Vilkår for bruk
Vilkårene gjelder på engelsk. Teksten under er den gjeldende versjonen og oversettes ikke.
Sist oppdatert 3. november 2026
Kreamatic Terms and Conditions
Last updated: 3 November 2026
Governing law: Norwegian law
Jurisdiction: Oslo District Court (Oslo tingrett)
Contracting entity: Kreamatic AS
Support: [email protected]
Privacy: [email protected]
1. Agreement to Terms
By registering for, accessing, or using the Kreamatic platform ("the Service"), you agree to be bound by these Terms and Conditions ("Terms"). If you do not agree, you may not access or use the Service.
These Terms constitute a legally binding agreement between you ("User", "you") and Kreamatic AS ("Kreamatic", "we", "us"). By accepting these Terms, you also accept the Data Processing Agreement in Annex A, and you confirm that you have read our Privacy Policy.
2. Who Can Use the Service
The Service is a tool for professional use in film, television and advertising production. You may use it only in your trade, business or profession, and by accepting these Terms you confirm that you act in that capacity. This applies to companies, sole traders and freelancers, and also to individuals, such as performers, who buy a personal subscription for their professional work.
Mandatory consumer protection rules still apply where the law requires it, and questions about them go to [email protected].
If you accept these Terms on behalf of a company or organization, you confirm that you have authority to bind it.
3. Service Description
Kreamatic is a cloud-based platform for the film, television and advertising industry. It is made up of modules, for example for locations, casting, projects, tasks, time and expenses, and company administration. Which modules and features exist, and what each plan includes, is shown in the Service and on the plans page, and changes over time as set out in Section 11. Features that are shown as unavailable are not part of the Service.
4. User Accounts and Access
4.1 Account Registration
To access the Service, you must register an account by providing accurate, complete, and current information. You must be at least 16 years of age. By accepting these Terms at registration, you confirm that you meet this requirement.
4.2 Account Security
You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. You agree to:
- Use a strong, unique password;
- Not share your credentials with third parties;
- Notify us immediately at [email protected] if you suspect unauthorized access.
4.3 Organizational Accounts
Companies may invite users to join their organizational account via email invitation. Invited users are bound by these Terms in addition to any internal policies of the inviting organization. Organizational administrators are responsible for managing member access, roles, and permissions within their account. Administrators ensure that members receive training in data protection, and remove a member's access without delay when the member leaves the organization.
4.4 Free Use
Kreamatic may offer plans or features free of charge. Free use is subject to these Terms in full, and Kreamatic may change or end free plans and features under Section 11.
4.5 Ownership of Organizational Content
Content that members create or upload for an organizational account is owned by the organization and stays with it when a member leaves. A member's personal account, and any subscription the member holds in their own name, belong to the member.
5. Subscriptions and Payment Terms
5.1 Subscription Plans
Paid plans, add-ons (such as additional storage) and their prices, billing periods and what they include are shown on the plans page, /plans, and in the Service. The price shown when you subscribe is the price that applies to you until it is changed under Section 5.4. These terms state no prices.
Norsk: Prisene vises på planside, /plans, og i tjenesten. Vilkårene oppgir ingen priser.
Prices are shown excluding VAT. VAT and other taxes are added at checkout where applicable, based on your billing address. For business customers in the EU, the reverse charge applies where applicable.
5.2 On-Demand Services and Credits
Certain features, such as some AI features, are paid for with prepaid credits rather than through a subscription. The Service shows which features use credits and at what rate before you use them. Credits are:
- Purchased in advance and held as a credit balance on your account;
- Consumed per transaction at rates shown within the Service;
- Non-refundable once consumed;
- Subject to spending limits per company, per user and per job. The limits that apply to you are shown within the Service.
Auto-refill of credits may be configured within account settings. Kreamatic does not guarantee the availability of on-demand services.
The rate for an on-demand service follows what our sub-processor charges us for the underlying service, with Kreamatic's markup on top. When the sub-processor's price changes, the rate follows straight away, up or down, without notice. The Service shows an estimate at the current rate before each use, and the rate in that estimate is the rate that applies to that use. A change to Kreamatic's markup is a price change under Section 13.3. The notice periods for subscription plans in Sections 5.4 and 13.3 are unchanged.
