This Data Processing Addendum (the “DPA”) forms part of the agreement between Common Ninja Ltd., a company incorporated under the laws of the State of Israel (company number 516365541), which provides the Vidocu platform (“Common Ninja”, “we”, “us”), and the customer using the Services (the “Customer”), namely the Vidocu Terms of Service available at https://vidocu.ai/terms or any other written agreement between the Parties governing the use of the Services (the “Agreement”). It sets out the Parties’ obligations regarding Personal Data that Common Ninja Processes on behalf of the Customer. Common Ninja and the Customer are each a “Party” and together the “Parties”.
Capitalized terms not defined in this DPA have the meaning given to them in the Agreement. By using the Services, or by signing this DPA, the Customer accepts this DPA, and the person accepting it confirms that they have authority to bind the Customer. If there is a conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA prevails. Where the Standard Contractual Clauses apply, they prevail over this DPA to the extent of any conflict.
1. Definitions
1.1 “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party, where “control” means ownership or control of more than 50% of the voting interests of the entity.
1.2 “CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended, and its implementing regulations.
1.3 “Controller”, “Processor”, “Processing”, “Data Subject”, “Member State”, “Personal Data Breach” and “Supervisory Authority” have the meaning given to them in the GDPR. “Business”, “Service Provider”, “Consumer”, “Sell” and “Share” have the meaning given to them in the CCPA. Where the CCPA applies, “Controller” includes “Business” and “Processor” includes “Service Provider”.
1.4 “Customer Content” means the videos, screen and audio recordings, images, documents, text and other material uploaded to or created in the Services by or for the Customer, including material generated from it such as transcripts, subtitles, scripts, voiceovers, articles, translations, trainings and knowledge base content.
1.5 “Data Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data Processed by Common Ninja or its Sub-processors on behalf of the Customer.
1.6 “Data Protection Laws” means all privacy and data protection laws that apply to the Processing of Personal Data under the Agreement, including, as applicable, the GDPR, the UK GDPR, the FADP, the Israeli Protection of Privacy Law, 5741-1981 and its regulations, and the CCPA.
1.7 “FADP” means the Swiss Federal Act on Data Protection of 25 September 2020, as amended.
1.8 “GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation).
1.9 “Personal Data” means any information relating to an identified or identifiable natural person, or that is “personal information” under the CCPA, to the extent Common Ninja Processes it on behalf of the Customer under the Agreement.
1.10 “Security Measures” means the technical and organizational measures described in Schedule 2.
1.11 “Services” means the Vidocu platform and related services Common Ninja provides to the Customer under the Agreement, including the web application, knowledge bases, trainings, browser extension, API and integrations with AI assistants.
1.12 “Sensitive Data” means Personal Data that receives special protection under Data Protection Laws, including special categories of data under Article 9 of the GDPR, data relating to criminal convictions, government identification numbers, financial account or payment card numbers, and account passwords.
1.13 “Standard Contractual Clauses” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, in the form published at https://vidocu.ai/privacy-scc-c2p (controller to processor) and https://vidocu.ai/privacy-scc-p2p (processor to processor), including their Annexes.
1.14 “Sub-processor” means any third party, including an Affiliate of Common Ninja, engaged by Common Ninja to Process Personal Data on behalf of the Customer.
1.15 “UK GDPR” means the GDPR as it forms part of the law of the United Kingdom under the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.
2. Processing of Personal Data
2.1 Roles of the Parties. For Personal Data Processed on behalf of the Customer, the Customer is the Controller and Common Ninja is the Processor. Where the Customer itself acts as a Processor for another Controller, Common Ninja acts as the Customer’s Sub-processor.
2.2 Customer’s Responsibilities. The Customer shall comply with Data Protection Laws in its use of the Services and in its instructions to Common Ninja. The Customer is responsible for having a lawful basis, and any notices and consents required, for the Personal Data it provides to the Services, including for recording, uploading and publishing images and voices of people who appear in Customer Content.
