Data Processing Addendum

Version: 3.0
Effective date: November 1, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Sonic Zen, Inc. (doing business as Engage Wisdom, "we," "us," the "Processor") and the client named on the Order Form or account ("you," the "Client," the data controller). That agreement, including this DPA, is the "Agreement." This DPA governs our processing of personal data contained in the content of your collection (that content, "Collection Content"), and it controls over the Terms of Service on data-protection questions. It applies automatically whenever we process personal data in Collection Content on your behalf. Signing an Order Form confirms execution for the record, and it is part of the Agreement for every collection owner, organization or individual. These terms are presented before you accept them and are available to download and keep, in every version you have accepted.

1. Roles and scope

You are the controller of Collection Content; we are your processor. For the data we handle for our own purposes, we are the controller, and this DPA does not apply to that processing. Those purposes are accounts, billing, support, securing the platform, keeping the Service working reliably, preventing abuse, understanding how the Service is used, meeting our own legal obligations, and the platform learning our Privacy Policy describes. Annex A describes the subject matter, duration, nature, and purposes of the processing, the categories of data subjects, and the types of personal data.

2. Processing on your documented instructions

We process Collection Content only on your documented instructions, including regarding transfers, unless Union or Member State law requires otherwise, in which case we inform you of that legal requirement before processing, unless the law prohibits it on important grounds of public interest. For processing the GDPR does not govern, we may also act where other law that applies to us requires it, as the Terms of Service describe in Section 12.

Your instructions are given through: (a) this DPA and the Agreement; (b) your settings in the Service; and (c) Permissions Clearance certifications, the Cleared marks you apply to each Talk, and their withdrawal.

  • Certifications as instructions. When you mark a Talk Cleared, or withdraw a Cleared mark, that certification or withdrawal is your documented instruction for that Talk, and the interface text at the point of certification states what the mark instructs.
  • Who acts for you. The people you give access to your collection act for you under this DPA, within the access your Service settings give them: a certification or instruction given by a person your settings allow to certify for your collection is your documented instruction. You are responsible for granting, changing, and removing that access; the most recent record controls, and we may rely on it until you change it.
  • How we rely. We may rely on the most recent certification made for each Talk in your collection; a change operates prospectively and does not undo processing already performed under the certification then in force.
  • What the Service retains. For each certification, the Service retains the status selected, the person who certified, the timestamp, and the version of the interface text then presented; those records are available to you.
  • Interface-text consistency. The interface text is consistent with the description of Cleared and its withdrawal in Section 3 of the Terms; if it conflicts, that description controls.

If an instruction, in our opinion, infringes the GDPR or other applicable data-protection law, we inform you immediately, and we may suspend the instructed action until it is resolved with you.

3. Special categories

Collection Content may include special categories of personal data: recordings of people speaking about their beliefs, health, or personal lives. Where the GDPR applies to you, you warrant that, for the Collection Content you bring to the Service and for each recording you certify as Cleared, you have identified and can demonstrate a lawful basis under Article 6 and, where special-category data is present, a condition under Article 9(2) for the processing and publication you instruct, and, where you affirmatively elect enhanced learning (Section 12), for the platform-learning disclosure that election permits. We do not independently determine or evaluate your basis; that determination is yours as controller. Nothing in this section limits Section 2's duty to tell you when an instruction appears to infringe the law.

4. Confidentiality

We ensure that persons authorized to process Collection Content are bound by confidentiality obligations, contractual or statutory.

5. Security

We implement the technical and organizational measures described in Annex B (Article 32), taking into account the nature of the processing and the information available to us. Annex B states our non-biometric design commitments: how we build the system, and what we require, contractually, of the providers that process audio for us.

6. Sub-processors

You authorize our use of sub-processors generally, and of each provider on our list, alternates included, from the day you accept this DPA. Our sub-processor list at go.engagewisdom.com/sub-processors names, for each kind of service, the provider we use and any alternate providers we have vetted to the standards of this Section, with each one's location and what it does, and it always shows which provider is in use. The list as it stands when you accept this DPA is part of it.

