Data Processing Agreement

Draft v1 · Aug 2026. This Data Processing Agreement (“DPA”) is between Evidentum, Inc. (Processor) and the business Customer (Controller) using Evidentum under the Terms. It applies when we process Customer Personal Data on your behalf. Enterprise Customers may countersign a version attached to an Order Form. Transfer clauses (SCCs), liability, and audit mechanics require counsel before production reliance.

1. Roles

• Customer is Controller of Customer Personal Data (including Camera Data and User account data as applicable)
• Evidentum is Processor / service provider, processing only to provide the Services and as permitted by law
• If Customer is itself a processor, Customer warrants authority to appoint Evidentum as subprocessor

2. Scope of processing

• Subject matter: hosting and processing Account data and Customer Content
• Nature: ingest from Customer systems, storage, frame analysis, Events/Incidents/Cases, AI text features you enable, integrations you configure, deletion
• Purpose: provide, secure, support, and bill for the Services per your configuration
• Data subjects: your Users; people incidentally in your footage; others you submit
• Categories: as in the Privacy Policy (identifiers, Camera Data, investigation records, logs)

3. Instructions

You instruct us to process Customer Personal Data to run Evidentum as configured (including AI Features that may send text prompts/metadata to AI subprocessors). We will not process for our own purposes except as allowed for service providers under applicable law, and we do not use Customer Content to train general-purpose AI models by default. If an instruction appears unlawful, we will notify you when permitted.

4. Confidentiality & security

Authorized personnel are under confidentiality duties. We maintain technical and organizational measures summarized on Security (TLS, auth, RBAC/site scoping, signed media access, audit/custody tooling, rate limits, production secret controls). You secure cameras, networks, credentials, and connected systems. We do not claim SOC 2 unless completed and stated.

5. Subprocessors

• You authorize Subprocessors needed to run the Services — see /subprocessors
• We flow down materially protective obligations and remain responsible to you for Subprocessor performance
• Material changes are posted on the Subprocessors page; Enterprise notice/objection timing to be finalized with counsel
• Customer-configured integrations are your recipients—not our Subprocessors—for data you choose to send

6. Data-subject requests

We will reasonably assist you (product features + support) with rights requests. Requests about camera/investigation data should generally go to you as Controller; if we receive one identifying you, we will redirect/notify you when permitted.

7. Security Incidents

We will notify you without undue delay after becoming aware of a Security Incident affecting Customer Personal Data, with information reasonably available, via Account admin / designated security contacts. Notification is not an admission of fault. You decide regulator/individual notices unless law obligates us directly.

8. Return & deletion

After termination, you may export available data (target window: 30 days, subject to counsel). We then delete from primary systems within a commercially reasonable period, except legal holds, legal retention, backup rotation, and de-identified operational data.

9. Audits

We will provide information reasonably necessary to demonstrate compliance (questionnaires, security materials, Subprocessors list). Audits generally at most once per 12 months on reasonable notice, preferably via reports/questionnaires; on-site mechanics and cost allocation to be finalized with counsel.

10. International transfers

Data may be processed in the U.S. and other countries where we or Subprocessors operate. Restricted transfers incorporate EU SCCs Module 2 (and Module 3 where applicable) and the UK IDTA Addendum as described in the full DPA draft; signed SCC packs available for Enterprise on request.

11. Your obligations

• Lawful basis and rights to instruct us (including camera/surveillance compliance)
• Notices to employees/visitors and other data subjects as required
• Appropriate retention, access, and integration configuration
• No unlawful processing instructions

12. Liability, term, precedence

Liability follows the Terms/Order Form except where data-protection law forbids limitation (counsel to align). This DPA lasts while we process under the Terms plus deletion. Order: signed Order Form amendments → SCCs (transfer conflicts) → this DPA (privacy conflicts) → Terms.

13. Contact

privacy@evidentum.ai · legal@evidentum.ai · security@evidentum.ai · Evidentum, Inc. · Address: [to be provided]

Full working draft with Annex I (processing details) and Annex II (security measures): docs/legal/04-dpa.md