1. Parties and scope
This DPA applies when incorporated into a service agreement between the customer and PodMagi’s operator. It concerns personal information in customer media; PodMagi’s own account, billing and inquiry processing is described separately in the Privacy Policy.
Before processing starts, the parties must identify their legal entities and complete a written schedule describing the service, duration, information, people affected, locations, subprocessors, security measures and retention. This public DPA alone is not a completed processing schedule.
2. Processing description
The customer is the organization responsible for the personal information, or acts for the organization that is. PodMagi acts as a service provider and processes information only to carry out the agreed service, on the customer’s documented lawful instructions, including instructions about transfers, unless the law requires otherwise. PodMagi will inform the customer of such a legal requirement unless prohibited.
Processing may include receipt, storage, transcription, editing, generation, export and deletion of video, audio, images, transcripts and related metadata. People affected may include the customer’s staff, presenters, guests and other people in supplied media. Sensitive personal information requires an expressly agreed lawful arrangement.
The customer is responsible for lawful collection, notices, consents and rights to instruct processing. PodMagi will inform the customer if an instruction appears to infringe privacy law.
3. Confidentiality and security
Persons authorized to process the information must be bound by confidentiality. PodMagi must apply security measures appropriate to the sensitivity of the information, the purposes, the quantity and the format, and document the actual controls in the processing schedule, including access, transfer protection, recovery and incident response. Security statements in marketing do not replace that schedule.
4. Subprocessors and transfers
Subprocessors require the customer’s prior specific or general written authorization. With general authorization, PodMagi will notify proposed additions or replacements in advance and allow a reasonable opportunity to object on privacy grounds before use. Unresolved objections must be addressed before the affected processing proceeds.
Subprocessors must be bound by equivalent confidentiality and security duties; PodMagi remains responsible for their performance of those duties. The current entities, services and locations must be listed in the schedule. Where information leaves Québec, PodMagi will give the customer the details it needs to carry out the privacy impact assessment that Québec law requires, and the transfer must be covered by a written agreement with appropriate safeguards.
5. Assistance and incidents
Taking into account the nature of processing and the information available, PodMagi will assist with access, correction and other individual requests, security obligations, confidentiality-incident notifications and privacy impact assessments. Requests received directly will be forwarded unless law requires another response.
PodMagi will notify the customer’s person in charge of the protection of personal information without undue delay after becoming aware of any breach, or attempted breach, of the confidentiality of the customer’s information, and provide available details, consequences and remedial actions, with updates as information becomes available. This does not replace the customer’s own notification obligations to the Commission d’accès à l’information and affected people.
6. Information and audits
PodMagi will provide the information needed to verify compliance with this DPA and allow and contribute to audits or verifications by the customer or an authorized auditor. Reasonable notice, confidentiality and coordination may apply, but must not prevent an audit required by law or an urgent incident.
7. Return and deletion
When the service ends, PodMagi will return or destroy personal information and existing copies at the customer’s choice unless law requires retention, and will not keep the information beyond the agreed service. The agreed schedule must set the operational deadlines, backup expiry and any lawful retention restrictions. Retained backups must remain protected and unavailable for routine use until expiry. Confirmation of deletion is available on request.
Customer media must not be used to train shared or general-purpose models without a separate explicit opt-in and a valid arrangement covering all affected rights. Customer-specific style training requires documented instructions.
8. Law and contact
This DPA is governed by the laws of the Province of Québec and the federal laws of Canada that apply there, including Québec’s Act respecting the protection of personal information in the private sector and, where it applies, PIPEDA. Mandatory privacy obligations prevail over inconsistent general commercial terms.
PodMagi — 80 Rue des Sept Sommets, La Conception, QC J0T 1M0, Canada. Email: support@podmagi.com. Telephone: +1 (514) 838-2128.