2.3 Common Ninja’s Processing. Common Ninja shall Process Personal Data only on the Customer’s documented instructions, which are: (i) to provide, maintain, secure and support the Services in accordance with the Agreement and this DPA; (ii) as initiated by the Customer and its users through the Services; (iii) to create aggregated or de-identified information that no longer identifies any person, the Customer or its users; and (iv) as otherwise agreed in writing. The Agreement and this DPA are the Customer’s complete instructions at the time of signing; additional instructions require the Parties’ agreement. Common Ninja may also Process Personal Data where required by applicable law, in which case it shall inform the Customer of that requirement before Processing unless the law prohibits it. Common Ninja shall inform the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Laws.
2.4 Details of the Processing. The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are described in Schedule 1.
2.5 Faces and Voices. Customer Content may contain images of people, including their faces, and recordings of their voices. Common Ninja Processes these only as ordinary image, video and audio content in order to provide the Services, for example to transcribe speech, generate subtitles, voiceovers and articles, take screenshots, or keep a speaker in frame when a video is reformatted. Common Ninja does not Process them to uniquely identify any person, does not create or store biometric templates, and does not use face or voice recognition to identify individuals. Where a feature locates a face within a frame, it does so to position the image and does not determine who the person is. Where the Customer uses voice cloning or AI avatars, Common Ninja and its Sub-processors use the voice recording or images the Customer provides to create a synthetic voice or avatar for the Customer’s use only. The Customer is responsible for obtaining the consent of the person whose voice or likeness is used.
2.6 No Model Training. Common Ninja does not use Personal Data to train, fine-tune or improve AI models made available to other customers, and it configures its AI Sub-processors not to use such data to train their models where that option is available.
2.7 Sensitive Data. The Services are not designed for Sensitive Data. The Customer shall not submit Sensitive Data to the Services without Common Ninja’s prior written agreement. Common Ninja has no obligation to review Customer Content to identify Sensitive Data.
2.8 CCPA. Common Ninja shall not Sell or Share Personal Data; retain, use or disclose it for any purpose other than providing the Services, or outside the direct business relationship between the Parties; or combine it with personal information it receives from other sources, except as permitted by the CCPA. Common Ninja shall notify the Customer if it can no longer meet its obligations under the CCPA.
2.9 Common Ninja as Controller. This DPA does not apply to Personal Data that Common Ninja Processes as a Controller for its own legitimate business purposes, as described in its Privacy Policy at https://vidocu.ai/privacy-policy. These purposes are: managing accounts, billing and the customer relationship; sending service and product communications; securing the Services and preventing fraud and abuse; measuring and improving the Services using usage information; and complying with legal obligations.
3. Data Subject Requests
Common Ninja shall, to the extent legally permitted, promptly notify the Customer of any request it receives from a Data Subject to exercise their rights under Data Protection Laws regarding Personal Data Processed on behalf of the Customer, and shall not respond to the request itself other than to refer the Data Subject to the Customer. Taking into account the nature of the Processing, Common Ninja shall assist the Customer by appropriate technical and organizational measures, insofar as possible, to respond to such requests. Many requests can be handled directly in the Services, for example by editing or deleting Customer Content, users or training records.
4. Confidentiality
Common Ninja shall ensure that its personnel authorized to Process Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, and that access is limited to those who need it to provide the Services.
5. Sub-processors
5.1 Authorization. The Customer gives Common Ninja general authorization to engage Sub-processors. The Sub-processors listed at https://vidocu.ai/privacy-sub-processors on the date of this DPA (the “Sub-processor List”, which states each Sub-processor’s name, processing location and purpose) are authorized.
5.2 Notice of New Sub-processors. Common Ninja shall notify the Customer by email to the owners of the Customer’s workspaces, and update the Sub-processor List, at least thirty (30) days before a new Sub-processor begins Processing Personal Data. The Customer may also ask to receive such notices at another address by writing to [email protected].
