Data Processing Addendum

ACRCloud PTE. LTD.
Effective date: October 20, 2026
Last updated: October 20, 2026

This Data Processing Addendum (“DPA”) describes how ACRCloud processes Personal Data on a Customer’s documented instructions when providing the Services. It forms part of the ACRCloud Terms of Use and any applicable order or subscription.

1. Definitions and scope

“Customer Personal Data” means Personal Data contained in Customer Content, Derived Data, or project-related Service Data that ACRCloud processes on Customer’s behalf. “Personal Data,” “Controller,” “Processor,” “Data Subject,” and “Processing” have the meanings given by applicable data-protection law. “Services Agreement” means the ACRCloud Terms of Use, the applicable order, and any plan or subscription governing the Services.

This DPA applies when Customer is a Controller (or Processor acting for another Controller) and ACRCloud processes Customer Personal Data to provide the Services. If this DPA conflicts with the Services Agreement on the processing of Customer Personal Data, this DPA controls. The order controls service-specific details and commercial terms.

For the retention schedule in Section 8, “Business Data” means Customer’s service-specific project data, fingerprints, Customer-provided metadata, uploaded-file records, monitoring streams and configurations, recognition results and other service results. Account and authentication data and technical, access, security and login logs are listed separately in that schedule. These distinctions do not limit Customer’s self-service deletion rights under Section 7.

2. Roles and instructions

Customer acts as Controller and ACRCloud acts as Processor for Customer Personal Data processed on Customer’s behalf. ACRCloud may act as an independent Controller for account administration, billing, security of its own systems, direct business communications, and operation of its public website; those activities are described in the ACRCloud Privacy Policy and are outside this DPA.

Customer instructs ACRCloud to process Customer Personal Data as necessary to provide, secure, maintain, and support the Services selected by Customer, including the processing described in the applicable order and Section 12. ACRCloud will process Customer Personal Data only on those documented instructions, unless applicable law requires otherwise. Where legally permitted, ACRCloud will inform Customer of such legal requirement before processing. ACRCloud will inform Customer if it believes an instruction infringes applicable data-protection law, unless law prohibits that notice.

3. Customer responsibilities

Customer is responsible for the lawfulness, accuracy, quality, and means of collecting Customer Personal Data; determining and documenting an appropriate legal basis; giving required privacy notices; obtaining required permissions and consents; and responding to Data Subject requests. Customer will ensure that its instructions and use of the Services comply with applicable law.

Audio or video submitted to a Service may contain a person’s voice, image, or other Personal Data. Customer must inform affected individuals where required. Customer may submit children’s data, including children’s voices, only where the applicable Service and a written order expressly authorize that processing, and Customer has obtained all notices, permissions, parental authorizations, and lawful bases required by law. This DPA does not itself make Customer’s collection or use of children’s data lawful, or authorize ACRCloud to solicit Personal Data directly from children.

Customer must not submit special-category Personal Data, biometric-identification data, or other sensitive data unless the applicable Service and a written agreement expressly permit it.

4. ACRCloud obligations

ACRCloud will:

• ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations;
• maintain appropriate technical and organizational measures as described in Section 12 and the Services Agreement;
• engage subprocessors in accordance with Section 5;
• taking into account the nature of Processing and information available to ACRCloud, reasonably assist Customer with Data Subject requests and Customer’s security, impact-assessment, and regulator-consultation obligations under applicable law;
• notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide information about the incident as it becomes available; and
• make information reasonably necessary to demonstrate compliance with this DPA available to Customer under Section 10.

5. Subprocessors

Customer gives ACRCloud general written authorization to use subprocessors for hosting, security, support, billing, and other functions needed to provide the Services. ACRCloud will impose data-protection obligations on each subprocessor that are no less protective than the applicable obligations in this DPA and remains responsible for its subprocessors’ performance.

The current subprocessor summary, processing locations and provider-specific transfer safeguards are set out below and in Section 6. This summary covers the ACRCloud Console, File Scanning API, Broadcast Monitoring and Music Recognition services. For information about processing arrangements for another Service, contact support@acrcloud.com.

These providers process data under documented instructions and applicable data processing agreements with confidentiality, security and data-protection obligations. Customer Content and Customer-specific Derived Data are not provided to them for model training. For an on-premises or air-gapped Docker deployment, locally processed Customer Content is not processed by these cloud subprocessors; any licence or update-distribution activity is separate from that local content processing.

ACRCloud will notify Customer of an intended material addition or replacement by email or through the Console at least 30 days in advance where reasonably practicable. Customer may object within 15 days after notice on reasonable data-protection grounds by contacting ACRCloud. The parties will work in good faith to address the objection. If they cannot resolve it, Customer may stop using and terminate the affected Service without penalty, and ACRCloud may discontinue that affected Service. For urgent security or legal changes, ACRCloud will give notice as soon as reasonably practicable.

6. International transfers

Customer’s project region is the region selected in the Console or identified in the applicable order. For projects in the US West region, Customer Content and project data are processed and stored in that region; authorized personnel may access project data from outside the United States where necessary to operate and support the Service. A US West selection is not a commitment that access is limited to the United States.

