Data Processing Agreement

Last updated: 6 September 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the customer who holds a Whoosh account (“Customer”, the controller) and RSW Digital Ltd (company no. 08499015), 3 The Mill, High Street, Stourbridge, England, DY8 4FA (“”, the processor). It applies whenever processes personal data on the Customer’s behalf under the GDPR, the UK GDPR or the Swiss FADP. No signature is needed: the DPA is accepted by using the service. Customers who need a countersigned copy can request one at support@whoosh.video.

1. Subject matter and duration

processes personal data to provide the video collection service described in the Terms: hosting campaign pages, receiving video recordings and the details a respondent enters, storing them, making them available to the Customer, producing highlight reels, sending notification emails and, when the Customer enables it, copying files to the Customer’s own cloud storage. Processing lasts for the term of the Customer’s account plus the deletion period in section 9.

2. Nature and purpose

Storage, transmission, transcoding, display and deletion of video and associated data, solely so that the Customer can collect and use video responses. does not use Customer data to train machine-learning models and does not sell it.

3. Categories of data subjects

People who record a video through a Customer campaign link (candidates, customers, students, attendees, employees, members of the public), Customer staff who administer the account, and people who appear in uploaded footage.

4. Categories of personal data

Video and audio recordings, including facial images and voice; names, email addresses and free-text answers entered by respondents; star ratings; technical data such as IP address, browser type and timestamps; Customer account and billing contact details. Special category data may appear in what a respondent chooses to say on camera. The Customer is responsible for the lawful basis for collecting it.

5. Customer instructions

processes personal data only on documented instructions from the Customer. The Terms, this DPA and the settings the Customer chooses in the dashboard (retention, cloud storage, translation, integrations) are those instructions. will inform the Customer if, in its opinion, an instruction infringes data protection law.

6. Confidentiality and security

Staff with access to Customer data are bound by confidentiality obligations. maintains the technical and organisational measures in Annex 2, including encryption in transit (TLS 1.2 or higher), encryption at rest for the database and stored credentials, access controls based on least privilege, nightly encrypted backups with 30-day retention, and logging of administrative access.

7. Sub-processors

The Customer authorises the sub-processors listed on the sub-processor page. will publish changes there at least 14 days before a new sub-processor handles Customer data. The Customer may object in writing within that period; if the objection cannot be resolved, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees. remains liable for its sub-processors’ performance.

8. Data subject rights and assistance

forwards requests it receives from data subjects to the Customer without undue delay and helps the Customer answer them through dashboard tools (view, download, rename, delete and restore recordings) and, where needed, manual assistance. also assists with data protection impact assessments and prior consultations to the extent the information is available to it.

9. Deletion and return

The Customer can delete campaigns and recordings at any time; deleted items stay in the recycle bin for 30 days and are then purged. When an account is closed, deletes all Customer data within 30 days, except where retention is required by law. Backups age out within a further 30 days. On request before closure, the Customer can export recordings through the dashboard or the API.

10. Personal data breach

notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer data. The notice describes the nature of the breach, the likely consequences, the measures taken and a contact point. Notices go to the account owner’s email address.

11. Audits

makes available the information needed to demonstrate compliance with this DPA, including this document, the sub-processor list and a summary of security measures. Once a year, or after a breach, the Customer may conduct an audit at its own cost, on 30 days’ notice, during business hours and without disrupting other customers. Where holds a third-party certification or report, it may satisfy the audit by providing it.

12. International transfers

Customer data is hosted in the region shown on the sub-processor page. Where personal data leaves the EEA, the UK or Switzerland, the transfer relies on the European Commission’s Standard Contractual Clauses (Module 2, controller to processor), the UK International Data Transfer Addendum and, for Swiss data, the FADP amendments, which are incorporated into this DPA by reference.

13. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.

Annex 1: processing details

Controller: the Customer. Processor: RSW Digital Ltd (company no. 08499015), 3 The Mill, High Street, Stourbridge, England, DY8 4FA. Contact: support@whoosh.video. Frequency: continuous for the term. Data, subjects and purpose: sections 1 to 4 above. Retention: section 9.

Annex 2: technical and organisational measures

Encryption in transit (HTTPS/TLS) for every page, upload and API call. Database and stored credentials encrypted at rest; cloud storage tokens encrypted with a key held outside the database. Authentication through a dedicated identity provider with passwordless and social login; role-based access inside the product (owner, expert, pro, free plans; system administrators separate). Signed, expiring share links for recordings. Rate limiting on public endpoints. Soft delete with a 30-day recycle bin, then permanent removal. Nightly encrypted backups retained for 30 days. Structured logging with error alerting; secrets never written to logs. Vulnerability fixes deployed through a reviewed continuous-integration pipeline.