Data Processing Agreement

Effective from 17 Sept 2026 · version 1.1

PastierAI: Annex to the Terms of Use

This Data Processing Agreement (“DPA”) supplements the Terms of Use of the PastierAI service (“Terms of Use”) and forms an integral part of them, in the same way as the Privacy policy (Terms of Use, Section 17). It applies whenever, in using the Service, you submit to us personal data of a third party for which you determine the purposes and means of processing.

By registering for or using the Service, you accept this DPA at the same time and in the same manner as the Terms of Use (Terms of Use, Section 5); no separate signature is required. If you need a separately countersigned copy for your own compliance records, write to assistant@fameplay.ai.

1. Parties and definitions

Processor (“we”, “us”, the “Operator”): Czech Video Center a.s., Company ID 09839194, registered seat U garáží 1611/1, Holešovice, 170 00 Praha 7, Czech Republic, operator of the PastierAI service (pastierai.com).

Controller (“you”, the “User”): the business entity that has accepted the Terms of Use and, through its use of the Service, submits personal data of third parties for which it acts as controller within the meaning of Art. 4(7) GDPR.

Service, Output, Your content: as defined in Section 2 of the Terms of Use.

Data Protection Legislation: Regulation (EU) 2016/679 (GDPR), Czech Act No. 110/2019 Coll. on the processing of personal data, and any other directly applicable EU or Czech law on the protection of personal data.

Personal Data, Data Subject, Processing, Special Categories of Personal Data: as defined in Art. 4 and 9 GDPR.

Sub-processor: another processor engaged by us to process personal data on your behalf.

Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed under this DPA.

2. Subject matter, duration and nature of processing

This DPA governs our processing, as processor, of personal data contained in Your content (the voice conversations, text messages and uploaded documents you submit to the Service) where that data relates to third parties (for example, your own customers, prospects, employees or other individuals) and you act as controller of it. Full details of the subject matter, duration, nature, purpose, and categories of data subjects and personal data are set out in Annex 1.

This DPA does not cover our processing of your own account and registration data, or your own use of the Service, where we act as controller; that processing is described in the Privacy policy.

We process personal data under this DPA for as long as the Terms of Use are in force between us, and thereafter for the retention periods set out in Section 8 of the Privacy policy, after which the data is deleted or irreversibly anonymised.

3. Your instructions and responsibilities

We process personal data only on your documented instructions. The Terms of Use, this DPA, and your ordinary use of the Service's functionality (holding a conversation, uploading a document, and the settings you choose) are your instructions to us. Any further instruction must be given in writing to assistant@fameplay.ai; if it changes the nature of the Service, we may charge for it or decline it, and we will tell you if we consider an instruction to infringe Data Protection Legislation.

You confirm and warrant that:

• you have a valid legal basis for submitting any third-party personal data to the Service, and, where required by applicable law (including rules on the recording of calls and electronic communications), you have given the necessary notices to, or obtained the necessary consent from, the data subjects concerned before doing so;
• you will not submit special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR) unless you have an independent, valid legal basis and, where required, appropriate additional safeguards for doing so;
• the content you submit and the way you use the Service do not infringe the rights of the data subjects concerned or any applicable law.

This mirrors, and does not replace, the representations you make under Section 8 of the Terms of Use.

4. Our obligations

We will:

• process personal data only on your documented instructions, including with regard to transfers to a third country, unless required to do otherwise by EU or Czech law, in which case we will inform you before processing, unless that law prohibits this;
• ensure that everyone authorised to process the data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality;
• implement the technical and organisational measures described in Annex 2, appropriate to the risk, in accordance with Art. 32 GDPR;
• respect the conditions in Section 5 for engaging another processor;
• taking into account the nature of the processing, assist you by appropriate technical and organisational measures, insofar as this is possible, with fulfilling your obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR;
• assist you in ensuring compliance with your obligations under Art. 32–36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the nature of the processing and the information available to us;
• at your choice, delete or return to you all personal data processed under this DPA after the end of the provision of the relevant Service, and delete existing copies, unless EU or Czech law requires us to keep the data (see Section 8 of the Privacy policy for the retention periods that then apply);
• make available to you the information reasonably necessary to demonstrate our compliance with Art. 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on the terms in Section 6;
• inform you promptly if, in our opinion, an instruction you give infringes GDPR, Czech Act No. 110/2019 Coll., or another data protection provision.

We do not use the content you or your data subjects submit to the Service to train our own or any third party's language models; processing of that content is limited to providing the Service. This is a binding processing instruction under this DPA, not merely a policy statement.

5. Sub-processors

You give us general written authorisation to engage the sub-processors listed in Annex 3 to help us provide the Service, and to add or replace a sub-processor provided that we notify you in advance under Section 14 of the Privacy policy (at least 15 days before a material change takes effect, other than where a shorter notice is required to address an urgent security or legal issue).

If you have reasonable data-protection grounds to object to a new sub-processor, tell us within 15 days of our notice; we will work with you in good faith to find a solution, which may include not making the change for you, or, if none is found, either party may terminate the affected part of the Service without penalty.

Where we engage a sub-processor, we impose on it, by contract, the same data protection obligations that apply to us under this DPA, in particular to provide sufficient guarantees to implement appropriate technical and organisational measures. We remain fully liable to you for a sub-processor's performance of its obligations.

The current list of sub-processors is always the one in Annex 3, mirroring Section 6 of the Privacy policy.

