1. Roles and applicable rules
The customer determines why personal data in its media is processed and acts as controller, or as a processor authorised by its controller. SautiBridge acts as processor, or subprocessor as appropriate, for the agreed media service. Account administration is a separate controller activity covered by our Privacy Policy. This framework is intended to implement Article 28 of the GDPR and applicable French data-protection law.
2. Processing schedule to agree before activation
- Parties: the full registered identities and contacts of SautiBridge and the customer.
- Subject and purpose: the agreed transcription, translation, dubbing, voice matching, lip synchronisation, review, storage and export tasks.
- Duration: the service term and specifically agreed active-storage, return, deletion and backup periods.
- Individuals: speakers, presenters, interviewees, reviewers and other people appearing in the submitted material.
- Data: image, voice, speech, identifiers, transcripts, translations and project metadata strictly necessary for the agreed task.
- Sensitive material: special-category, biometric identification and children's data require a separate documented assessment and lawful instructions before acceptance.
- Providers and locations: each approved hosting, storage, AI or support provider, its role, processing countries and applicable transfer mechanism.
3. Instructions and confidentiality
SautiBridge will process the agreed data only on documented lawful instructions, including instructions on transfers, except where law requires otherwise. It will inform the customer of a legal requirement where permitted, flag an apparently unlawful instruction, and ensure authorised personnel are subject to confidentiality duties.
4. Security schedule
The parties must record measures appropriate to the actual media workflow and its risks, including access permissions, secure transport, credential management, isolation, logging, recovery, deletion and incident handling. A website Trust Center is not evidence that a separate media platform implements all required measures. The agreed security schedule forms part of the contract.
5. Subprocessors
No subprocessor may be engaged without the customer's prior specific or general written authorisation. Under general authorisation, SautiBridge will provide advance notice of additions or replacements and an opportunity to object on data-protection grounds. Equivalent written obligations must bind the subprocessor; SautiBridge remains responsible for its processor obligations. The provider list must be available to every affected customer.
6. Rights and assistance
Taking account of the nature of the processing and information available, SautiBridge will assist with data-subject requests and the customer's security, impact-assessment and supervisory-consultation duties. Requests relating to customer-controlled media will be referred to the customer unless a lawful instruction or legal obligation requires otherwise.
7. Personal-data breaches
SautiBridge will notify the customer without undue delay after becoming aware of a personal-data breach affecting the agreed processing, provide available facts and mitigation information, and supply updates as information becomes available. This must enable the controller to assess its own reporting obligations.
8. International transfers
A transfer outside the EEA requires the agreed instructions and a valid Chapter V GDPR mechanism. Where standard contractual clauses are used, the parties must select the applicable module, complete its annexes, assess the transfer and apply necessary supplementary measures. This page does not itself execute those clauses or certify any provider's eligibility.
9. Return, deletion and evidence
At the end of the service, SautiBridge will return or delete the data at the customer's choice and remove copies unless Union or Member State law requires retention. The agreed schedule must cover deletion deadlines and protected backup expiry. SautiBridge will provide information needed to demonstrate compliance and allow and contribute to audits, including inspections by the customer or its mandated auditor, with arrangements that protect other customers' data.
10. Customer duties and execution
The customer must provide lawful instructions, inform individuals, establish a legal basis, obtain necessary voice and image permissions, minimise submitted data and review outputs. Request a completed agreement and provider schedule at support@sautibridge.com. No unidentified AI provider is authorised merely by publishing this framework.