5.3 Billing and Payment
Payments are processed by our payment provider, named in the list of sub-processors at kreamatic.com/subprocessors (the "Sub-processor List", Annex A.5). By providing a payment method, you authorize Kreamatic to charge recurring subscription fees on your selected billing cycle. Failed payments may result in service suspension after reasonable notice. You are responsible for keeping your payment information current. For organizational accounts, the administrator who creates the subscription is responsible for payment, including for members who have been given access. Applicable VAT is calculated by the payment provider.
5.4 Price Changes
Kreamatic may change the price of a plan with at least 30 days' notice by e-mail. The notice states the new price and the date it takes effect. Continued use of the Service after that date constitutes acceptance of the new price. If you do not accept it, you may terminate the subscription before that date, and we refund any prepaid amount for the period after termination. Section 13.3 applies.
5.5 Refund Policy
Subscription fees are non-refundable except as set out in these Terms (Sections 5.4, 11.1, 13.3 and Annex A.5) or where required by applicable law. Otherwise, unused prepaid subscription periods upon voluntary cancellation are not refunded. Credits purchased for on-demand services are non-refundable once consumed. Kreamatic will consider refund requests made in good faith on a case-by-case basis.
6. User Responsibilities and Acceptable Use
6.1 General Obligations
You agree to use the Service only for lawful purposes and in compliance with these Terms, applicable law, and any guidelines published by Kreamatic. You are responsible for all content you upload, store, or share through the Service. Content you share through a public link can be viewed and copied by anyone who has the link. You are responsible for whom you share it with, and for withdrawing the link when it is no longer needed.
6.2 Prohibited Use
You agree not to:
- Upload, store, or transmit illegal, harmful, defamatory, or offensive content;
- Violate any person's privacy, intellectual property rights, or publicity rights;
- Upload personal data of third parties without a valid legal basis under GDPR;
- Attempt to gain unauthorized access to any system, account, or data;
- Use the Service to transmit spam, phishing communications, or malware;
- Reverse engineer, decompile, or disassemble any part of the Service;
- Resell, sublicense, or otherwise commercialize access to the Service without written consent;
- Interfere with the integrity, security, or performance of the Service;
- Create accounts or organizations that impersonate another person or organization.
6.3 How We Moderate Content
We do not review content before it is uploaded. We act on content when we receive a notice, when our automated abuse protection flags an account, or when we find a breach ourselves. Decisions are taken by people; automated tools only flag. We may restrict the visibility of content, remove it, disable a public link, or suspend or terminate an account if content is illegal or breaks Section 6.2. We act diligently, objectively and proportionately, with regard to the rights of everyone involved.
6.4 Reporting Illegal Content
Anyone can report content they believe is illegal, including content shown through a public link, by using the report function where the page offers one, on the report page at kreamatic.com/report, or by writing to [email protected]. A report should contain: why you believe the content is illegal; the exact URL; your name and e-mail address; and a statement that you believe in good faith the report is accurate and complete. We confirm receipt without undue delay, decide in a timely and objective manner, and tell you our decision and how you can challenge it.
6.5 If We Restrict Your Content or Account
If we remove or restrict your content, or suspend or terminate your account, we tell you what we did, why (the law or the section of these Terms we rely on), the facts we relied on, whether automated means were involved, and how you can challenge the decision. You can ask us to review the decision by replying to that message, and you may also go to court.
6.6 Points of Contact
Users can contact us at [email protected]. Authorities can contact us under the EU Digital Services Act at [email protected], in Norwegian or English.
7. Data Protection and GDPR
7.1 Roles Under GDPR
Kreamatic operates as a Data Processor acting on your behalf as the Data Controller when you use the Service to process personal data of third parties (such as casting candidates, crew members, or location contacts). This relationship is governed by the Data Processing Agreement in Annex A.
7.2 Your Obligations as Data Controller
When you use the Service to collect, store, or process personal data of third parties, you are solely responsible for:
- Obtaining valid consent or establishing another legal basis under GDPR for each processing activity;
- Providing individuals with appropriate privacy information;
- Honoring data subject rights (access, rectification, erasure, portability);
- Conducting Data Protection Impact Assessments where required;
- Ensuring data minimization - only collecting data necessary for your purposes;
- Not making candidate profiles public or sharing them with unrelated parties without the individual's own consent, using time-limited links, and removing access when the project is over;
- Defining and following retention periods, and deleting data you no longer need.