5.3 Right to Object. The Customer may object to a new Sub-processor on reasonable grounds relating to data protection by writing to [email protected] within thirty (30) days of the notice. The Parties shall discuss the objection in good faith, and Common Ninja may offer a change to the Services or their configuration that avoids the Sub-processor. If the objection is not resolved within thirty (30) days of its receipt, the Customer may terminate the part of the Services that cannot be provided without the new Sub-processor, by written notice, and Common Ninja shall refund any prepaid fees for the terminated part covering the period after termination. This is the Customer’s sole and exclusive remedy for an objection to a Sub-processor.
5.4 Urgent Replacement. Where Common Ninja must replace a Sub-processor urgently to keep the Services secure or available, for example because the existing Sub-processor has failed or ended its service, it may do so with shorter notice. It shall notify the Customer as soon as possible, and Section 5.3 applies from the date of that notice.
5.5 Sub-processor Obligations. Common Ninja shall carry out appropriate due diligence on each Sub-processor, and shall impose on it by written contract data protection obligations that provide at least the same level of protection as this DPA. Common Ninja remains fully responsible to the Customer for the performance of its Sub-processors’ obligations.
6. Security and Audits
6.1 Security Measures. Common Ninja shall implement and maintain the Security Measures, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. Common Ninja may update the Security Measures from time to time, provided that updates do not reduce the overall level of protection.
6.2 Assistance. Taking into account the nature of the Processing and the information available to it, Common Ninja shall reasonably assist the Customer with its obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultations with a Supervisory Authority.
6.3 Audit Reports. Common Ninja holds a SOC 2 Type 2 report covering the Security, Confidentiality and Availability criteria, and shall use commercially reasonable efforts to maintain an equivalent independent report during the term of the Agreement. On request, and subject to a confidentiality agreement, Common Ninja shall provide the Customer with its most recent report and answer reasonable written questions about its Processing of Personal Data, no more than once in any twelve (12) month period unless a Data Incident has occurred.
6.4 Audits. Where the information under Section 6.3 is not sufficient to demonstrate compliance with this DPA, or where a Supervisory Authority requires it, the Customer, or an independent auditor bound by confidentiality that is not a competitor of Common Ninja, may audit Common Ninja’s compliance with this DPA. The Customer shall give at least thirty (30) days’ written notice and agree the scope, timing and method with Common Ninja in advance. Audits shall be carried out by review of documents and remote sessions where that is sufficient, and on site only where it is not. They shall take place during normal business hours without disrupting Common Ninja’s operations, and shall not give access to other customers’ data or to information subject to confidentiality obligations owed to third parties. The Customer bears its own costs, and shall reimburse Common Ninja’s reasonable costs for time spent on the audit beyond one business day, unless the audit reveals a material breach of this DPA by Common Ninja. Audits are limited to once in any twelve (12) month period, unless a Data Incident has occurred or a Supervisory Authority requires otherwise. Audit results are Common Ninja’s confidential information and may be used only to assess compliance with this DPA.
7. Data Incidents
7.1 Notice. Common Ninja maintains an incident response plan. It shall notify the Customer of a Data Incident without undue delay, and in any event within seventy-two (72) hours after becoming aware of it, by email to the owners of the Customer’s workspaces. Common Ninja becomes aware of a Data Incident when it has a reasonable degree of certainty that one has occurred. Unsuccessful attempts or activities that do not compromise the security of Personal Data, such as pings, port scans, blocked login attempts or denial of service attacks, are not Data Incidents.
7.2 Content of the Notice. The notice shall describe, to the extent then known: the nature of the Data Incident, including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to reduce its possible adverse effects; and a contact point for more information. Where not all of this information is available at once, Common Ninja shall provide it in phases without undue delay.
7.3 Response and Cooperation. Common Ninja shall promptly take reasonable steps to contain, investigate and remedy the Data Incident, and shall provide the Customer with the cooperation and information it reasonably needs to meet its own obligations, including notifying Supervisory Authorities and affected Data Subjects. Nothing in this DPA restricts the Customer from making any notification or disclosure it considers necessary under Data Protection Laws.
