Data processing addendum
Processor terms for customer personal data handled by One Studio.
Roles and instructions
The customer is controller and Sansa Vision is processor for customer personal data. We process only documented lawful instructions necessary to provide One Studio, unless law requires otherwise. The subject matter is product building and operation; duration is the agreement; data types and subjects depend on customer projects.
People and security
Authorized personnel are bound by confidentiality. Controls include least privilege, tenant-scoped authorization, encryption in transit and at rest through platform services, isolated build execution, dependency and secret controls, signed webhooks, logging, backups, and incident response.
Subprocessors
Cloudflare provides compute, D1, R2, KV, email, network security, and logging. Stripe and Link provide Managed Payments. OneClient provides scoped infrastructure orchestration. We remain responsible for processor obligations and will provide notice of material subprocessor changes. Customers may object on reasonable data-protection grounds.
Assistance and incidents
We assist with rights requests, security, impact assessments, and regulator consultation where applicable. We notify customers without undue delay after confirming a personal data breach and provide available facts, likely consequences, and mitigation.
Return, deletion, and audits
At contract end, customers may export data and request deletion. Active data is deleted within 30 days and backups age out within 90 days unless law requires retention. We provide reasonable compliance information and support proportionate audits, subject to confidentiality and security limits.
International transfers
Where required, the EU standard contractual clauses apply using the controller-to-processor module. The customer is data exporter and Sansa Vision is data importer. The security description in this DPA completes the relevant technical measures. Conflicting mandatory privacy terms take priority.