For projects in the Singapore region, project processing and storage take place in Singapore. Where an EEA Region is selected, Customer Content, Derived Data and project-related Service Data, including project logs, backups and disaster-recovery copies, are processed and stored within the European Economic Area. ACRCloud will not transfer or permit access to that EEA project data from outside the EEA except where required by applicable law or expressly instructed by Customer through an external integration, as set out in the Services Agreement. Account administration and authentication data are distinct from EEA project data.

Where a transfer of Customer Personal Data is subject to a legal restriction on international transfers, ACRCloud and Customer will use an applicable lawful transfer mechanism and safeguards required by applicable law. For a restricted transfer to a subprocessor, the applicable provider agreement incorporates the European Commission’s Standard Contractual Clauses under Implementing Decision (EU) 2021/914 where required, using the module appropriate to the parties’ roles. A lawful transfer mechanism does not authorize a transfer or remote access prohibited by the EEA project commitments above.

ACRCloud assesses restricted transfers and the need for supplementary measures in light of the processing and applicable destination-country law. Information about the applicable contracting entities, transfer arrangements, relevant access or onward-processing locations and safeguards, and copies of applicable transfer terms, may be requested at support@acrcloud.com, subject to appropriate confidentiality protections and redaction of unrelated confidential information. Any completed transfer terms in an order or transfer schedule form part of this DPA and control to the extent of a conflict about that transfer, without reducing mandatory data-protection obligations.

7. Data-Subject requests

Individuals whose Personal Data is processed by ACRCloud on Customer’s behalf should direct rights requests to Customer. Customer is responsible for receiving and responding to those requests. ACRCloud will provide the reasonable assistance required by applicable law, taking into account the nature of Processing and the information available to ACRCloud.

Customer may self-service delete all Customer Usage Data created, submitted or generated through the relevant Service through the available Service controls. This includes, where applicable, uploaded-file records and results in File Scanning, monitoring streams and monitoring results, fingerprints, recognition results, request logs, project data and related records. ACRCloud will support Customer’s use of those controls and will provide any additional assistance required by applicable law or this DPA.

8. Retention, return, and deletion

Raw audio and video. ACRCloud temporarily buffers Customer-uploaded raw audio or video only as needed to transmit and process a request. Transient copies are automatically deleted when processing succeeds or fails and are not kept in long-term backups.

Customer Usage Data. Customer may self-service delete all Customer Usage Data created, submitted or generated through the relevant Service through the available Service controls. This includes, without limitation, uploaded-file records and results in File Scanning, monitoring streams and monitoring results, fingerprints, recognition results, request logs, project data and related records. Deletion of selected Customer Usage Data does not require an account downgrade or account closure.

Retention schedule. The following schedule forms part of this DPA. Retention is tied to the events described below rather than an unspecified additional retention period.

The deletion events above cover the relevant data in active systems and backup copies together; ACRCloud does not retain a separate backup recovery window for data deleted at those events. Customer should arrange any required export or return before switching to Free, before the trial expires without an upgrade, or before deleting the account, because the applicable Business Data cannot be recovered after deletion.

When the applicable processing services end, ACRCloud will, at Customer’s choice and through the applicable account-offboarding process, return or delete Customer Personal Data under its control without undue delay and delete existing copies. Any return must be arranged before the applicable automatic deletion event above. This does not limit Customer’s self-service deletion rights while the Services remain active or ACRCloud’s assistance obligations under this DPA.

Only where applicable law requires retention may the minimum legally required information be retained beyond an otherwise applicable deletion event. Such information remains protected, is restricted to the legally required purpose and is deleted when that legal obligation ends. This exception does not create a general right to keep Business Data, logs or backup copies for optional support, security, billing or recovery purposes. Account administration and any independently controlled statutory records remain subject to the Privacy Policy and applicable law.

9. Security and incidents

ACRCloud will maintain safeguards appropriate to the risk, including access controls, encryption in transit, least-privilege access, logging, and secure deletion procedures. A current description of ACRCloud’s safeguards is available on request at support@acrcloud.com.

ACRCloud’s breach notice will describe the nature of the incident and, as information becomes available, its likely consequences and measures taken or proposed. ACRCloud may provide information in phases if a complete account is not immediately available. Customer is responsible for determining whether and how to notify individuals or authorities.

10. Compliance information and audits

On reasonable written request, ACRCloud will provide information reasonably necessary to demonstrate compliance with this DPA and will contribute to audits or inspections conducted by Customer or an independent auditor mandated by Customer, as required by applicable law. Audits must be limited to Processing relevant to Customer, conducted on reasonable prior notice during normal business hours, subject to confidentiality and security requirements, and arranged to avoid unreasonable disruption. Available third-party audit reports or certifications may be used to address requests where appropriate.

11. Term and other terms

This DPA remains in force while ACRCloud processes Customer Personal Data under the Services Agreement. The liability limits, governing law, dispute provisions, and other general terms in the Services Agreement apply to this DPA unless applicable law requires otherwise. Nothing in this DPA limits either party’s non-waivable obligations or rights under applicable data-protection law.

Questions about this DPA or a Customer’s processing arrangements may be sent to support@acrcloud.com.

12. Processing details and security measures

Related documents: Terms of Use · Privacy Policy