We may move processing to an alternate already on the list without advance notice; the page shows the change on the day it happens. Before we add a sub-processor that is not on the list, or replace one with a provider that is not on the list, we post the change at least 14 days before the new sub-processor begins processing Collection Content.

Where the GDPR, the UK GDPR, or another law that applies to your collection gives you a right to object, we also email each such change, and each move to a listed alternate, to your notice address. You may then object in writing, on reasonable and material data-protection grounds: to a new sub-processor, within those 14 days; to a move to a listed alternate, within 14 days of our email. Where the Standard Contractual Clauses in Annex D govern your transfer, a new sub-processor that is not on the list does not process your Collection Content while your objection is unresolved. If we cannot offer a workable alternative, you may terminate the affected services and receive a pro-rated refund of prepaid fees.

Where a sub-processor must be replaced promptly for security or service continuity, for reasons outside our reasonable control, and no listed alternate can do the work, we may make the replacement on posting and tell you as soon as we can; your objection right then runs for 14 days from that notice. This paragraph does not apply where the Standard Contractual Clauses in Annex D govern the transfer and require earlier notice.

We impose data-protection obligations on each sub-processor equivalent to this DPA, including the security commitments in Annex B and a prohibition on using Collection Content to train the sub-processor's own models. We remain fully liable to you for their performance.

7. Assisting with data-subject rights

Taking into account the nature of the processing, we assist you with appropriate technical and organizational measures to fulfil your obligation to respond to data-subject requests (Articles 15–22). Requests that reach us about Collection Content are forwarded to you promptly, and we assist you in responding; we do not respond on your behalf unless you instruct it. Compliance copies are free: where data-protection law gives a person, their authorized representative, or you a right that requires a copy of personal data inside Collection Content, including AI-generated materials that contain personal data, we provide the relevant data in a faithful, intelligible, and, where appropriate, structured and machine-readable form at no charge, and within 14 days of your request, or of receiving what we reasonably need to find that data, if that is later; where you tell us the law requires it sooner, we work with you in good faith to meet that date. Publishing Credits price finished Publishing Products (Terms Section 7), never anyone's legal rights.

8. Personal-data breach

We notify you without undue delay after becoming aware of a personal-data breach affecting Collection Content, with the information Article 33(3) requires as it becomes available, and we assist you with your notification obligations. Whether and how to notify authorities and data subjects for Collection Content is your decision as controller; we do not make those notifications unless you instruct it or the law requires us to.

9. DPIA and compliance assistance

We provide reasonable assistance with data-protection impact assessments and prior consultations (Articles 35–36) relating to the processing we perform, including our processing documentation and the technical annexes to this DPA. More broadly, taking into account the nature of the processing and the information available to us, we provide reasonable assistance with your obligations under Articles 32 to 36.

10. Return and deletion at the end of services

At the end of the services, we make the return set below available during the export window and delete the remaining Collection Content as stated, unless Union or Member State law requires storage:

  • Returned free, in structured, machine-readable form, during the export window (30 days): your recordings and files, whether you uploaded them or we imported them for you, your authorized users' saved edits, any Publishing Products we created for you, and the titles, descriptions, notes, and other material you entered, together with your certification records and your collection settings (visibility states, access and membership records, publication and feed settings, and project manifests).
  • Deleted: Transient Renditions, internal working data, and remaining copies after the window (or, for an export you asked for before the window ended, once its download link has been live for at least 14 days), except backup copies, which clear on their normal rotation, and copies we must retain under applicable law or need to establish or defend a legal claim, including certification records and instructions, which we use only for that purpose and delete when it ends. Where the GDPR, the UK GDPR, or the Standard Contractual Clauses apply to your collection, the exception for copies kept under law or for a legal claim is narrower: we keep a copy after the window only where Union, Member State or United Kingdom law requires storage, or where a law that applies to us forbids deletion, and we tell you which law it is.
  • Publishing Products remain available for purchase with Publishing Credits before and during the window; nothing in this section requires us to manufacture them, and nothing in their pricing limits Section 7 of this DPA.

