DATA PROCESSING ADDENDUM
Effective Date: July 24, 2025
Part of: ReelReview Terms of UseApplies to:
All ReelReview users collecting or uploading Personal Data via the platform
1. Introduction
This Data Processing Addendum (“Addendum”) is entered into between the customer (the “Business” or “Controller”) and Original8 Consulting Inc., a Florida corporation doing business as ReelReview, located at [Your Company’s Miami Address] (“Service Provider” or “Processor”).
This Addendum supplements and forms part of the ReelReview Terms of Use, and governs ReelReview’s processing of Personal Data on behalf of the Business.
2. Definitions
- “Personal Data”: Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. This includes, but is not limited to, data defined as “personal information” under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), and “personal data” under the General Data Protection Regulation (GDPR).
- “Business” / “Controller”: The entity using ReelReview to collect, store, and manage video content and associated data, and which determines the purposes and means of the processing of Personal Data.
- “Service Provider” / “Processor”: ReelReview, acting solely on behalf of and under the documented instructions of the Business, for the purposes of providing the Services.
- “Process” / “Processing”: Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Data Protection Laws”: All applicable laws and regulations relating to the processing of Personal Data, including but not limited to, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and the General Data Protection Regulation (EU) 2016/679 (GDPR) to the extent applicable to the processing of Personal Data of individuals in the European Union.
- “Data Subject”: An identified or identifiable natural person to whom Personal Data relates.
- “Supervisory Authority”: An independent public authority which is established by an EU Member State pursuant to Article 51 of the GDPR.
3. Scope and Purpose of Processing
ReelReview provides a platform that enables users to request, collect, manage, and store user-submitted videos, including testimonials, and to facilitate collaborative feedback and AI-powered insights.
ReelReview processes Personal Data only:
- To deliver the Services described in the Terms of Use;
- As instructed by the Business, including through the Business’s use of the Services’ functionalities;
- In accordance with applicable Data Protection Laws.
ReelReview does not determine the purpose or legal basis for the processing of Personal Data submitted by users or their end-customers. The Business is the Controller of the Personal Data and ReelReview is the Processor.
4. Business Responsibilities
The Business represents and warrants that:
- It has obtained all necessary consents, legal permissions, and valid legal bases from Data Subjects (including individuals appearing in or submitting video content) required for the lawful collection, processing, and transfer of Personal Data to ReelReview and for ReelReview to process such Personal Data in accordance with this Addendum and the Terms of Use.
- It complies with all applicable Data Protection Laws in its collection, use, and transfer of Personal Data.
- It is solely responsible for the content, accuracy, and legality of any Personal Data uploaded to the platform, and for the instructions it provides to ReelReview regarding the processing of such Personal Data.
- It will not use ReelReview to store or transmit unlawful, harmful, or unconsented data, or data for which it does not have the necessary rights or permissions.
5. Service Provider Commitments
ReelReview agrees to:
- Process Personal Data only for the limited and specified purpose of delivering the platform features and as instructed by the Business, unless otherwise required by law to which ReelReview is subject. In such a case, ReelReview shall inform the Business of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
- Not “sell” or “share” Personal Data as defined by the California Consumer Privacy Act (CCPA/CPRA).
- Not retain, use, or disclose Personal Data outside the direct business relationship between the Business and ReelReview, except as necessary to provide the Services, and not for any commercial purpose other than providing the Services, or as otherwise permitted by Data Protection Laws.
- Implement and maintain appropriate technical and organizational safeguards to protect Personal Data, as further detailed in Section 10.
- Notify the Business without undue delay upon becoming aware of a confirmed Personal Data Breach affecting the Personal Data processed under this Addendum.
- Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- Provide reasonable assistance to the Business in ensuring compliance with the Business’s obligations regarding data protection impact assessments and prior consultation with Supervisory Authorities, where required by Data Protection Laws.
6. Subprocessors
ReelReview uses the following subprocessors to support service delivery and may update this list from time to time. ReelReview will notify the Business of any intended changes concerning the addition or replacement of subprocessors, thereby giving the Business the opportunity to object to such changes.
| Subprocessor | Purpose | Location |
| Amazon Web Services | Cloud infrastructure and video processing | USA |
| Google Workspace | Internal communication | USA |
| OpenAI | AI functionalities | USA |
ReelReview ensures all subprocessors are contractually bound to the same level of data protection obligations as set out in this Addendum, particularly with regard to implementing appropriate technical and organizational measures.
7. Data Subject Requests
ReelReview will:
- Promptly notify the Business of any privacy requests (e.g., access, deletion, correction, restriction, objection, data portability) received from Data Subjects relating to the Personal Data processed under this Addendum.
- Not independently respond to such requests without instruction from the Business, unless legally required to do so.
- Provide reasonable assistance to the Business in fulfilling verified Data Subject requests, taking into account the nature of the processing, and by appropriate technical and organizational measures, insofar as this is possible.
8. Data Retention and Deletion
Upon termination of the account or written instruction by the Business, ReelReview will delete or return Personal Data to the Business within 30 days, unless retention is required by applicable law. Backup systems are cleared within 90 days following deletion from live systems, unless required for legal compliance. No Personal Data is retained beyond the contract’s purpose or statutory obligations.
9. Compliance with CCPA/CPRA
ReelReview certifies that it:
- Acts as a Service Provider under the CCPA/CPRA with respect to the Personal Data processed on behalf of the Business.
- Does not sell, share, combine, or build profiles from Personal Data for any purpose other than providing the contracted service to the Business.
- Will support the Business’s obligations regarding consumer rights and transparency under the CCPA/CPRA.
- Will notify the Business if it determines it can no longer meet its obligations under the CCPA/CPRA or other applicable privacy laws.
10. GDPR Compliance
To the extent GDPR applies to the processing of Personal Data under this Addendum, ReelReview, as Processor, commits to:
- Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
- Assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller’s obligation to respond to requests for exercising the Data Subject’s rights.
- Assist the Controller in ensuring compliance with obligations pursuant to Articles 32 to 36 of the GDPR (Security of processing, Notification of a personal data breach to the supervisory authority, Communication of a personal data breach to the data subject, Data protection impact assessment, and Prior consultation).
- At the choice of the Controller, delete or return all the Personal Data to the Controller after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the Personal Data.
- Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.
11. Security Measures
ReelReview maintains appropriate administrative, technical, and physical security controls designed to protect Personal Data, including:
- Encryption in transit and at rest;
- Access controls, role-based permissions;
- Activity logging and anomaly detection;
- Regular employee privacy and security training;
- Incident response protocols;
- Regular security assessments and vulnerability management.
12. Limitation of Liability
To the maximum extent permitted by law:
- ReelReview is not liable for any failure by the Controller to obtain proper consent or legal basis for processing, or to comply with applicable Data Protection Laws.
- ReelReview has no responsibility for the legality, accuracy, or publication of video content or any Personal Data uploaded by the Business.
- ReelReview’s total liability under this Addendum is limited as described in Clause 11 (Limitation on Liability) of the ReelReview Terms of Use.
13. Governing Law and Venue
This Addendum is governed by and construed in accordance with the laws of the State of Florida, USA, without regard to its conflict of law principles. Any disputes arising out of or relating to this Addendum shall be exclusively resolved in the courts of Miami-Dade County, Florida.
14. Acceptance
By checking the box during the account creation process, or by otherwise accessing or using the Services, the Business:
- Accepts this Data Processing Addendum as binding;
- Confirms authority to accept this agreement on behalf of its entire organization;
- Acknowledges its role and responsibilities as a Controller under applicable Data Protection Laws.
