GDPR & data rights

This page describes the rights you have over your personal data under Law No. 195/2024 on the protection of personal data and, for persons in the European Union, Regulation (EU) 2016/679 (GDPR), how to exercise them, and the terms on which Geminel Studio processes data on behalf of its clients (the data processing agreement, “DPA”).

1. Data subject rights

2. How to exercise your rights

2.1. Send your request to contact@geminel.studio, preferably from the address associated with the account. State the right you wish to exercise and, where applicable, the Workspace concerned.

2.2. To protect your data, we may ask for additional information to verify your identity.

2.3. We respond without undue delay and within one month at most of receiving the request. The period may be extended by two further months for complex or numerous requests, in which case we inform you within the first month.

2.4. Exercising your rights is free of charge. For manifestly unfounded or excessive requests we may charge a reasonable fee or refuse the request, giving reasons.

3. Our role for client data

3.1. For data about clients and users of the Platform (account, billing, payments, security) we are the controller; see the Privacy Policy.

3.2. For personal data that the client uploads or connects in its Workspace, in particular audience data from social accounts (public names and profiles, comments, direct messages), the persons appearing in video and photo materials, and data from uploaded documents, the client is the controller and Geminel Studio is the processor.

4. Data processing agreement (DPA)

The sections below constitute the data processing agreement between the client (controller) and Geminel Studio (processor), concluded under Law No. 195/2024 and Article 28 GDPR, unless the parties have signed a separate agreement.

4.1. Subject matter and duration. We process the data only to provide the contracted Services (content production, publishing, replies to comments and messages, statistics), for the duration of the contract.

4.2. Categories of persons and data. The audience of the client's social accounts (public identifiers and names, the content of comments and messages), the persons appearing in the client's materials (image, voice), and the client's employees and collaborators. We do not ask for special categories of data; if the client's materials contain them, the client is responsible for having a legal basis.

4.3. Instructions. We process the data only on the client's documented instructions, expressed through the contract and through the settings in the Platform (reply rules, autonomy level, scheduled publications). If an instruction appears to us to be unlawful, we inform the client.

4.4. Confidentiality. The persons authorised to process the data are bound by confidentiality.

4.5. Security. We apply the measures described in the Privacy Policy: encryption in transit, secrets encrypted at rest, isolation of Workspaces at database level (row-level security), role-based access control, an audit log, and backups.

4.6. Sub-processors. The client authorises us to use sub-processors for: hosting (Contabo, EU); file storage and DNS (Cloudflare R2); temporary storage and AI models (Google Cloud, Vertex AI); other language and speech-synthesis AI models (for example, Anthropic and ElevenLabs); video rendering (Amazon Web Services, Frankfurt region, when the function is active); and sending e-mails. The current list is provided on request. We inform the client before adding or replacing a sub-processor, and the client may object; if we cannot find a solution, the client may terminate the contract. We impose equivalent protection obligations on sub-processors.

4.7. Transfers. Transfers outside the Republic of Moldova and the EU take place only with the safeguards required by law (adequacy decisions or standard contractual clauses).

4.8. Assistance. We help the client, as far as possible, to respond to data subjects' requests, to carry out impact assessments and to meet its security and notification obligations.

4.9. Personal data breaches. We notify the client without undue delay, and within 48 hours at most, after becoming aware of a breach affecting its data, with the information available about its nature, the data affected and the measures taken, so that the client can notify the authority within the legal 72-hour period.

4.10. End of processing. On termination of the contract, the client may export its data for 30 days; we then delete it, including from backups when their cycle expires, unless the law requires retention.

4.11. Audit. We make available to the client the information needed to demonstrate compliance with these obligations and allow reasonable audits, with prior notice and respecting the confidentiality of other clients.

5. Voice and image

Voice cloning, when the function is available, is done only with the express consent of the person, recorded in the Platform with the date, time and version of the statement. Consent may be withdrawn at any time; after withdrawal, the cloned voice is no longer used for new materials.