Data Processing Agreement

How to get a signed copy

Definitions

“Controller” means the Customer (the business subscribing to AdZhi) who determines the purposes and means of processing personal data.

“Processor” means AdZhi Ltd, which processes personal data on behalf of the Controller.

“Personal Data” means any information relating to an identified or identifiable natural person processed through the AdZhi service, which may include individuals appearing in or named within ad creative submitted for analysis.

“Services” means the acoustic analysis, transcription, and reporting features of the AdZhi platform.

Scope and purpose

AdZhi Ltd processes personal data to provide the Services described in the subscription agreement. Processing is limited to:

• Transcribing spoken content from video advertisements submitted by the Controller
• Analysing acoustic and linguistic features of that content
• Analysing the video’s visual content: scene, motion and on-screen text across the file, and up to four sampled still frames sent for semantic analysis (see the subprocessor table)
• Producing scores, forecasts and written recommendations from those analyses
• Linking analyses to performance results the Controller supplies or connects from an ad account, to grade forecasts and calibrate them to the Controller’s account
• Storing the original upload for in-report playback while the Controller keeps retention on, and storing analysis results in the Controller’s account

Other than the pooled use of derived numeric data described below, AdZhi does not process the personal data for any purpose other than providing the Services, except as required by law.

Pooled benchmarks and models. Separately from the Services, and on by default with an opt-out in Account → Privacy & data, AdZhi uses numeric feature values and outcome figures derived from analyses to compute shared benchmarks and to improve pooled models. This uses no audio, video, transcripts, frames, filenames or other content, and figures are only used in aggregate behind a k-anonymity floor; the Privacy Policy (Section 5) describes it in full. Where the Controller opts out, its derived data is excluded from this use.

Nature of personal data processed

The personal data processed may include:

• Voice recordings of individuals appearing in submitted advertisements
• Transcripts of spoken content, which may include incidental personal details mentioned in the ad
• Still images of individuals appearing in submitted advertisements (up to four sampled frames per analysis)
• On-screen text in the video, which may include incidental personal details
• Facial presence data (detected, not identified — no facial recognition)

AdZhi does not process special category data, financial data, health data, or government identifiers as part of the Services.

Processor obligations

AdZhi Ltd agrees to:

1. Process personal data only on documented instructions from the Controller
2. Ensure that persons authorised to process the data are bound by confidentiality
3. Implement appropriate technical and organisational security measures (see Section 6)
4. Give the Controller at least 14 days’ notice before engaging a new sub-processor, so any reasonable objection can be raised (the current sub-processors are listed in Section 5 below)
5. Assist the Controller in responding to data subject requests within 5 business days
6. Delete or return all personal data upon termination of the Services
7. Make available all information necessary to demonstrate compliance with this agreement

Sub-processors

AdZhi currently uses the following sub-processors. The Controller consents to these sub-processors by accepting these terms. AdZhi will notify the Controller at least 14 days before engaging new sub-processors.

The hosted transcription fast path is configured, so Personal Data in the form of ad audio is transferred to a US transcription Sub-processor (Groq or OpenAI) in the ordinary course of processing. A local Whisper model on AdZhi’s own infrastructure is the software default and the fallback where that path is disabled. The entries below marked “conditional” depend on a further condition — notably the AssemblyAI fallback, engaged only where transcription confidence is low.

Security measures

AdZhi implements the following technical and organisational measures:

• TLS encryption for all data in transit
• Encryption at rest for database storage
• bcrypt password hashing (cost factor 12)
• Role-based access control — all data scoped to authenticated user
• Per-account control over creative retention — access-controlled storage, with deletion on opt-out and on account deletion
• Signed session tokens with 60-minute expiry
• No application-level employee access to customer content; infrastructure access is restricted and logged

Data retention and deletion

Raw video and audio files are retained by default so the Controller can replay each creative within its report, stored access-controlled to the Controller’s account and encrypted at rest. The Controller may disable retention at any time in Account → Privacy & data, which deletes retained files and deletes subsequent uploads immediately after analysis. Analysis results are retained for the life of the customer account. Upon account deletion, all personal data, including any retained creatives, is deleted within 30 days. The Controller may request deletion of specific analyses at any time via the dashboard or by contacting privacy@adzhi.co.uk.

Data transfers

Data is primarily processed in the US and EU. Where data is transferred outside the UK/EEA, AdZhi relies on Standard Contractual Clauses with sub-processors and/or the sub-processor’s adequacy status. A list of transfer mechanisms is available on request.

Audit rights

The Controller may request evidence of compliance with this agreement by contacting privacy@adzhi.co.uk. For customers requiring formal audit rights, AdZhi will provide written responses to security questionnaires and, where reasonably required, allow third-party audit of relevant controls with 30 days’ notice.

Liability

Each party’s liability under this DPA is subject to the limitations set out in the main Terms of Service agreement.

Governing law

This agreement is governed by English law. Disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

Back to top ↑