This Data Processing Agreement (DPA) sets out how Spokesbot handles personal data submitted by clients based in the European Union or the United Kingdom, in line with the EU GDPR and the UK GDPR. It forms part of the overall agreement between you and Spokesbot when you commission a video.
Only the personal data you submit as part of a project: your name and email address, scripts or briefs that reference real individuals, and brand assets that may incorporate names or images of people. Spokesbot does not collect personal data about third parties unless you explicitly include it in a brief. You are responsible for ensuring you have a lawful basis to share any personal data about third parties.
HeyGen (AI video generation, US-based - receives your script and brand materials), Stripe (payment processing, US-based, PCI-DSS Level 1), and Hostinger (website hosting and form data storage). You will be notified of any replacement or addition.
Spokesbot is based in Arizona, United States. Personal data is transferred to the US when you submit a brief or make a payment. Transfers rely on Standard Contractual Clauses and, where applicable, adequacy decisions.
Project files are stored in password-protected systems, deleted within 90 days of project completion, no card data is stored by Spokesbot, and project communication takes place over encrypted email.
If a data subject contacts Spokesbot directly to exercise a GDPR right, we notify you within five business days and assist your response. In the event of a personal data breach affecting your project data, we notify you within 72 hours.
On completion of a project, your files are retained for up to 90 days and then deleted. You can request earlier deletion at any time by emailing info@spokesbot.video.
Data protection enquiries: info@spokesbot.video.