7.4 No Admission. Common Ninja’s notice of, or response to, a Data Incident is not an acknowledgement of fault or liability. This Section 7 does not apply to incidents caused by the Customer or its users, such as the compromise of a user’s own credentials, or by the Customer’s own configuration of the Services, such as publishing content or granting access to it, although Common Ninja shall still provide reasonable assistance.
8. Return and Deletion of Personal Data
8.1 During the Agreement. The Customer can delete Customer Content and users in the Services at any time, after which they are no longer available in the Services. The Customer may also ask Common Ninja to delete specified Personal Data, a workspace or all of its data by writing to [email protected]. Common Ninja shall delete the requested Personal Data, including stored files, from its production systems within thirty (30) days of the request, and within thirty (30) days of the Customer deleting a workspace or account in the Services.
8.2 After the Agreement Ends. For thirty (30) days after the Agreement ends, the Customer may export its Customer Content using the export features of the Services or on request in a commonly used format. Common Ninja shall then delete all Personal Data it Processes on behalf of the Customer from its production systems within thirty (30) days after that export period.
8.3 Backups, Logs and Sub-processors. Deleted Personal Data may remain in encrypted database backups until those backups expire under Common Ninja’s backup schedule, and in any event no longer than twelve (12) months, and in security and operational logs for the limited period they are kept. Backups are kept isolated, protected by the Security Measures, and used only to restore the Services after a failure. If a backup is ever restored, Common Ninja shall delete again any Personal Data that had been deleted before the restore. Personal Data held by Sub-processors is deleted in accordance with their retention terms.
8.4 Legal Retention and Confirmation. Common Ninja may retain Personal Data where required by applicable law, only for as long as required and subject to this DPA. On request, Common Ninja shall confirm the deletion to the Customer in writing.
9. International Transfers
9.1 Hosting. Common Ninja stores Customer Content files with Amazon Web Services in the United States (Oregon, us-west-2), and the Services’ databases with MongoDB Atlas on Amazon Web Services in the United States (Virginia, us-east-1). Common Ninja is established in Israel, which the European Commission and the United Kingdom recognize as providing an adequate level of data protection. Sub-processors process Personal Data in the locations stated in the Sub-processor List. Common Ninja may change hosting locations by updating the Sub-processor List in accordance with Section 5.
9.2 Transfers from the EEA, the United Kingdom and Switzerland. Where Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country that is not recognized as providing adequate protection, and no other valid transfer mechanism applies (such as the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, for a Sub-processor certified under it), the Standard Contractual Clauses apply and are incorporated into this DPA: Module Two (controller to processor) where the Customer is a Controller, and Module Three (processor to processor) where the Customer is a Processor. For transfers from the United Kingdom, the Standard Contractual Clauses apply as amended by Annex III thereto (UK Cross Border Transfers), and for transfers from Switzerland, as amended by Annex IV thereto (Swiss Cross Border Transfers). Annex I of the Standard Contractual Clauses is completed by Schedule 1, and Annex II by Schedule 2.
9.3 Government Access. If Common Ninja receives a request from a public authority for access to Personal Data, it shall, unless legally prohibited, notify the Customer, review the legality of the request, challenge it where there are reasonable grounds to do so, and disclose only the minimum information required.
10. Authorized Affiliates
The Customer enters into this DPA for itself and on behalf of its Affiliates that use the Services under the Customer’s account and are Controllers of Personal Data Processed under it. The Customer remains responsible for its Affiliates’ compliance, and all communication under this DPA takes place between Common Ninja and the Customer.
11. General
11.1 Term. This DPA applies for as long as Common Ninja Processes Personal Data on behalf of the Customer.
11.2 Liability. Each Party’s total liability arising out of or related to this DPA and the Standard Contractual Clauses, taken together, is subject to the limitations and exclusions of liability in the Agreement, except to the extent Data Protection Laws or the Standard Contractual Clauses do not permit such limitation. This DPA does not create any separate or additional liability.
11.3 Cost of Assistance. Common Ninja may charge reasonable fees for assistance under Sections 3 and 6.2 that goes beyond the standard features of the Services, unless the assistance is needed because of Common Ninja’s breach of this DPA.