A deletion certificate covering the return and deletion described above is available on request.

In this DPA, "delete" means erasing digital Collection Content and its copies. It never means destroying or disposing of physical original media, such as reels, cassettes, discs, or drives, which the Digitization Addendum governs exclusively.

If you prefer, tell us and we delete everything, including the return set, without waiting for the window to run.

Where data-protection law gives you a right to receive personal data contained in Transient Renditions, including when you elect return under Article 28(3)(g), we provide that data free, as Section 7 describes. A paid Publishing Product is an optional finished format, not the personal data itself.

11. Switching schedule

Where Regulation (EU) 2023/2854 (the Data Act), Chapter VI, applies to the services, this section is the written statement of the switching terms. Switching and retrieval rights under this section belong to customers in the Union; we may reasonably verify Union establishment or residence, and verification never operates as an obstacle to, or a delay of, switching.

  • Exportable data: the complete specification. Exportable data comprises, in a structured, commonly used, machine-readable format:
    • the categories returned free under Section 10: your uploads and the recordings we imported into your collection for you, your authorized users' saved edits, any Publishing Products we created for you, entered material, certification records, and collection settings; and
    • the current AI-generated outputs of your recordings as they exist in the Service at the time of your request: transcripts, captions, translations, summaries, chapter markers, and keywords as stored, and the current audio renditions as stored, at no charge.
  • Exempted from exportable data under Article 25(2)(f), because exporting them would risk breaching our trade secrets, as categories of data specific to the internal functioning of our service, and never so as to impede, delay, or degrade switching: processing intermediates that serve only the Service's internal functioning (raw recognition output and enriched pipeline files that no user-facing feature serves), model states and weights, security-and-integrity data, and delivery-infrastructure renditions (resolution ladders and segmented copies) of content that is exported whole.
  • Periods. Maximum notice to initiate switching: 2 months. Transition period: 30 days; where completing the transition within it is technically unfeasible, we notify you within 14 working days of your request and tell you the alternative period, which will not exceed seven months; you may also extend the transition period once, for a period you consider appropriate. Retrieval window: at least 30 days after the end of the transitional period. After the retrieval period, and once switching is complete, we erase in full all exportable data and all other data generated directly by you or relating to you directly; backup copies clear on their rotation within 180 days and are kept beyond use until they do.
  • Assistance and continuity. You may switch to another provider, move to your own infrastructure, or simply retrieve your exportable data and have the rest erased. We provide reasonable assistance with your switching or exit strategy, act with due care to maintain continuity of the services during the transition, and confirm termination of the affected services once switching completes. We keep a current switching-information page at go.engagewisdom.com/switching that sets out the exportable-data formats and structures, any known limitations, and the information a request should include. During the transition and the retrieval period we tell you of any known risk to the continuity of the services, and we keep your data secure to the standard of Annex B, including while it is transferred.
  • Where our infrastructure sits. The jurisdiction our infrastructure for the Service is subject to, and how we guard against unlawful governmental access to data, are stated at go.engagewisdom.com/switching.
  • The designated channel for notice under this section is office@engagewisdom.com. Notice through that channel is effective on receipt; a clear request that demonstrably reaches us another way is honored from the day a person reads it.
  • Charges. Switching, porting, retrieval and erasure under this section are free of charge. The exportable data itself is never charged for, and Publishing Credits are never required for switching, porting, retrieval, or erasure that the Data Act requires. Standard fees for optional finished products that are not necessary to retrieve the exportable data set (including Publishing Products) are unaffected.
  • Where Chapter VI applies, "exportable data" has the meaning the Data Act gives it, with the categories above as the minimum, and this section does not limit statutory switching or retrieval rights.

