Last updated: 2026-10-27
These Data Processing Terms ("DPA") apply when a member uses Depth Studio AI for the purposes of a business — for example a production company managing its crew, cast or clients in a Team or a client session — and in doing so places personal data of other people on the Platform. In that case the business ("Customer") is the controller and Gamze Kamile Akgül ("Supplier", "we") is the processor. Depth Studio AI is operated and supplied by Gamze Kamile Akgül, a sole proprietor registered in the Czech Republic under IČO 22435735, with a registered business address at Pod novým lesem 137/52, Veleslavín, 162 00 Praha 6, Czech Republic. This DPA forms part of the Terms of Use (section 26) and sets out the terms required by Article 28 of Regulation (EU) 2016/679 (GDPR). It does not cover the processing for which we are controller ourselves — account, security and billing data — which is described in the Privacy Policy.
We process the personal data only on the Customer's documented instructions, which are given by this DPA, the Terms of Use and the Customer's use and settings of the Platform, including transfers to third countries as described in section 11. We do not process the data for our own purposes. If we are required by EU or Member State law to process the data otherwise, we inform the Customer before processing, unless that law prohibits it. If we consider that an instruction infringes data protection law, we inform the Customer immediately.
Every person we authorise to process the personal data is bound by confidentiality or is under an appropriate statutory obligation of confidentiality, and has access to the data only to the extent needed to provide the service or support.
We implement technical and organisational measures appropriate to the risk (Art. 32 GDPR), including: row-level access control at the database layer, so that each user sees only the data of the Teams and projects they belong to; encryption in transit (HTTPS/TLS); scoped and time-limited access to stored files; secret management outside the application source code; multi-factor authentication for accounts that enable it; and audit logging of sensitive operations. We review these measures and may update them, provided the overall level of protection is not reduced.
Taking into account the nature of the processing, we assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection), and in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation (Arts. 32–36 GDPR), using the information available to us. If a data subject contacts us directly about data the Customer controls, we forward the request to the Customer and do not answer it ourselves unless the Customer instructs us to.
We notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, with the information then available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We provide further information as it becomes available.
The Customer can download its files and delete its data through the Platform at any time. When the Customer's use of the Platform ends, we delete the personal data processed under this DPA as described in the Privacy Policy — after the 30-day grace period that applies to account deletion — unless EU or Member State law requires us to keep it. Before deletion the Customer can download its content. Copies held by our AI gateway provider are deleted on its fixed schedule (generated files 14 days, task logs 2 months) and cannot be deleted earlier.
We make available to the Customer the information necessary to demonstrate compliance with this DPA and Article 28 GDPR, in the first place in writing. Where that is not sufficient, we allow and contribute to audits, including inspections, by the Customer or an auditor it mandates who is bound by confidentiality, on at least 30 days' notice, no more than once a year except after a breach, during normal business hours and at the Customer's cost.
Some sub-processors are located outside the European Economic Area (see the annex). Where personal data is transferred to them, the transfer is based on an adequacy decision of the European Commission, including the EU–U.S. Data Privacy Framework for certified recipients, or on the Standard Contractual Clauses adopted by the European Commission, together with measures such as encryption in transit and minimisation of the data transmitted. The exception is our AI gateway provider, which offers no such safeguard (see the annex); before placing images, video or voices of real people on the Platform, the Customer should take this into account.
Liability under this DPA is governed by the Terms of Use, except where Article 82 GDPR or other mandatory law provides otherwise. If this DPA conflicts with the Terms of Use on the processing of personal data, this DPA prevails. This DPA is governed by the same law as the Terms of Use.
Payment providers are not sub-processors under this DPA: for a purchase they act as independent controllers or, where they sell as merchant of record, as the seller (Privacy Policy, section 5).
Depth Studio AI is operated and supplied by Gamze Kamile Akgül, a sole proprietor registered in the Czech Republic under IČO 22435735, with a registered business address at Pod novým lesem 137/52, Veleslavín, 162 00 Praha 6, Czech Republic.
Data protection contact: [email protected]