7.3 Special Category Data
The Casting Catalog module may be used to process special category personal data under GDPR Article 9, including physical characteristics, ethnic origin, and photographs. You must obtain explicit consent from data subjects before storing such data. Kreamatic provides consent management tools to assist you, but obtaining and managing consent remains your responsibility. You must not register health information about candidates unless it is necessary, you have a legal basis, and you hold explicit consent, and you must not use a profile for any purpose other than the one the consent covers.
If you register personal data about a person under 16 years of age, for example a child performer, you must obtain the consent of the holder of parental responsibility and assess whether the processing is necessary. This concerns data you register about others and does not allow anyone under 16 to hold an account (Section 4.1).
7.3a Allergies and Dietary Needs
Users can record food allergies and dietary needs so that catering on a production can keep them safe. This is health data, and religious dietary needs can reveal religious belief. Recording it is always voluntary. Kreamatic processes it only with the user's explicit consent, given in the Service, and the user can change or remove it at any time, which withdraws the consent.
On a project the user takes part in, the information is shown with the user's name only to the user, to the people responsible for safety and for catering on the project, and to anyone given safety or catering responsibility for a particular day. The project owner, the project managers and all other members see only totals. The project's access ends automatically when the project is completed, archived, cancelled or deleted. A life-threatening allergy gives everyone on set a warning that does not name the person.
If you record dietary needs for a person who has no account, you (or the organization you act for) are the controller, you must have that person's explicit consent, and you must delete the data when the project no longer needs it.
Dietary, allergy and health information in Kreamatic is entered by users, is for guidance only and is not verified by Kreamatic; to the extent permitted by applicable law, the production using it is responsible for ordering, food handling and safety measures.
7.4 Data Location, Transfers and Security
We store customer data in the EU/EEA. Some providers on the Sub-processor List process data outside the EEA, for example when you use an AI feature or pay. We transfer data outside the EEA only on a basis the GDPR allows: an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses. The Sub-processor List states the location and transfer basis for each provider, and you can ask us for a copy of the safeguards.
We protect data with technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access control at application and database level, the ability to restore data after an incident, and regular testing of these measures.
7.5 Personal Data Breaches
If we become aware of a personal data breach affecting data we process for you, we notify you without undue delay, and we aim to do so within 48 hours. We give you the information we have about the nature of the breach, the data and people affected, the likely consequences and the measures taken, and we add to it as we learn more. You decide whether the supervisory authority and the people affected must be notified, and we help you do so. If you discover a breach that affects the Service, notify us without undue delay.
7.6 Your Personal Data
Kreamatic processes your account data (name, email, contact details, payment identifiers) as a Data Controller for the purpose of providing and administering the Service. This processing is governed by our Privacy Policy, available at kreamatic.com/privacy.
7.7 Agency-Owned Media and Erasure Requests
Where an agency using the Casting Catalog module has uploaded media (photographs or video) that it produced and owns, depicting a talent, and that talent subsequently exercises their right to erasure under GDPR Article 17, the following applies:
- On erasure: the media is immediately unlinked from the talent's profile and hidden from all views, and the talent's account and personal data are erased in full.
- Bounded retention of the agency's own asset: the agency-owned media is retained for up to 24 months from the date of the erasure, on the agency's own legal basis as controller of that asset - its legitimate interest in its commercial property (GDPR Article 6(1)(f)) and the establishment, exercise, or defence of legal claims (GDPR Article 17(3)(e)). After 24 months the file and its record are permanently deleted.
- Ordinary profile deletion is different: if a talent deletes their profile through the normal in-product flow (not a GDPR erasure request), agency-owned media is not subject to this retention and is left untouched.
This retention applies only to media the agency produced and owns and has not transferred to the talent. Media owned by the talent - including media transferred to them - is deleted in full on erasure.
8. Intellectual Property
8.1 Your Content
You retain all ownership rights in content you upload to the Service ("Your Content"). By uploading content, you grant Kreamatic a limited, non-exclusive, royalty-free license to store, process, and transmit Your Content solely as necessary to provide the Service. This license terminates when you delete content or close your account.
You represent and warrant that you have all rights necessary to upload Your Content and that Your Content does not infringe the intellectual property, privacy, or other rights of any third party.
8.2 AI Features and AI-Generated Content
The Service offers optional artificial intelligence (AI) features that generate tags, classifications, extracted text and suggestions based on Your Content. AI features are on by default, and you choose for yourself whether to use them: nothing is sent to an AI provider unless you or a user in your organization starts an AI feature. An organization administrator can turn AI features off for the whole organization, and the same tasks can then be done by hand.