11.4 Changes. Common Ninja may update this DPA to reflect changes in Data Protection Laws, in the Services or in its Sub-processors. Updates shall not reduce the protection of Personal Data under this DPA during the Customer’s subscription term without the Customer’s written consent. Where the Parties have signed this DPA, changes require a written amendment signed by both Parties, except for changes to the Sub-processor List made under Section 5.
11.5 Governing Law. This DPA is governed by the law that governs the Agreement, except where the Standard Contractual Clauses or Data Protection Laws require otherwise.
11.6 Contact. Questions about this DPA or the Processing of Personal Data can be sent to [email protected].
Schedule 1: Details of the Processing
Subject Matter and Nature
Providing the Services: storing and processing Customer Content; analyzing video and audio; transcription; generating subtitles, scripts, voiceovers, AI avatar videos, articles, translations and trainings; publishing knowledge bases; managing users, access, approvals and training records; support; and securing and maintaining the Services.
Purpose
To provide the Services to the Customer under the Agreement, to follow the Customer’s instructions given through the Services, and to comply with applicable law.
Duration
For the term of the Agreement and until deletion under Section 8.
Frequency
Continuous, in line with the Customer’s use of the Services.
Categories of Data Subjects
- The Customer’s users of the Services, such as employees and contractors
- People who appear or speak in Customer Content
- People assigned trainings and their qualification records
- Readers of the Customer’s knowledge bases, including the Customer’s own customers where the Customer grants them access
- Other people named or shown in Customer Content
Types of Personal Data
- Account data: name, email address, role, workspace membership, sign-in and single sign-on identifiers (also Processed by Common Ninja as a Controller, see Section 2.9)
- Customer Content: video, screen and audio recordings, including images of people (faces) and voices; transcripts, subtitles, scripts, articles, translations and other text that may contain names or other Personal Data
- Training data: names and email addresses of participants, answers, scores, completion and qualification records
- Knowledge base reader data: email addresses used to sign in, feedback, questions asked to the AI assistant, and usage data
- Technical data: IP address, browser and device information, and logs of activity in the Services
Sensitive Data
None intended (see Section 2.7). Faces and voices are Processed only as described in Section 2.5 and not for the purpose of uniquely identifying a natural person.
Sub-processors
As listed in the Sub-processor List, for the purposes and in the locations stated there.
Schedule 2: Technical and Organizational Measures
Common Ninja may update these measures in accordance with Section 6.1.
Certification
- SOC 2 Type 2 report covering Security, Confidentiality and Availability, issued by an independent auditor and available under a confidentiality agreement
Encryption
- Data in transit is encrypted with TLS 1.2 or higher
- Databases are encrypted at rest with AES-256, and stored files with server-side encryption
- Credentials that the Customer connects to third-party integrations are stored encrypted
Access Control
- Access to production systems is limited to named engineers, follows least privilege, and requires multi-factor authentication
- Access rights are reviewed regularly and removed promptly when a person leaves
- In the Services, workspace roles, folder permissions, content locks with approval records, and sign-in protected knowledge bases let the Customer control who can see and change content; single sign-on is available
Infrastructure and Application Security
- Hosting on Amazon Web Services and MongoDB Atlas with network protection, DDoS mitigation and a web application firewall at the edge
- Separation of customer data by workspace in the application
- Automated dependency and vulnerability scanning, secure development with code review, and a strict Content Security Policy
- API access through revocable keys and OAuth tokens limited by scope
Availability and Backups
- Automated database backups with point-in-time recovery, with restores tested
- Monitoring and alerting on production systems
Incident Response
- A documented incident response plan, reviewed and tested regularly, including notice to customers under Section 7
Personnel
- Confidentiality obligations for all personnel, security awareness training, and a documented onboarding and offboarding process
Sub-processors
- Due diligence before engagement, written data protection terms, and AI providers configured not to train on Customer Content where that option is available
Deletion
- Deletion of Personal Data under Section 8, including automatic removal of deleted and replaced stored files within 30 days
Last updated: September 27, 2026