12. Platform learning

  • Platform learning is controller-side processing by us, outside this DPA, as the Privacy Policy and the Terms of Service describe.
  • How participation is elected. Whether your collection's eligible Published Content participates, and whether enhanced learning applies, is elected as Terms Section 6 describes, on your Order Form or in your Service settings. The election is made when the collection is set up, and may be changed later as Terms Section 6 describes; participation does not begin unless it is recorded.
  • Enhanced learning in the EU/EEA and UK. Enhanced learning, the separate, affirmative election permitting learning from identifiable Published Content (Terms Section 6), is never a default. We do not offer enhanced learning to a Client established in the EU/EEA or UK, and an enhanced-learning election recorded for such a Client is inoperative.
  • Signals and corrections outside this DPA. Aggregate usage signals that identify no one, and de-identified corrections, are controller-side processing outside this DPA, as the Privacy Policy describes.
  • What an exclusion election is. An exclusion election is a contractual restriction on that processing, not a processing instruction under this DPA; it does not change the role allocation in Section 1, and it operates prospectively.
  • Special-category content. Apart from the names of public figures and historical persons that Terms Section 6 describes, where Published Content contains special-category personal data, it participates in standard learning only after effective de-identification, performed on your documented instruction, as your processor, for the purposes your election states: improving the transcripts, metadata, and renditions of your collection and the Service's features. Where the GDPR or the UK GDPR applies to you, you rely for that instruction on an Article 9(2) condition, such as data the person has manifestly made public or their explicit consent, and your Section 3 warranty covers it. De-identification is effective when the result can no longer reasonably be linked to an individual, judged from our own position, including our access to the published original; once it is effective, the result is no longer personal data and needs no further legal basis. We document our method against that standard.
  • Your warranty reaches your elections. Your Section 3 warranty extends to the disclosure your elections permit.
  • Effect of an exclusion. An exclusion stops new learning from the collection within 30 days; it does not unwind learning already lawfully completed, or require retraining of models already built, except where the law requires otherwise.

13. Audits

We make available the information necessary to demonstrate compliance with Article 28 of the GDPR and with any other data-protection law that applies to your collection: our records, certifications, and summaries of third-party assessments, where available. Where the GDPR or another data-protection law that applies to your collection gives you the right, we also allow for and contribute to audits, including inspections, conducted by you or your mandated auditor. These take place on at least 30 days' written notice, ordinarily at most once per twelve months for each controller, and more often after a personal-data breach affecting your Collection Content or where a supervisory authority requires it. A joint audit may satisfy more than one controller where those controllers agree. Audits are conducted during business hours, without access to other Clients' data, and under confidentiality. You bear our reasonable, documented incremental costs of an audit, except where the audit identifies material noncompliance with this DPA or follows a personal-data breach on our side, in which case we bear the costs attributable to that noncompliance or breach without regard to the cap in Section 16 of the Terms. Material noncompliance means a failure that a supervisory authority has found, or that demonstrably compromises the security or lawfulness of Collection Content; documentary or record-keeping deviations that do not have that effect are not material. Charges are never set at a level that would deter the audit right. Audits ordinarily begin with documentary review of the materials above; inspection follows where they are materially insufficient or a supervisory authority requires it.

14. Transfers

We are a US company; processing occurs in the United States and the countries our sub-processor list states. Where your transfer of Collection Content to us, as your processor, is a restricted transfer under the international-transfer rules of the GDPR, UK data-protection law, or the Swiss Federal Act on Data Protection (FADP) (a "covered restricted transfer"), we rely on the EU Standard Contractual Clauses (Module Two, controller-to-processor), which are incorporated by reference as Annex D with the selections stated there, and, for onward transfers to a provider that is certified, the EU–US Data Privacy Framework. Where the transfer is a covered restricted transfer under UK data-protection law, the UK Addendum to the SCCs applies; where it is one under the FADP, the SCCs apply with the Swiss adaptations stated in Annex D. On reasonable request, we provide information reasonably necessary for your transfer assessment, and we implement supplementary measures that are reasonably necessary, technically and commercially feasible, and within our control, or that we agree with you. If we have reason to believe that a law or practice that applies to us prevents us from meeting the Standard Contractual Clauses, we tell you promptly and help you identify measures to address it. If you decide to suspend the affected transfer, we stop processing the affected Collection Content until compliance is restored, and you may terminate the affected services, with a pro-rated refund of prepaid fees for them.

