Data Processing Agreement

Last updated: 5 November 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Terms”) between Vindrose sp. z o.o., ul. Piękna 58c, 50-506 Wrocław, Poland, KRS No. 0001261581 (“BlaBlaScribe”, “we”), and the customer who uses the Service to process personal data on its own behalf or on behalf of its organisation (“Customer”, “you”).

It applies whenever BlaBlaScribe processes personal data contained in your User Content as your processor under Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). It applies automatically when you accept the Terms; no separate signature is needed. If you need a countersigned copy, write to [email protected].

If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

1. Roles

• For personal data in your User Content (recordings, transcripts, subtitles, translations, voice-overs and voice samples), you are the controller and BlaBlaScribe is your processor.
• For your account, billing, usage and marketing data, BlaBlaScribe is an independent controller, as described in the Privacy Policy. This DPA does not cover that data.

2. Instructions

We process personal data only on your documented instructions. Your instructions are: the Terms, this DPA, and the actions you take in the Service (for example uploading a file, requesting a translation, creating a voice-over or deleting a file). If we believe an instruction infringes the GDPR or other EU or Member State data-protection law, we will tell you. We may process personal data otherwise only where EU or Member State law requires it; in that case we will tell you first unless the law forbids it.

3. Details of the processing

Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

4. Confidentiality

Only systems and authorised personnel that need access to operate the Service and provide support can access User Content. Everyone authorised to process personal data is bound by confidentiality obligations.

5. Security

We implement appropriate technical and organisational measures under Article 32 GDPR, described in Annex 2. We may update them as long as the overall level of protection does not decrease.

6. Subprocessors

1. You give us general authorisation to engage subprocessors. The current list, with what each one receives and where, is published at blablascribe.ai/company/subprocessors.
2. We inform you of any addition or replacement of a subprocessor that processes User Content by updating that page, with the date of the change, before the new subprocessor starts processing User Content. We do not send separate notifications; please check that page to stay informed.
3. If you object to a change on reasonable data-protection grounds, we will discuss it with you in good faith. If we can’t resolve it, you may stop using the affected feature or terminate the Service. Fees already paid are not refunded.
4. We impose on each subprocessor data-protection obligations that are at least as protective as this DPA, and we remain responsible to you for their performance.

Transcription, subtitle generation and speech/music separation run on our own servers in Germany. Audio and video are not sent to third-party AI providers. Only if you use translation, AI text tools or dubbing do we send the text of your transcript to Google (Gemini API), and for dubbing the voice-over script — and, for a voice clone, the voice sample you approved — to ElevenLabs.

7. International transfers

User Content is stored on servers of Hetzner Online GmbH in Germany. Where a subprocessor processes personal data outside the European Economic Area, we make sure an appropriate safeguard under Chapter V GDPR is in place: an adequacy decision (including the EU–US Data Privacy Framework where the subprocessor is certified) or the European Commission’s Standard Contractual Clauses.

8. Helping you meet your obligations

• Data subject requests. You can access, export, correct and delete User Content yourself in the Service. If we receive a request from a data subject about your User Content, we will forward it to you and not answer it ourselves unless you instruct us to.
• DPIAs and consultations. We will provide reasonable information you need for a data protection impact assessment or a prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to us.

9. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting your User Content. The notice will include, as far as available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. We will provide further information as it becomes available.

10. Deletion and return

• You can export and delete your files at any time in the Service. Deleting a file removes it from active storage.
• Original audio and video are deleted automatically according to your plan, as set out in the Privacy Policy. Transcripts, subtitles and translations stay in your account until you delete them or your account.
• When you delete your account, we delete your User Content, normally immediately, unless EU or Member State law requires us to keep it. Copies in backups are overwritten in the normal backup cycle within 30 days.

11. Information and audits

We demonstrate compliance with Article 28 GDPR through our published documentation: this DPA, the Privacy Policy, the Security & privacy page and the Subprocessors page. We keep these documents up to date. Further audits, including inspections, take place only where a supervisory authority or applicable law requires them; in that case they are carried out with reasonable notice, at your cost and subject to confidentiality.

12. Liability, term and governing law

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it to be limited. This DPA applies for as long as we process personal data on your behalf. It is governed by the same law, and disputes go to the same courts, as the Terms (Poland, courts of Wrocław).

Annex 1 — Details of the processing

• Subject matter: providing the Service — transcription, subtitles, translation, AI text tools, voice-overs (dubbing), editing and export.
• Duration: for the term of the Terms, plus the retention periods in Section 10.
• Nature and purpose: storing, transcribing, translating, summarising, generating speech from, editing and exporting User Content at your request.
• Types of personal data: voices and anything spoken in recordings; images in video; names and other information in file names, transcripts, subtitles and translations; voice samples, if you create a voice clone.
• Special categories: recordings may contain special categories of data (for example health, political opinions or religious beliefs) if the speakers mention them. You decide whether to upload such content. We do not process voices to identify individuals; a voice clone reproduces a voice only to create the voice-overs you request.
• Data subjects: people whose voices, images or names appear in your User Content — for example interviewees, participants, speakers, students, clients and employees.

Annex 2 — Technical and organisational measures

• Location: User Content is hosted by Hetzner Online GmbH in data centres in Germany (EU).
• Processing on our own infrastructure: transcription, subtitle generation and speech/music separation do not use third-party AI providers.
• Encryption in transit: all connections to the Service use HTTPS (TLS).
• Access control: access to User Content is limited to systems and authorised personnel that need it to operate the Service and provide support.
• No training: User Content is not used to train AI models, by us or by our subprocessors.
• Minimisation: only the data a feature needs is sent to a subprocessor (for example, translation sends text, never audio); voice models at ElevenLabs exist only while a voice-over is being generated.
• Retention controls: automatic deletion of original media according to plan, advance email reminders, and deletion by the user at any time.
• Payments: card data is handled by Stripe; we never receive full card numbers.

Annex 3 — Subprocessors

The current list is at blablascribe.ai/company/subprocessors.