When you use an AI feature, the content you submit for that analysis is sent to the AI sub-processors named in the Sub-processor List (Annex A.5). They process it on our behalf and do not use it to train their models through our integration.
You are responsible for having the right to send the content you submit to AI analysis, for example images of people and documents containing personal data, and for reviewing and validating AI-generated content before relying on it. AI-generated output can be wrong, and Kreamatic does not guarantee that it is accurate or complete. Ownership of AI-generated output is assigned to you as part of your use of the Service.
Norsk: AI-funksjonene er valgfrie og på som standard. Du velger selv å bruke dem, og selskapsadmin kan skru dem av for hele selskapet. Du har ansvaret for at du har rett til å sende innholdet til AI-analyse, og for å kontrollere resultatet. Resultatene kan være feil, og Kreamatic garanterer ikke at de er riktige.
8.3 Kreamatic Intellectual Property
The Service, platform, software, design, documentation, and branding are owned by Kreamatic and protected by applicable intellectual property laws. These Terms do not transfer any ownership rights to you. You may not copy, modify, create derivative works of, or otherwise exploit any part of the Service without prior written consent.
9. Third-Party Services and Integrations
The Service relies on third-party providers for hosting, sign-in, payments, e-mail, maps, abuse protection, analytics and AI features. Those that process personal data on our behalf are listed in the Sub-processor List (Annex A.5), with each provider's purpose and location. Some features connect to a service of your own choosing, for example when you connect a Google account to import files or link a 3D tour. Your use of such a service is subject to its own terms, and Kreamatic is not responsible for its availability, accuracy or conduct.
10. Service Availability
Kreamatic targets high availability of the Service but does not guarantee uninterrupted access. The Service may be unavailable due to scheduled maintenance (announced in advance where possible), emergency maintenance, or events beyond our reasonable control. Kreamatic will endeavor to minimize disruption and communicate planned downtime through the Service or by email.
11. Service Changes and Termination
11.1 Service Modifications
Kreamatic develops the Service continuously and may add, change or remove features. We give at least 30 days' notice by e-mail before a change that materially reduces what you have paid for. Continued use of the Service after the change takes effect constitutes acceptance. If you do not accept such a change, you may terminate the affected subscription before it takes effect, and we refund any prepaid amount for the period after termination.
11.2 Termination by You
You may cancel a paid subscription at any time in the Service. It then runs until the end of the current billing period and is not renewed; prepaid periods are refunded only as set out in Section 5.5. You may terminate your account at any time through account settings. You have 30 days following termination to export your data.
After this period we delete your data, except data we must keep by law. The 30 days count from the day after you ask, and the deletion runs when day 30 is over, and the Service shows the date. Your own timesheets, expenses and receipts as a freelancer without a company are deleted with your account, so download them first. An organization's accounting records, such as invoices, payment records and approved timesheets and expenses, are kept for five years after the end of the financial year as the Norwegian Bookkeeping Act requires, and are then deleted. We keep other records for these periods: security logs 12 months; operational logs and user activity 90 days; server logs 30 days; consent records and data protection requests 12 months; your acceptance of these Terms for as long as the account exists and 12 months after it is deleted. Deleted data may remain in backups for up to 12 months and is not restored for use from them. Content owned by an organization stays with the organization (Section 4.5).
11.3 Termination by Kreamatic
Kreamatic may suspend or terminate your account if you breach these Terms, fail to pay fees, engage in illegal activities, or pose a security or legal risk. Unless the breach is serious or urgent, we warn you first and give you a chance to fix it. Section 6.5 applies. In such cases, we may restrict your ability to export data if legally required.
11.4 Effect of Termination
Upon termination, your right to access the Service ceases. Provisions of these Terms that by their nature should survive termination (including Sections 7, 8, 12, and 13) shall remain in effect.
12. Limitation of Liability
12.1 Disclaimer of Warranties
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. KREAMATIC DOES NOT WARRANT THAT THE SERVICE WILL BE ERROR-FREE, UNINTERRUPTED, OR FREE OF HARMFUL COMPONENTS.
12.2 Liability Cap - Subscriptions
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, KREAMATIC'S TOTAL CUMULATIVE LIABILITY TO YOU ARISING FROM OR RELATING TO THESE TERMS OR YOUR USE OF THE SERVICE SHALL NOT EXCEED THE TOTAL SUBSCRIPTION FEES YOU PAID TO KREAMATIC IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.
