This Data Processing Agreement (“DPA”) forms part of, and is incorporated by reference into, the Terms and Conditions between Render Tiger LTD (“RenderTiger,” “Processor,” “we,” or “us”) and the business customer that has agreed to those Terms (“Customer,” “Controller,” or “you”) (together, the “Agreement”). This DPA applies where Customer's use of the Service involves RenderTiger processing personal data on Customer's behalf, such as personal data contained in content Customer or its end users upload to the Service. In the event of a conflict between this DPA and the Terms and Conditions with respect to the processing of personal data, this DPA controls.
1. Definitions
- “Data Protection Laws” means all applicable laws relating to the processing of personal data, including the GDPR, the UK GDPR and Data Protection Act 2018, the CCPA, the ePrivacy Directive, and the Israeli Protection of Privacy Law, 5741-1981 (as amended, including Amendment No. 13), in each case to the extent applicable to the processing under this DPA.
- “Personal Data,” “Processing,” “Controller,” “Processor,” and “Data Subject” have the meanings given in the GDPR, and equivalent terms under other Data Protection Laws are construed accordingly.
- “Customer Data” means personal data that Customer or its end users submit to, or process through, the Service, and that RenderTiger processes on Customer's behalf.
- “Sub-processor” means any third party engaged by RenderTiger to process Customer Data in connection with providing the Service.
- “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data.
2. Roles of the Parties
2.1 The parties agree that, with respect to Customer Data, Customer is the Controller and RenderTiger is the Processor. Customer will comply with its obligations as a Controller under applicable Data Protection Laws, including ensuring it has a valid legal basis for the Customer Data it submits to the Service and any consents or notices required from its own end users.
2.2 RenderTiger will process Customer Data only on documented instructions from Customer, including as set out in the Agreement and this DPA, unless required to do otherwise by applicable law, in which case RenderTiger will inform Customer of that legal requirement before processing, unless the law prohibits this.
3. Nature and Purpose of Processing
3.1 Subject Matter. The provision of the AI-powered video, script, and voiceover generation Service to Customer.
3.2 Duration. For the term of the Agreement, and thereafter as described in Section 8 (Deletion and Return of Data).
3.3 Nature and Purpose. Storing, hosting, and processing Customer Data to generate Outputs, provide Customer's account and Subscription, and otherwise operate the Service as instructed by Customer.
3.4 Categories of Data Subjects. Customer's end users and any individuals whose personal data appears in content uploaded to the Service (for example, individuals depicted in images, video, or audio submitted as Customer Data).
3.5 Categories of Personal Data. Contact and account details, and any personal data contained within uploaded images, video, audio, or text prompts, which may include an individual's name, image, voice, or likeness.
4. RenderTiger's Obligations
- Process Customer Data only in accordance with Customer's documented instructions, unless otherwise required by law;
- Ensure that personnel authorized to process Customer Data are subject to confidentiality obligations;
- Implement appropriate technical and organizational measures to protect Customer Data against unauthorized or unlawful processing, and against accidental loss, destruction, or damage;
- Taking into account the nature of the processing, assist Customer, insofar as reasonably possible, in responding to requests from data subjects seeking to exercise their rights under applicable Data Protection Laws;
- Notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Data, and provide reasonably available information to assist Customer in meeting any notification obligations it may have; and
- Make available to Customer information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, subject to reasonable advance notice, confidentiality, and no more than once per year absent a Security Incident or legal requirement.
5. Sub-processors
5.1 General Authorization. Customer provides general authorization for RenderTiger to engage Sub-processors to assist in providing the Service, provided that RenderTiger imposes data protection obligations on each Sub-processor that are no less protective than those set out in this DPA.
5.2 Current Sub-processors. RenderTiger currently engages the following categories of Sub-processors: (a) BlueSnap, for payment processing; (b) OpenAI, Anthropic, Seedance, and similar providers, for AI-powered content generation; (c) Google, for analytics and advertising services; and (d) hosting and cloud infrastructure providers necessary to operate the Service. RenderTiger will maintain a current list of its Sub-processors and will provide it to Customer upon written request to legal@rendertiger.com.
5.3 Notice of Changes. RenderTiger will provide Customer with reasonable advance notice of the addition or replacement of any Sub-processor, and Customer may object on reasonable data-protection grounds by notifying RenderTiger within fourteen (14) days of such notice. If the parties cannot resolve the objection, either party may terminate the affected portion of the Service.
6. International Data Transfers
Customer Data may be transferred to and processed in Israel, the United States, and other countries where RenderTiger or its Sub-processors operate. Because Render Tiger LTD is established in Israel — a country recognized by the European Commission as providing an adequate level of data protection — transfers of Customer Data from the EEA to Israel do not require additional safeguards beyond that adequacy decision. Where Customer Data is transferred to a country without an equivalent adequacy decision, RenderTiger will implement appropriate safeguards required under applicable Data Protection Laws, such as Standard Contractual Clauses.
7. Confidentiality and Security
RenderTiger will treat Customer Data as confidential and will implement and maintain appropriate technical and organizational security measures designed to protect Customer Data, taking into account the state of the art, the costs of implementation, and the nature, scope, and purposes of the processing.
8. Deletion and Return of Data
Upon termination or expiration of the Agreement, and subject to Customer's Account-deletion process described in RenderTiger's Privacy Policy, RenderTiger will delete or return Customer Data in its possession within a reasonable period, except to the extent applicable law requires RenderTiger to retain some or all of the Customer Data, in which case RenderTiger will isolate and protect that data from further processing.
9. Liability
Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability set out in the Terms and Conditions, which apply to this DPA as if fully set out here.
10. Term and Governing Law
This DPA takes effect on the date Customer agrees to the Agreement and remains in effect for as long as RenderTiger processes Customer Data on Customer's behalf. This DPA is governed by the laws of the State of Israel, and disputes arising under it are subject to the jurisdiction and dispute-resolution provisions of the Terms and Conditions.
11. Contact
Questions about this DPA, or requests for RenderTiger's current Sub-processor list, may be directed to legal@rendertiger.com.