant Processing as data importer does not itself fall within the territorial scope of the EU GDPR, the parties enter into the European Commission Standard Contractual Clauses in Decision (EU) 2021/914 (“EU SCCs”), incorporated without modification as follows:

• Module 2 applies where Customer is a Controller and Parsonos is a Processor.
• Module 3 applies where Customer is a Processor and Parsonos is a Subprocessor.
• Clause 7, the docking clause, applies.
• Under Clause 9(a), Option 2, general written authorization applies with the 30-day notice period in Section 9.
• The optional language in Clause 11 does not apply.
• Under Clause 17, Option 1, Irish law applies.
• Under Clause 18(b), the courts of Ireland are selected.
• Annexes I, II, and III of this DPA complete the corresponding appendices to the EU SCCs.

For Clause 13, the competent supervisory authority is the authority identified in Annex I.C in accordance with the EU SCCs. If this DPA conflicts with the EU SCCs, the EU SCCs control for the restricted transfer.

If Parsonos’s relevant Processing as data importer is subject to the EU GDPR and Decision (EU) 2021/914 therefore does not cover the transfer, the parties will use another legally available Article 46 transfer mechanism tailored to that scenario, including any applicable standard clauses or authorized ad hoc clauses. The affected transfer will not begin or continue without that mechanism unless no Chapter V transfer occurs or another lawful transfer ground applies.

12.2 United Kingdom transfers

For a restricted transfer governed by the UK GDPR, the parties incorporate the then-current mandatory clauses of the UK International Data Transfer Addendum to the EU SCCs, version B1.0 in force March 21, 2022, as lawfully revised (“UK Addendum”). The parties and key contacts in Table 1 are those in Annex I; Table 2 selects the EU SCC modules and options in Section 12.1; Table 3 consists of Annexes I through III; and in Table 4 neither party may end the UK Addendum solely because the approved Addendum changes. The UK Addendum controls over conflicting commercial terms for the restricted transfer.

12.3 Swiss transfers

For a restricted transfer governed by the Swiss FADP, the EU SCCs apply with references to the EU GDPR understood to include the Swiss FADP where appropriate, “Member State” understood to include Switzerland where needed to preserve Data Subject rights, and the Federal Data Protection and Information Commissioner acting as competent authority. Swiss Data Subjects may enforce their applicable rights in Switzerland. These adaptations do not reduce the protections of the EU SCCs.

12.4 Assessments and supplementary measures

Each party will provide information reasonably needed for a transfer-impact or data-protection assessment. Parsonos will implement the technical and organizational measures in Annex II and notify Customer if it reasonably believes it cannot comply with the applicable transfer mechanism. The parties will cooperate on lawful supplementary measures. Parsonos does not rely on or represent certification under a data-transfer framework unless expressly added after verification.

13. Conflict, liability, and duration

This DPA controls over the Agreement for its data-protection subject. The EU SCCs or UK Addendum control where they require a different result. Commercial liability terms in the Agreement apply to this DPA only to the extent permitted by Applicable Privacy Law and the applicable transfer clauses.

This DPA begins when Customer accepts the Agreement and continues while Parsonos Processes Customer Personal Data. Sections that by their nature must continue—including confidentiality, deletion, audit of retained Processing, international-transfer rights, and accrued remedies—survive termination.

Annex I — Processing details

A. Parties

Data exporter / Customer: The business or professional customer identified by the Palaba account, billing record, and acceptance record, including its address and the privacy contact’s name, position, and contact details supplied through the account. Customer is a Controller or Processor as stated in Section 2. Its activities relevant to the transfer are its use and direction of the Processing described in Annex I.B.

Data importer / Parsonos: Parsonos Corporation, 131 Continental Drive, Suite 305, Newark, Delaware 19713, United States; contact person: Ruben Krüpper, President and Chief Executive Officer, privacy@parsonos.com. Parsonos is a Processor or Subprocessor. Its activities relevant to the transfer are its receipt and Processing of Customer Personal Data as described in Annex I.B.

The parties’ legally binding acceptance of the Agreement constitutes their signature and dates the EU SCCs and UK Addendum on the Agreement acceptance date.

B. Description of Processing and transfer

Data Subjects: Customer’s account users, tenant administrators, project managers, editors, viewers, external guests, authors, narrators, performers, contractors, personnel, rights holders, customers, and other persons whose information Customer includes in a project.

Categories of Personal Data: Names, email addresses, account and tenant identifiers, roles and permissions, project identifiers and titles, manuscripts, scripts, PDFs, recordings and voices, speech and text content, project instructions, annotations, job and workflow metadata, Customer Deliverables, support information submitted through an approved channel, and security or usage events tied to the project.