12.3 Liability Cap - On-Demand Services and Credits
FOR CLAIMS ARISING FROM OR RELATING TO ON-DEMAND SERVICES OR CREDIT-BASED FEATURES, KREAMATIC'S TOTAL LIABILITY SHALL BE LIMITED TO THE LESSER OF: (A) THE VALUE OF THE CREDITS DIRECTLY INVOLVED IN THE INCIDENT GIVING RISE TO THE CLAIM, OR (B) EUR 500.
12.4 Exclusion of Consequential Damages
IN NO EVENT SHALL KREAMATIC BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS OPPORTUNITIES, EVEN IF KREAMATIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
12.5 Indemnification
You agree to indemnify, defend, and hold harmless Kreamatic, its officers, directors, employees, and agents from and against any claims, liabilities, damages, and costs (including reasonable legal fees) arising from: (a) your violation of these Terms; (b) your violation of any applicable law or third-party rights; (c) Your Content; or (d) your failure to comply with GDPR or other data protection obligations.
12.6 What These Limits Do Not Cover
Nothing in these Terms limits or excludes liability for gross negligence or wilful misconduct, for death or personal injury, or any liability that cannot be limited under applicable law. If you are a consumer, Sections 12.1 to 12.4 apply only to the extent the consumer law that applies to you allows, and the Service will conform to the contract as that law requires.
13. General Provisions
13.1 Governing Law
These Terms are governed by Norwegian law, without regard to its conflict of law principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply. If you are a consumer, this choice of law does not deprive you of the protection of the mandatory rules of the country where you live.
13.2 Dispute Resolution
We try to resolve any dispute arising from or relating to these Terms through good-faith negotiation first. If it is not resolved within 30 days, either party may bring it before Oslo District Court (Oslo tingrett), which is the agreed venue. If you are a consumer, you may also bring a case before the courts of the country where you live, and we may bring a case against you only there.
13.3 Changes to These Terms, Prices and the Service
We may change these Terms, our prices or the Service for valid reasons: changes in law or regulatory guidance, security, changes in our providers or costs, new or changed features, or to make the Terms clearer. We give at least 30 days' notice of a material change by e-mail to the account holder (for organizations, the administrators) and in the Service, and state what changes and from which date. Changes required by law, or needed urgently for security, may take effect sooner and we tell you as soon as we can. The date at the top shows the last change.
We do not ask you to accept the Terms again. A change applies from its effective date if you keep using the Service. If you do not accept a change, you may terminate your account or the affected subscription before the effective date, and we refund any prepaid amount for the period after termination.
13.4 Entire Agreement
These Terms, together with the Data Processing Agreement (Annex A) and the Sub-processor List that forms part of it, constitute the entire agreement between you and Kreamatic with respect to the Service and supersede all prior agreements.
13.5 Severability
If any provision of these Terms is found unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions shall continue in full force.
13.6 No Waiver
Failure by Kreamatic to enforce any provision of these Terms shall not constitute a waiver of the right to enforce such provision in the future.
13.7 Assignment
You may not assign or transfer your rights under these Terms without Kreamatic's prior written consent. Kreamatic may assign these Terms to an affiliate or in connection with a merger, acquisition, or sale of substantially all its assets.
13.8 Force Majeure
Kreamatic shall not be liable for delays or failures in performance resulting from circumstances beyond its reasonable control, including natural disasters, acts of war, pandemics, governmental action, or internet infrastructure failures.
14. Contact Information
| | | |---|---| | General support | [email protected] | | Privacy | [email protected] | | Registered entity | Kreamatic AS |
15. Acceptance
By checking "I agree to the Terms and Conditions" when you create an account, or by accessing or using the Service, you confirm that you have read, understood and agree to be bound by these Terms and the Data Processing Agreement (Annex A), and that you have read the Privacy Policy. If you are accepting on behalf of an organization, you confirm that you have authority to bind that organization.
Annex A - Data Processing Agreement (DPA)
A.1 Purpose and Scope
This Data Processing Agreement ("DPA") supplements the Terms and Conditions and governs the processing of personal data by Kreamatic AS ("Kreamatic", "Processor") on behalf of the User ("Controller") in connection with the Service. This DPA is entered into in accordance with Article 28 of the GDPR.
