Privacy Policy

Effective 28 April 2026

This Privacy Policy (“Privacy Policy”) governs the use of Services provided by the Invideo entity identified in the applicable Order Form (“Invideo”) to the customer identified in that Order Form (“Customer”).

This Privacy Policy forms part of, and is incorporated by reference into, the Master Services Agreement (“MSA”) and applies to all access to and use of the Services under the MSA, including by Affiliates and Authorised Users.

Capitalised terms used in this Privacy Policy but not defined here shall have the same meaning as ascribed to them in the MSA.

1. Scope of This Privacy Policy

1.1 This Privacy Policy sets out the terms agreed between Invideo and Customer in relation to the handling of Personal Data in connection with the Services, in circumstances where Invideo acts as an independent controller or equivalent.

1.2 This Privacy Policy applies to the processing of Personal Data by Invideo in the following circumstances:

1.2.1 Personal Data relating to Customer, its Affiliates and its Authorised Users and other business contacts provided to Invideo in connection with an Order Form, account administration or the negotiation or performance of the Agreement (“Business Contact Data”).

1.2.2 Personal Data associated with accounts of Authorised Users used to administer access to the Services (“Account Data”).

1.2.3 Personal Data included in Usage Data and System Data generated by or on behalf of Invideo in connection with the provision, operation, protection and improvement of the Services, to the extent such Usage Data or System Data constitutes Personal Data (“Operational Data”).

1.2.4 Personal Data included in communications exchanged between Invideo and Customer in connection with support and other interactions governed by the Support Policy (“Support Interaction Data”).

1.3 This Privacy Policy does not apply to Customer Personal Data included in Customer Data or Customer Content that Invideo processes on behalf of the Customer as described in the DPA and MSA. Such processing is governed by the DPA.

1.4 Where required under Applicable Data Protection Laws, Invideo processes Personal Data described in this Privacy Policy on one or more of the following legal bases: (a) as necessary to perform the Agreement; (b) to comply with legal obligations under Applicable Laws; (c) for Invideo’s legitimate business interests, including operating, securing and improving the Services, provided such interests are not overridden by the rights of Data Subjects; and (d) where applicable, based on consent.

2. Categories of Personal Data

2.1 Business Contact Data may include names, professional titles, business contact details (such as email address, postal address and telephone number), and information relating to the Customer’s organisation and role, as provided in Order Forms.

2.2 Account Data may include identifiers associated with Customer’s accounts and Authorised Users, such as usernames, authentication credentials and role or permission information required to administer access to the Services.

2.3 Operational Data may include elements of Usage Data and System Data that relate to an identifiable individual, such as device identifiers, IP addresses, session identifiers, configuration data, feature usage and other analytics and diagnostic information generated in connection with the use and operation of the Services.

2.4 Support Interaction Data may include the contents of communications with Invideo’s support personnel, metadata associated with support requests and any information voluntarily provided to Invideo in the course of receiving support, as described in the Support Policy.

3. Purposes of Processing

Invideo will process the Personal Data within the scope of this Privacy Policy for the following purposes:

3.1 To create, maintain, and administer Customer accounts and Authorised Users, verify identity and authorisation, manage billing and invoicing, and communicate with Customer and Authorised Users regarding the Agreement and Services.

3.2 To operate, maintain, and support the Services in line with the MSA and SLA, including monitoring performance and availability, resolving incidents, and enhancing the Services. Aggregated or de-identified Usage and System Data may be used for analytics, quality assurance, security, and product improvement, consistent with the Agreement and Applicable Data Protection Laws.

3.3 To safeguard the Services, detect and respond to security incidents or misuse, enforce compliance with the Agreement and AUP, and meet legal or regulatory obligations, including trade controls and sanctions.

3.4 To respond to support requests, manage Customer and Authorised User interactions under the Support Policy, and maintain legitimate business communications with Customers and prospects where permitted by Applicable Data Protection Laws.

3.5 Where the Services include AI or similar technologies, to operate and monitor these features and use Operational Data to evaluate and improve their performance, reliability, and safety. Such processing supports Service functionality and does not use Customer Personal Data to train general models for other customers, except as expressly permitted or using aggregated/de-identified data. Invideo may also assist Customers in implementing AI-related transparency or safeguard measures required under Applicable Data Protection Laws or the AUP.

3.6 When acting as an independent controller, Invideo will comply with Applicable Data Protection Laws and will not “sell” or use Personal Data for targeted advertising, except where explicitly allowed under law.

