Legal

English · Deutsch
In case of differences, the German version prevails.

Data Processing Agreement

Last updated: 10 October 2026. Agreement under Art. 28(3) GDPR for customers who use Bumely for their business (creators with a registered business, agencies, companies). The processor is tayger, owner Tayger Galster, Regensburger Straße 138, 90478 Nürnberg, Germany (see the Legal notice). For private users, the Privacy Policy applies; they do not need this agreement.

How the agreement is concluded

Send us an email to info@bumely.com with the subject “DPA”, the name of your business, your address and the email address of your Bumely account. We confirm the agreement by email; from that confirmation on, it applies to all videos you process through this account. The two emails are the agreement in electronic form (Art. 28(9) GDPR). If you need a signed version, we will send it to you as a PDF.

1. Subject matter and duration

You (the controller) upload videos to the Bumely Studio; we (the processor) cut out pauses, create subtitles, suggest a post text, deliver the finished videos and send them, on your instruction, to the platform you choose for publishing. The agreement applies for as long as your Bumely account exists and ends when the account is deleted or when you terminate it by email.

2. Nature and purpose of processing, types of data, data subjects

Nature of processing: storing, cutting, speech recognition (transcription), subtitling, rendering, transmitting. Purpose: solely creating and publishing your videos on your behalf. Types of data: video and audio recordings, still images, transcripts and subtitles, post texts, file names, timestamps. Data subjects: you, the people who can be seen or heard in your videos, and people whose names or details are mentioned in what is said.

3. Instructions

We process the data only on your documented instructions. Your instructions are this agreement and what you trigger in the Studio: uploading, choosing a look, cutting, finishing, downloading, saving, publishing and deleting. Further instructions are sent by email to info@bumely.com. If we consider an instruction unlawful, we tell you immediately and may suspend it until clarified. We are obliged to transfer data to a third country beyond what is listed in Section 6 only if EU or German law requires it; in that case we inform you beforehand, as far as permitted.

4. Confidentiality

Only the owner has access to your data; he is bound to confidentiality. There are currently no employees. If any join, we bind them to confidentiality in writing before they get access.

5. Security of processing (Art. 32 GDPR)

We implement the technical and organisational measures described in our measures document; you can request it at info@bumely.com. They include: servers in a data centre in Frankfurt am Main, encryption of all connections (HTTPS, TLS), maintenance access only via SSH key, firewall and lockout after failed attempts, separate data folders per account, automatic deletion of videos after 7 days, encrypted storage of platform tokens, error reports without content. We keep the measures up to date with the state of the art without lowering the level of protection.

6. Sub-processors

You give us general authorisation to use these sub-processors:

Platforms to which we send your video on your instruction (TikTok, Instagram, YouTube, Buffer) are not our sub-processors; your own contract with the platform applies to them. If we want to add or replace a sub-processor, we notify you by email at least 14 days in advance. You can object for good reason; you may then terminate the agreement and delete your account. With every sub-processor we conclude a contract that imposes the same obligations on it as this agreement imposes on us.

7. Rights of data subjects

If data subjects contact us, we forward the request to you and do not answer it ourselves. We support you with the means of the Studio in fulfilling access, rectification, erasure, restriction and data portability: you can download, change and delete videos, transcripts and post texts yourself at any time; you export your account data in the Studio under “Download my data”.

8. Assistance under Art. 32 to 36 GDPR

We assist you with the security of processing, with notifying personal data breaches, with data protection impact assessments and with consulting the supervisory authority, as far as our processing is concerned. We notify you of a breach affecting your data without undue delay, at the latest 48 hours after becoming aware of it, with everything we know about it.

9. Deletion and return

We delete videos, audio tracks, transcripts and finished files automatically 7 days after upload, earlier on your request. After the agreement ends, we delete all remaining data of your account as soon as you delete your account, at the latest 30 days after your termination, unless a statutory obligation requires longer retention. Backups by the host are overwritten after three weeks at the latest. Before that, you can download everything yourself.

10. Evidence and audits

We make available all information you need to demonstrate compliance with this agreement: on request, the measures document, this document, details of the sub-processors and answers to your questions. An audit on site or by an auditor appointed by you is possible with 14 days’ notice during business hours, at most once a year unless there has been an incident. You bear the costs of such an audit. For the data centre, the evidence of our host applies.

11. Miscellaneous

In case of conflict, this agreement prevails over the Terms of Service as far as data protection is concerned. German law applies. We notify you of changes by email; they are deemed accepted if you do not object within 30 days, which we point out in the email.