A.2 Subject Matter, Nature, Purpose and Duration
The Processor shall process personal data on behalf of the Controller for the purpose of providing the Kreamatic platform and associated services. The nature of processing includes storage, retrieval, display, transmission, deletion, and backup of personal data uploaded or generated by the Controller through use of the Service. Processing lasts for as long as the Controller uses the Service, and ends when the data has been deleted or returned under Section A.9.
A.3 Categories of Data and Data Subjects
The Controller may upload personal data relating to the following categories of data subjects:
- Crew members, production staff and project members (name, contact details, role, time, expense and receipt records)
- Performers and applicants to casting calls (name, contact details, physical characteristics, photographs, video)
- Location owners and contacts (name, contact details)
- Company representatives, clients and other contacts
- Visitors who view or comment on a shared link (name entered and comment)
Special categories of personal data (GDPR Article 9) processed by the Controller may include ethnic origin, physical characteristics, and biometric data via photographs in the Casting module, and health data, such as food allergies and dietary needs registered for crew in the Projects module (Section 7.3a of the Terms). The Controller is responsible for obtaining explicit consent from data subjects for such processing.
A.4 Processor Obligations
Kreamatic, as Processor, agrees to:
- Process personal data only on documented instructions from the Controller (i.e., the Controller's use of the Service);
- Inform the Controller immediately if, in our opinion, an instruction infringes the GDPR or other data protection law;
- Ensure that persons authorized to process personal data are bound by appropriate confidentiality obligations;
- Implement appropriate technical and organizational security measures as described in Section 7.4 of the Terms;
- Assist the Controller in fulfilling its obligations to respond to data subject requests (access, rectification, erasure, portability, restriction, objection);
- Assist the Controller with security, breach notification, DPIAs, and prior consultation obligations;
- Delete or return all personal data to the Controller when the service relationship ends, as set out in Section A.9;
- Make available all information necessary to demonstrate compliance with this DPA and permit audits.
A.5 Sub-Processors
The Controller gives general written authorization for Kreamatic to engage sub-processors. The current sub-processors, with the purpose, the data concerned, the location of processing and the transfer basis, are listed in the Sub-processor List at kreamatic.com/subprocessors, which forms part of this DPA.
We notify the Controller of any intended addition or replacement of a sub-processor at least 30 days before it starts processing personal data, by e-mail to the account holder (for organizations, the administrators). The Controller may object on reasonable data protection grounds within that period by writing to [email protected]. If the Controller does not accept the change, the Controller may terminate the affected subscription before the change takes effect, and we refund any prepaid amount for the remainder of the period.
We impose on each sub-processor, by contract, the same data protection obligations as those in this DPA, in particular sufficient guarantees of appropriate technical and organizational measures.
A.6 Data Transfers
Personal data is stored in the EU/EEA. Where a sub-processor processes personal data outside the EEA, the transfer relies on an adequacy decision (including the EU-U.S. Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses, as stated for each provider in the Sub-processor List. A copy is available on request.
A.7 Audit Rights
The Controller may conduct audits of Kreamatic's data processing activities upon reasonable written notice (at least 30 days). Audits shall be conducted during normal business hours and at the Controller's expense. Kreamatic may satisfy audit requests by providing relevant certifications or third-party audit reports.
A.8 Liability Under This DPA
Each party's liability under this DPA is subject to the limitations set out in Section 12 of the Terms. Kreamatic's liability as Processor is limited to direct damages caused by its failure to comply with documented Controller instructions or its obligations under this DPA.
Kreamatic remains fully liable to the Controller for the performance of its sub-processors' data protection obligations.
A.9 End of Processing
When the service relationship ends, the Controller may, during the 30-day period in Section 11.2 of the Terms, export its data (return) or ask for deletion. After that period we delete the personal data and existing copies, unless law requires us to keep it. Data in backups is deleted as the backups expire, within 12 months, and is not restored for use in the meantime.
Change History
| Date | Changes | |---|---| | January 2026 | Initial terms | | April 2026 | Added on-demand credits section, Art. 9 special category data, B2B-only clause, updated liability caps, DPA Annex A expanded | | October 2026 | Clarifications before launch: age limit stated without reference to national law, casting data duties, organizational administration, ownership and payment, public links, impersonation, removal of content, storage location stated as EU/EEA | | 22 October 2026 | General update: professional use, prices excluding VAT, disputes, sub-processor list, data protection annex | | 3 November 2026 | On-demand rates follow the sub-processor's cost straight away, with the rate in the estimate before each use applying |