Sensitive or special-category data: Customer Content may reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health, sex life or sexual orientation, criminal allegations or convictions, a minor’s information, or voice or other data regulated as biometric information depending on its use. Customer determines whether to submit such data and must provide lawful instructions. Parsonos applies the safeguards in Annex II and limits access and provider routing to the requested workflow.

Frequency: Continuous or intermittent, depending on Customer’s use of Palaba.

Nature and purpose: Receipt, hosting, organization, retrieval, alignment, transcription, analysis, transformation, generation of Customer Deliverables, access control, support, troubleshooting, security, deletion, and other Processing documented in the Agreement or project instructions.

Duration: For the applicable project and Agreement term, the post-termination retrieval period, and the deletion and isolated-backup lifecycle described in Section 8.

Transfer subject matter: Provision of Palaba to Customer in the United States, including the Processing above.

C. Competent authority

For the EU SCCs, Customer’s acceptance record will identify by name and contact details the competent supervisory authority selected consistently with Clause 13: the authority for Customer’s EEA establishment; if Customer is not established in the EEA but has an Article 27 representative, the authority for that representative’s Member State; or otherwise an authority in a Member State where affected Data Subjects are located. If more than one authority is eligible, Customer will select one and the acceptance record will preserve that selection with the executed SCC particulars. The competent authority for the UK Addendum is determined under its mandatory clauses.

Annex II — Technical and organizational measures

Parsonos will implement and maintain the following baseline measures:

1. Identity and access: individual privileged accounts; MFA for privileged systems; role- and tenant-scoped customer access; least-privilege service credentials; prompt access revocation; and project-scoped guest access where enabled.
2. Infrastructure access: key-based SSH with password authentication disabled; restricted network access and firewalls; secrets limited to the components that require them; and controlled credential storage, rotation, and recovery.
3. Encryption: current industry-standard encryption in transit; encryption at rest for persistent Customer Personal Data in application databases, object storage, server volumes, and backups; encrypted personnel work devices used for privileged access; and documented key-management and recovery procedures.
4. Tenant isolation: authorization checks bind authenticated identity to tenant membership, role, project permission, object identifier, and signed-link issuance; download links are scoped and time-limited; storage is not publicly listable.
5. Personnel: access limited to personnel with an active development, support, security, or legal need; contractual confidentiality; privacy and security instruction; and prohibition on uncontrolled local retention of Customer Personal Data.
6. Logging and monitoring: authentication, privileged access, permission, sharing, download, deletion, billing attribution, and material security events logged as appropriate; unusual behavior alerts; protected log retention; and periodic review.
7. Secure development and change control: access-controlled version control; review and validation of material production changes appropriate to team size; traceable deployment and rollback practices; and no use of production Customer Personal Data for generalized testing without express permission.
8. Vulnerability management: supported systems; risk-based security updates; review, triage, mitigation, and remediation of identified vulnerabilities; and a monitored good-faith vulnerability-reporting channel.
9. Incident response: a written plan covering detection, escalation, containment, evidence preservation, recovery, communications, regulatory and customer assessment, post-incident review, and periodic exercises.
10. Resilience and recovery: encrypted and access-restricted backups where used; documented restoration and integrity validation; periodic restore testing; automated deployment and rebuild capability; deletion records reapplied after restoration; and continuity responsibilities assigned to at least two authorized personnel.
11. Provider management: documented diligence, written data-protection terms, data-minimizing routing, training and retention settings, location review, Subprocessor-change controls, and periodic reassessment.
12. Deletion and media handling: authenticated deletion, active-system removal, documented backup expiration, restricted recovery use, secure endpoint deletion after approved troubleshooting, and disposal of secrets and media when no longer needed.
13. Physical and endpoint security: full-disk encryption, automatic locking, current security updates, controlled administrative privileges, and no ordinary storage of Customer Personal Data on personal laptops.
14. Support handling: support email limited to project titles at most; no manuscripts, recordings, credentials, or project-file attachments through ordinary email; and an approved secure channel for content needed for authorized troubleshooting.

Annex III — Authorized Subprocessors

The Subprocessor List in effect when Customer accepts this DPA is incorporated into this Annex. It identifies the current authorized Subprocessors, broad functions, Customer Personal Data, and processing countries. A provider is included only to the extent it Processes Customer Personal Data on behalf of Parsonos, and applies only where the corresponding Service or feature is used. Changes follow Section 9.