Data Processing Agreement (DPA)
This page is a plain-language template drafted for RTFC's pre-launch, invite-only phase. It has not been reviewed by outside counsel; a signed order form or enterprise agreement with its own data processing terms prevails over this page.
This DPA applies whenever a customer submits personal data of its own end users - audio, transcripts, or claim text - for processing by RTFC, and forms part of the agreement between the customer and Faktolumo SAS under Article 28 GDPR.
Roles
The customer is the controller of the personal data it submits. Faktolumo SAS is the processor, processing that data solely to provide the RTFC service and on the customer's documented instructions, given through the customer's use of the API or dashboard, or a signed agreement.
Subject matter, duration, nature and purpose
| Subject matter | Automated fact-checking of audio, transcripts and the claims extracted from them. |
| Duration | For the term of the customer's subscription, plus the retention windows described in the Privacy Policy. |
| Nature of processing | Speech-to-text transcription, claim extraction, automated research, and verdict synthesis, via the providers listed in Subprocessors. |
| Purpose | Providing the fact-checking service the customer has subscribed to. |
| Categories of data | Audio recordings, transcript text, claim text and context, and - where diarization is enabled - voice biometric data (special category, see Privacy Policy). |
| Categories of data subjects | Speakers in the audio or transcript the customer submits - which may include the customer's own end users, or third parties such as broadcast participants, depending on the customer's use case. |
Brand checks (public content of third parties)
The service lets the Customer analyse public videos and captions published by third parties. Those third parties are additional data subjects. The data concerned is their public handle and profile details, the speech and text of their public posts, and the passages that mention a brand. No special category of data is sought, and the Customer must not use the service to infer one (see the Acceptable Use Policy).
The Customer determines the purposes and the accounts analysed, and is responsible for having a lawful basis (typically a legitimate interest balanced against the creator's rights), for any information owed to those persons, and for the decisions taken from the results. Faktolumo processes the data only to run the check and to avoid transcribing the same public video twice, assists the Customer with requests from those persons, and erases the transcripts, scan results and account record of a person on the documented request of the Customer or of that person.
Sub-processors
The customer authorizes Faktolumo to engage the sub-processors listed on the Subprocessors page to provide the service. That page is the current, authoritative list.
We give notice of a new sub-processor by updating that page. A customer that objects to a specific new sub-processor on reasonable data-protection grounds may raise it at contact@faktolumo.eu within 30 days of the update, and we will work in good faith to address the objection, including by not routing that customer's data through the new sub-processor where technically feasible.
Security measures
Faktolumo implements the following measures, among others:
- Token-based authentication (JWT and scoped personal access tokens) on every endpoint, including read endpoints.
- Per-debate ownership checks on every request that touches customer content, so one customer's data is never returned to another.
- An optional field-level encryption key for user data at rest, where configured for the deployment.
- Rate limiting, per-tenant spend ceilings, and an admissions guard that prevents one tenant from starving the shared processing queue.
AI processing and no-training guarantee
The step that extracts claims directly from a customer's raw transcript is restricted to AI providers that contractually commit not to train their models on submitted data - a technical control enforced at the point the model is selected, not merely a policy statement.
This restriction currently covers that one step. The later step that researches and drafts a verdict for an already-extracted claim is not yet restricted to the same no-training pool. A customer for whom this distinction is material should contact us before relying on it as a blanket guarantee.
Assistance with data subject requests
Where technically possible, Faktolumo will assist the customer in responding to a data subject's request to exercise their GDPR rights concerning content the customer submitted, including by executing an erasure request through our own erasure process.
Personal data breach
Faktolumo will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's content, with the information reasonably available at the time, so the customer can meet its own notification obligations.
Deletion or return of data
On termination of the customer's subscription, the customer's content is deleted or anonymized in line with the retention windows described in the Privacy Policy, except for the anonymized, content-free billing records Faktolumo is legally required to retain (see Your rights).
International transfers
See Where data is processed in the Privacy Policy for the current position on sub-processors located outside the EEA.
Audit
On reasonable prior notice, and no more than once per year absent a specific incident, the customer may request evidence of the security measures described above; a full on-site audit is subject to a separate written agreement.
Contact
Questions about this DPA, or to request a countersigned copy for your own records: contact@faktolumo.eu.