Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the agreement between the customer using Runnel (“Customer”) and SOUN L.L.C. (a Delaware limited liability company) (“SOUN,” “Processor”) for the processing of Personal Data through the Runnel service.
1. Roles and definitions
The Customer is the controller of the Personal Data it submits to or collects through Runnel. SOUN is the processor, acting on the Customer’s documented instructions.
- Personal Data — information relating to an identified or identifiable individual that the Customer processes through Runnel.
- Processing — any operation performed on Personal Data.
- Data Subject — the individual the Personal Data relates to (here, primarily crew, talent, and the Customer’s contacts).
- Subprocessor — a third party engaged by SOUN to process Personal Data.
- Applicable Data Protection Law — the data protection and privacy laws that apply to the Customer’s use of Runnel.
2. Subject matter, duration, nature, and purpose
SOUN processes Personal Data to provide Runnel: sending and collecting production paperwork (deal memos, NDAs, W-9s, payment details), delivering signed documents at the Customer’s direction, and the related storage, security, and support. Processing continues for the term of the Customer’s use of Runnel and the periods described in Section 9.
3. Categories of data subjects and Personal Data
Data subjects: the Customer’s crew, talent, and business contacts.
Categories of Personal Data: identity and contact details; deal-memo and NDA signer details (including home address and emergency contact); and, for payment, government identifiers (Social Security or Employer Identification Numbers) and financial account data (bank routing and account numbers), together with uploaded W-9s and receipts. The Customer acknowledges that this includes sensitive government identifiers and financial account data, which materially affects the Customer’s own risk assessment and obligations as controller.
4. Processing on documented instruction
SOUN processes Personal Data only on the Customer’s documented instructions, including as set out in the agreement, this DPA, and the Customer’s configuration and use of Runnel. SOUN does not use the Customer’s crew or talent Personal Data for its own purposes and does not use it to train machine-learning models. If SOUN is required by law to process otherwise, it will inform the Customer unless legally prohibited.
5. Confidentiality
SOUN ensures that personnel authorized to process Personal Data are bound by appropriate obligations of confidentiality.
6. Security measures
SOUN maintains the technical and organizational measures described in Section 6 of the Runnel Privacy Policy (opens in a new tab) — including AES-256-GCM encryption at rest for sensitive submission data, server-side-only handling, HTTPS/TLS in transit, database row-level workspace isolation, least-privilege access to raw identifiers, expiring tokenized links, and tamper-evident signature records. Those measures are incorporated here by reference so the two documents cannot drift apart.
7. Subprocessors
The Customer authorizes SOUN to engage the subprocessors listed in Section 8 of the Runnel Privacy Policy (opens in a new tab). SOUN remains responsible for its subprocessors’ processing. SOUN will make the current list available and will give the Customer notice of an intended change to its subprocessors so the Customer has an opportunity to object.
8. Assistance with data-subject requests
Taking into account the nature of the processing, SOUN will assist the Customer, by appropriate technical and organizational measures, in responding to requests from data subjects to exercise their rights. Runnel provides the Customer with controls to view, download, and permanently erase a crew member’s sensitive identifiers.
9. Personal data breach notification
SOUN will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s Personal Data, and within any period required by applicable law, and will provide information reasonably available to assist the Customer in meeting its own notification obligations.
10. Deletion and return on termination
On termination, and on the Customer’s request, SOUN will delete or return the Customer’s Personal Data, subject to retention required by law and the tamper-evident signature records retained as evidence of executed agreements (which contain no government identifiers or financial account data). Deleting a project or workspace in Runnel permanently deletes its data after the applicable recovery window described in the Privacy Policy.
11. Audit rights
SOUN will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will contribute to audits as required by Applicable Data Protection Law.
12. International transfers
SOUN processes Personal Data in the United States and does not target or knowingly serve data subjects in the EU or UK, so no EU/UK cross-border transfer mechanism (such as the Standard Contractual Clauses) currently applies. If the Customer’s own use brings EU/UK data subjects into scope, the parties will agree the appropriate transfer mechanism in writing.
13. Governing law
This DPA is governed by the laws of the State of Delaware, without regard to its conflict-of-laws principles.
Annex I / II — reserved
Because Runnel operates in the United States only, EU/UK annexes (Standard Contractual Clauses, Annex I processing details, Annex II security measures) are not required today. If a Customer’s use later brings EU/UK data subjects into scope, these annexes will be completed as part of counsel review.