15. General

Liability under this DPA is subject to the Agreement's limitations, except where data-protection law does not permit that. This DPA lasts as long as we process Collection Content. We may change this DPA as Section 15 of the Terms describes for material changes. On data-protection questions, this DPA controls over the Terms of Service; a signed Order Form controls over both on commercial questions. Nothing in the Agreement limits rights or liabilities under the Standard Contractual Clauses to the extent a limitation would conflict with them.

16. US privacy laws: service provider

For personal information of US residents that we process on your behalf under a state privacy law, we act as your service provider (or processor, as the law names the role):

  • Purpose limitation. You disclose that personal information to us only for limited and specified purposes, and we process it only for the business purposes listed in Annex A under "What we do with Collection Content": digitizing and importing, hosting, remastering, transcribing, translating, summarizing, labelling, indexing for search, supporting editing and redaction, publishing, sharing and distributing where you enable it, producing Publishing Products, exporting, backing up, and de-identifying Published Content for the platform learning your election permits (Section 12).
  • No sale, no sharing, no drift. We do not sell it or share it; we do not retain, use, or disclose it outside our direct business relationship with you; and we do not combine it with personal information from other sources except as the law permits a service provider to do.
  • Same protection, your oversight. We comply with the obligations those laws place on us, and we provide it the same level of privacy protection the law requires of you, and you may take reasonable and appropriate steps, including the audit path Section 13 describes, to ensure we use it consistently with your obligations and to stop and remediate unauthorized use.
  • Notice, certification, flow-down. We notify you if we can no longer meet these obligations, we certify that we understand and will comply with them, and we bind sub-processors to the same restrictions.

"Sell," "share," "business purpose," and "service provider" carry their California Consumer Privacy Act meanings, and this section applies equally under equivalent US state privacy laws.

Annex A: Processing Details

Article 28(3) requires the processing contract to state what is processed, for whom, why, and for how long. This annex is that statement: the data sheet for everything this DPA governs.

  • What we do with Collection Content (the nature of the processing). We digitize and import physical and digital carriers, host, remaster, transcribe, translate, summarize, label with keywords and speaker roles, index for search, support editing and redaction, publish, share, and distribute where you enable it, produce Publishing Products, export, back up, and de-identify Published Content for the platform learning your election permits (Section 12).
  • How long (duration). For the term of the Agreement, plus the export window and the normal backup rotation (and, for copies we must keep under applicable law or need to establish or defend a legal claim, until that need ends, narrowed as Section 10 states where the GDPR, the UK GDPR, or the Standard Contractual Clauses apply to your collection), and, for digitization projects, the project copies the Digitization Addendum describes, until your account closes or, if you ask us in writing to delete them earlier, no later than 30 days after your request (Digitization Addendum, Section 6). Collection Content is transferred to us on a continuous basis, not as a one-off.
  • Why (purpose). To provide the Service to you as the Agreement describes, on your instructions.
  • Whose personal data appears (data subjects). Speakers, teachers, translators, audience members, and other people who appear in or are identified by Collection Content, and your authorized users, insofar as their names, actions, and certifications appear in the collection records we process on your behalf.
  • What kinds of personal data (categories). Voices and images in recordings; names and biographical details spoken in the content or entered as metadata; and, where recordings contain them, special categories of personal data, principally beliefs, and at times health or personal lives, since these are teaching archives (Section 3 applies).
  • Supervisory authority (Standard Contractual Clauses, Annex I, part C). The competent supervisory authority is [the authority of the Member State where you are established], recorded here when the clauses are executed for your transfer; for a covered restricted transfer under the FADP, it is the FDPIC, as Annex D states.

Annex B: Security Measures (Article 32)

These are the technical and organizational measures Section 5 promises, and the source for SCC Annex II at execution.