3.7 Invideo does not perform automated decision-making that produces legal or similarly significant effects. AI-enabled features operate as assistive tools only. Customers remain responsible for reviewing and validating Outputs before use.

4. Disclosure of Personal Data

4.1 Invideo may disclose Personal Data processed under this Privacy Policy to:

4.1.1 service providers engaged by Invideo to support the operation of the Services and Invideo’s business (including hosting, customer support, communications, analytics and billing), subject to contractual obligations requiring confidentiality and appropriate security measures consistent with the Agreement;

4.1.2 Affiliates of Invideo involved in the provision, support or marketing of the Services, as reflected in the Agreement and relevant Order Forms; and

4.1.3 competent authorities or other third parties, where Invideo reasonably considers that disclosure is required to comply with applicable law, regulation or legal process, or to protect the rights, property or safety of Invideo, Customers, Authorised Users or third parties, in each case in accordance with any applicable confidentiality obligations in the Agreement.

4.2 Invideo does not “sell” or “share” Personal Data for targeted advertising purposes as those terms are defined under Applicable Data Protection Laws, except as permitted by such laws.

5. Cookies and Technical Mechanisms

5.1 In connection with the Services and Invideo-controlled web interfaces, Invideo may use cookies, software development kits and similar technical mechanisms (“Cookies”) to support authentication, maintain sessions, record certain configuration or preference information, and collect Operational Data for the purposes described in Section 3 of this Privacy Policy.

5.2 Where required by Applicable Data Protection Laws, Invideo will implement appropriate mechanisms to allow end users to provide consent for non-essential Cookies and manage preferences. Additional information regarding Cookies, including categories, purposes and retention, may be made available through a separate cookie notice or banner.

6. International Transfers

6.1 Personal Data processed under this Privacy Policy may be transferred to and processed in countries where Invideo or its relevant service providers or Affiliates operate, including jurisdictions outside the country in which the Personal Data was originally collected, as reflected in the Agreement and applicable Order Forms.

6.2 Where required by Applicable Data Protection Laws, Invideo will implement appropriate safeguards in respect of such transfers.

7. Retention

7.1 Invideo will retain Personal Data processed under this Privacy Policy for periods consistent with the purposes set out in this Privacy Policy, the Agreement and the Applicable Data Protection Laws.

7.2 In determining appropriate retention periods, Invideo considers factors such as the nature and sensitivity of the Personal Data, the purposes for which it is processed, contractual obligations, and applicable legal, regulatory, accounting or reporting requirements.

8. Data Subject Requests

8.1 To the extent required under Applicable Data Protection Laws, Data Subjects/Data Principals whose Personal Data falls within the scope of this Privacy Policy may have the right to:

8.1.1 access and obtain a copy of their Personal Data;

8.1.2 request correction or rectification of inaccurate or incomplete Personal Data;

8.1.3 request deletion or erasure of Personal Data;

8.1.4 restrict or object to certain processing activities;

8.1.5 request portability of their Personal Data; and

8.1.6 lodge a complaint with a competent data protection authority.

8.2 Invideo will respond to such requests in accordance with Applicable Data Protection Laws. Requests may be submitted using the contact details provided in Section 11 of this Policy.

9. Security Measures

9.1 Invideo will maintain appropriate technical and organisational measures designed to protect Personal Data processed under this Privacy Policy against unauthorised or unlawful processing and against accidental loss, destruction or damage. Further information regarding Invideo’s security measures and third-party audits may be made available to Customer in accordance with the Agreement.

10. Updates

10.1 Invideo may update this Privacy Policy from time to time. Any updates that materially affect the processing of Personal Data within the scope of this Privacy Policy in connection with the Agreement will be notified to Customer in accordance with the MSA.

11. Contact Information

11.1 For any questions, concerns or requests relating to this Privacy Policy or the processing of Personal Data, you may contact Invideo at: privacy@invideo.io

11.2 Where required under Applicable Data Protection Laws, Invideo will designate a data protection officer or grievance officer, whose details will be made available upon request or through Invideo’s website.

11.3 Where required under Applicable Data Protection Laws, Invideo will publish the contact details of its designated grievance officer, including name and contact information, on its website.

12. Children’s Data

12.1 The Services are not directed to individuals under the age of 18 (or such other age as required under Applicable Data Protection Laws). Invideo does not knowingly collect Personal Data from children. If Invideo becomes aware that such data has been collected, it will take appropriate steps to delete it.

13.1 The Services may contain links to or integrations with third-party websites or services. Invideo is not responsible for the privacy practices of such third parties, and this Privacy Policy does not apply to their processing activities. Users are encouraged to review the privacy policies of such third parties.