Data Processing Addendum.

Data Processing Terms

You are the controller and Good Creative Media is the processor for personal data in the content you upload; sub-processors are listed in the Privacy Policy. We process personal data only on your documented instructions and do not use your content to train AI models. Personnel with access are bound by confidentiality obligations that survive termination. Security measures include encryption in transit and at rest, access controls and MFA, logging and audit trails, vulnerability management, and incident response. You authorize the listed sub-processors; we give 30 days’ notice of changes with a right to object, and each sub-processor is bound by terms no less protective than this Addendum, with us remaining responsible for their performance. We assist with data-subject requests, notify you of a personal data breach without undue delay and within 72 hours of awareness, provide information for your assessments, and allow a limited annual audit on 30 days’ notice. On termination we return or delete personal data at your election, with certification, except data we are legally required to retain. We incorporate Standard Contractual Clauses for transfers outside the EEA or UK. This Addendum governs conflicts on data protection.