  • Access. Role-based access control limits who can reach Collection Content, and access is logged.
  • Transit. Content is encrypted in transit.
  • Separation. Production and non-production environments are kept separate.
  • Backups. Backups run and clear on a defined rotation, within 180 days. Any content we are required to delete is removed from longer-term archives.
  • People. Everyone who works with Collection Content is bound to confidentiality (Section 4).
  • Incidents. We follow a written incident-response procedure, available on request.
  • Non-biometric design. Our system is designed and configured so that no durable voiceprints or voice embeddings are created or retained, either by us or, under the contractual commitments we require, by the providers that process audio for us. Voice data used for speaker separation is ephemeral to a single recording, there is no cross-recording voice matching, and speaker roles are inferred from what is said, not from anyone's voice. This is how we build the system, and what we require, contractually, of our providers.
  • Flow-down. Sub-processors that touch Collection Content are bound to measures no less protective than these (Section 6).

Annex C: Sub-processors

Our current sub-processor list is published at go.engagewisdom.com/sub-processors. The list as it stands when you accept this DPA is part of this DPA, and it changes only as Section 6 describes.

Annex D: Standard Contractual Clauses (Our Selections)

For covered restricted transfers identified in Section 14, the applicable SCCs and selections are set out in this annex. The SCCs are a fixed European Commission template (Decision 2021/914) that offers modules and options; this annex records the selections we make, so the executed clauses can be read only one way.

  • Module. Module Two, controller to processor: you export the data, and we import it.
  • Module One is not used for the processor services covered by this DPA. Enhanced learning is not offered to Clients established in the EU/EEA or UK (Section 12), so no controller-to-controller transfer annex arises under this DPA.
  • Docking (Clause 7). Included, so another organization can join the clauses later.
  • Sub-processors (Clause 9(a)). General authorization, with the notice period Section 6 states.
  • Redress option (Clause 11). The optional independent-dispute-body language is not used.
  • Law and forum (Clauses 17 and 18). Irish law governs the clauses, and disputes under them go to the courts of Ireland. A data subject may also bring proceedings in the courts of the Member State where they habitually reside, as Clause 18 provides.
  • The SCCs' own annexes. SCC Annexes I–III are completed from Annexes A–C of this DPA, for each data exporter, and the executed version attaches the operative SCC text in full.
  • How the Clauses are concluded. The Clauses are concluded only for a covered restricted transfer identified in Section 14. Where a Client making such a transfer signs an Order Form, signing it executes the Clauses. For such a Client on an account without a signed Order Form, accepting these terms concludes the Clauses with the Client as data exporter, and the Client's SCC Annex I is completed from Annex A and the acceptance record, and retained in electronic form with that record, which the Clauses permit and which we make available on request. An entity acceding later under the docking clause completes the Appendix and signs Annex I.A, as Clause 7 requires.
  • UK. UK transfers add the ICO's International Data Transfer Addendum to the SCCs (version B1.0), with its Part 1 tables completed from the Order Form or acceptance record, this annex and Annexes A to C (in Table 4, neither Party may end this Addendum under its Section 19), and its Part 2 incorporated in the ICO's alternative form: "Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses."
  • Switzerland. For a covered restricted transfer under the FADP, the Clauses apply with the adaptations the Swiss Federal Data Protection and Information Commissioner (FDPIC) requires for their recognition under Article 16(2)(d) FADP:
    • Supervisory authority (Clause 13). The FDPIC is the competent supervisory authority insofar as the FADP governs the transfer. Where the GDPR also governs it, the authority stated in Annex A supervises that part, in parallel.
    • Governing law and courts (Clauses 17 and 18(b)). Where only the FADP governs the transfer, Swiss law governs the Clauses and disputes between the parties go to the courts of Switzerland. Where the GDPR also governs it, the Clauses apply to the whole transfer to the GDPR's standard, and Irish law and the courts of Ireland apply, as above.
    • Data subjects in Switzerland (Clause 18(c)). The term "Member State" is not read so as to exclude data subjects in Switzerland from bringing proceedings for their rights where they habitually reside, in Switzerland.
    • References to the GDPR. Where only the FADP governs the transfer, references in the Clauses to the GDPR are read as references to the FADP.

Version 3.0, 2026-11-01.