Scope
The DPA applies when a business customer uses DemoTake's cloud features—such as sync, sharing, hosted web recording, cloud rendering or Assist/Director AI—and personal data is processed as part of that. Local recording and editing on a customer's Macs is not processing by us: that data never reaches us.
Roles
The customer is the controller and Sansa Group AB (through Sansavision) is the processor. For account administration, billing and security of our own services we act as an independent controller, as described in our privacy policy.
Processing details
| Subject matter | Providing DemoTake cloud and AI features |
|---|---|
| Duration | The term of the agreement, plus deletion within 30 days after termination |
| Data subjects | Customer users, individuals who appear in content the customer uploads, and viewers of the customer's share links |
| Categories of data | Account identifiers; uploaded and synced takes, exports and metadata, including presenter camera video; recordings uploaded by the customer's scheduled-run runners; share-link statistics (aggregates only); redacted text sent to AI features |
| Special categories | Not intended. Customers should redact or avoid recording such data. |
Our obligations
- Process personal data only on the customer's documented instructions.
- Ensure personnel with access are bound by confidentiality.
- Assist with data-subject requests, DPIAs and prior consultations.
- Notify the customer without undue delay after becoming aware of a personal data breach.
- Delete or return personal data at the end of the service.
- Make available information needed to demonstrate compliance, and allow for reasonable audits.
Security measures
- Local-first architecture: recording content stays on customer devices unless uploaded.
- Automatic redaction of likely secrets before AI processing; minimal-context AI by default.
- Encryption in transit (TLS) and at rest for cloud storage.
- Least-privilege access controls and logging for administrative access.
- Configurable retention for uploaded content; EU placement where available.
See Security for more.
Subprocessors
The customer authorises the subprocessors on our subprocessor list. We give at least 30 days' notice of changes, during which the customer may object.
Transfers
Transfers outside the EU/EEA rely on an adequacy decision or the EU Standard Contractual Clauses (Module 2 or 3, as applicable), incorporated by reference, together with supplementary measures where appropriate.
Requesting the DPA
The signable DPA will be available when cloud features launch. To request a copy, email legal@demotake.my.