6. Audits

We will provide you, on request, with this DPA, its Annexes, a summary of our technical and organisational measures, and, where available, relevant certifications or independent audit reports of our sub-processors.

If that information does not satisfy a specific, documented compliance need of yours, you may carry out an on-site or remote audit yourself or through an independent auditor bound by confidentiality, at your own cost, no more than once every 12 months (or more often if required by a supervisory authority or following a Security Incident), on at least 30 days' written notice, during business hours, and without disrupting our operations or those of our sub-processors or compromising the security of other customers' data.

7. International transfers

Some of our sub-processors process personal data in the United States or other countries outside the European Economic Area. We only allow this where the transfer is covered by an adequacy decision (in particular the EU–US Data Privacy Framework, where the recipient is certified), or by Standard Contractual Clauses adopted by the European Commission, supplemented, where our transfer impact assessment shows it is necessary, by additional technical and organisational safeguards. This mirrors Section 7 of the Privacy policy, which describes the mechanism used for each provider; Annex 3 states the mechanism per sub-processor.

We will provide you, on request, with a copy of the relevant safeguards. If your own supervisory authority or internal policy requires you to be a direct signatory to Standard Contractual Clauses for this processing, tell us at assistant@fameplay.ai and we will provide the appropriate module for signature.

8. Security Incidents and data subject requests

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a Security Incident affecting personal data processed under this DPA, with the information available to us at the time, and will keep you updated as our investigation progresses, so that you can meet your own obligations under Art. 33 and 34 GDPR.

If a data subject contacts us directly to exercise a right regarding data for which you are the controller, we will tell them to contact you, forward the request to you without undue delay, and give you reasonable assistance in responding, without ourselves granting or refusing the request.

9. Liability

Nothing in this DPA limits either party's liability that cannot be limited under mandatory law, including liability under Art. 82 GDPR towards data subjects, or liability for damage caused intentionally or by gross negligence.

Subject to that, liability between us under this DPA is subject to the same limits, exclusions and, where applicable, caps as set out in Section 12 of the Terms of Use.

10. Term and termination

This DPA takes effect when you accept the Terms of Use and remains in force for as long as we process personal data on your behalf under it. It ends automatically when the Terms of Use end (Section 13), except for provisions which by their nature are meant to survive, in particular confidentiality, liability, deletion or return of data, and the record-keeping needed to demonstrate compliance.

11. Relationship with the Terms of Use

This DPA is an integral part of the Terms of Use, in the same way as the Privacy policy (Terms of Use, Section 17). If there is a conflict between this DPA and the Terms of Use regarding the processing of personal data, this DPA prevails; on all other matters, the Terms of Use prevail.

We may update this DPA, in particular when the Service, our sub-processors, or Data Protection Legislation change. We will notify you of a material change by e-mail or in the Service, at least 15 days before it takes effect, in the same way as changes to the Terms of Use (Section 16).

12. Governing law and disputes

This DPA is governed by the law of the Czech Republic, excluding its conflict-of-law rules, and disputes are resolved as set out in Section 15 of the Terms of Use.

13. Final provisions

If a provision of this DPA is found invalid or unenforceable, the rest remains in force, and the invalid provision is replaced by one closest to its intended meaning. Our failure to exercise a right is not a waiver of it. We may transfer our rights and obligations under this DPA together with a transfer of the operation of the Service, as described in Section 17 of the Terms of Use.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

Mirrors Section 10 of the Privacy policy.

• Encryption in transit: TLS/HTTPS for all data transmitted between the user's browser and our servers.
• Encryption at rest: the account database is encrypted with AES-256 by the database provider; audio recordings, transcripts and uploaded documents are stored by the voice provider under its own SOC 2 certified security programme.
• Credential protection: passwords stored only as cryptographic hashes.
• Access control: server-side authentication for all API calls; row-level security so a user can access only data belonging to their own account; sensitive identifiers issued only after server-side verification.
• Access management: access to personal data and conversation recordings limited to authorised personnel on a need-to-know basis, bound by confidentiality, through protected administrator accounts with the providers; technical access logs are kept by the providers under their own security programmes.
• Backup and business continuity: the account database runs on the database provider's managed infrastructure with its own storage redundancy. The plan we currently use does not include automated daily backups, which is why the account database holds registration data only; conversation content is held by the voice provider under the retention periods in Section 8 of the Privacy policy. Hosting and voice-processing infrastructure are operated by the sub-processors listed in Annex 3 under their own redundancy and continuity arrangements.
• Vulnerability management: regular updates of software dependencies; infrastructure-level patching and hardening managed by the sub-processors listed in Annex 3 as part of their certified security programmes.
• Sub-processor due diligence: sub-processors are selected only where they offer an Art. 28 GDPR data processing agreement and a valid Chapter V transfer mechanism (DPF certification, or SCCs supported by a transfer impact assessment), and their certification status is reviewed before engagement and periodically thereafter.
• Breach response: an internal process to detect, assess and notify Security Incidents without undue delay, including notification of the competent supervisory authority within 72 hours where required by Art. 33 GDPR.

Annex 3: Sub-processors

Mirrors Sections 6–7 of the Privacy policy. We will keep this list current and notify you of changes under Section 5 of this DPA. DPF certification statuses verified on 16 September 2026 at dataprivacyframework.gov.

Company

Czech Video Center a.s.

Registered seat

U garáží 1611/1, Holešovice, 170 00 Praha 7

Company ID

09839194

Tax / VAT ID

CZ09839194

E-mail

assistant@fameplay.ai