Version 1.0 · 11 August 2026 · UK GDPR Article 28
These are the terms on which Veriframe processes personal data on your behalf. They are published rather than sent on request, so your data protection officer can read them before anyone has to ask.
This agreement applies automatically. It forms part of our terms of service and takes effect when you first send us footage. You do not need to sign anything for it to bind us.
If your procurement process needs a signed copy, print this page — there is a signature block at the end — or email enquiries@veriframe.co.uk and we will return a countersigned PDF. We will also complete your own DPA on your paper.
"Processor", "we", "us" — Veriframe Ltd, registered in England and Wales, company number 17390632, registered office 82 Suite A James Carter Road, Mildenhall, IP28 7DE. Registered with the Information Commissioner's Office, registration number ZC219332.
"Controller", "you" — the organisation whose account was used to send us the footage.
"UK GDPR" means the UK General Data Protection Regulation and the Data Protection Act 2018. Terms such as personal data, processing, data subject, personal data breach and sub-processor have the meanings given in that legislation.
For footage you send us, we are your processor. You decide what to send and why; we convert it on your instruction and nothing else. This agreement governs that processing.
For your account details, we are the controller — the names and work email addresses of the people who sign in, and the record of what was converted and billed. We need those to run the service and to keep proper accounts. That processing is described in our privacy notice and is outside this agreement.
We will:
Deletion is enforced by the software on a timer, not by anyone remembering. It is not a promise about intentions; it is a description of what the system does:
| The export you send | Deleted as soon as conversion succeeds. We never hold the original and the result at the same time. |
| Converted footage | Deleted 24 hours after it is ready, whether or not you have downloaded it. |
| After you download | Deletion is brought forward to about 15 minutes. |
| A job that fails | Deleted immediately. Abandoned part-way: within 6 hours. |
| On request | Immediately, from the job page or by asking us. |
Every deletion is logged with its reason, the volume removed and a timestamp. We can evidence destruction rather than assert it, and will provide that record for any job on request.
Because footage is deleted within a day in the ordinary course, there is nothing left to return or delete at the end of our relationship. If you end the agreement while a job is in progress, tell us and we will delete it at once.
Your account record — who your users are, and the list of jobs with their dates, sizes and reference labels — is kept while your account is open and for six years after the last transaction, because it forms part of our accounting records. That record contains no footage.
You give us general authorisation to use the sub-processors listed in Annex C. We will impose the same data protection obligations on any sub-processor that this agreement imposes on us, and we remain fully liable to you for their performance.
We will give you at least 30 days' notice by email before adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, you may end this agreement and stop using the service without penalty, and we will refund any unused credits.
If someone contacts us directly about footage you sent, we will not respond to the substance. We will tell them to contact you, and tell you promptly.
We will help you meet your own obligations, taking account of the short retention above. In practice the fastest route to erasure is the Delete now button on the job page, which removes the footage immediately — usually faster than we could act on a request passed to us.
We do not routinely view footage. We hold no index of its contents, so we cannot search it for a named individual; you will need to identify the job.
We will make available everything reasonably needed to demonstrate compliance with Article 28, and will contribute to audits by you or an auditor you appoint. In practice:
We will notify you of a personal data breach affecting your data without undue delay and within 72 hours of becoming aware of it, with what we know, what is affected, the likely consequences and what we are doing. Where we cannot provide everything at once we will provide it in stages rather than delay the first notification.
Notification goes to the account owner's email address. Keep it current.
Our short retention window materially limits exposure: in most cases footage from more than a day ago no longer exists to be affected.
All processing takes place in the United Kingdom, on infrastructure we control, in data centres certified to ISO/IEC 27001. Footage is not copied to any other country, and there is no restricted transfer under the UK GDPR. If that ever needs to change we will tell you first, under the 30 days' notice in section 4.
This agreement applies for as long as we process personal data on your behalf, and the obligations of confidentiality and deletion survive it.
Liability under this agreement is governed by the limits in our terms of service, except that nothing here limits either party's liability where the law does not allow it to be limited, and nothing here affects a data subject's rights or the powers of the Information Commissioner.
Each party will comply with its own obligations under the UK GDPR. You confirm that you have a lawful basis for the footage you send us and the right to have it processed.
This agreement is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.
| Subject matter | Converting proprietary CCTV and DVR exports into standard MP4 files, with a self-contained player and a certificate of conversion. |
| Duration | Minutes to hours per job. Footage is deleted within 24 hours of conversion, and sooner once downloaded. |
| Nature and purpose | Automated format conversion. The video is copied out of the recorder's container and written into MP4 without being decoded or re-encoded. No analysis, no recognition, no indexing, no human viewing in the ordinary course. |
| Type of personal data | Images of people, and anything else the camera recorded. Where the recording carries it: audio, GPS positions and timestamps, and vehicle telemetry such as speed and braking. Potentially special category data (Article 9) and criminal offence data (Article 10) — footage of an incident often is, which is why it is treated as sensitive throughout. |
| Categories of data subject | Whoever appears in the footage: members of the public, passengers, drivers, employees, suspects, witnesses. |
| Frequency | Occasional and controller-initiated. Nothing is processed unless you submit it. |
Article 32 measures, stated as facts you can check rather than as intentions.
The service runs in United Kingdom data centres certified to ISO/IEC 27001, and to ISO/IEC 27017, 27018 and 27701. The measures set out in the rest of this annex are ours and are additional to that environment.
Converting a proprietary export means parsing undocumented binary from an untrusted source, so it is treated as hostile. Each conversion runs in its own container-style unit with no network access of any kind, a read-only system, write access limited to that single job's directory, capped memory and CPU, a hard time limit, and no administrative rights. One customer's job cannot see another's.
Scope of certification. The ISO/IEC 27001, 27017, 27018 and 27701 certifications referred to above are held by our hosting provider and cover the data centres the service runs in. Veriframe Ltd holds no certification in its own name. If your assessment requires certification of the supplier rather than evidence of its controls, tell us early.
| Who | What they do | Where |
|---|---|---|
| OVH Hosting Limited | Provides the hosting the service runs on, and our email. Footage is stored there while it is being converted. They do not access it. | United Kingdom |
| Stripe Payments UK Ltd | Takes card payments for credits. Receives the buyer's name and email address. Never receives footage. | United Kingdom / EU |
Where a recording contains GPS, we fetch street-map tiles from OpenStreetMap once, during conversion, and embed them in the player. The finished player draws its map from those embedded tiles, so viewing it later contacts nobody.
What OpenStreetMap receives is a request for map squares covering the area the recording moved through. No footage, no filenames, no account details and no identifiers are sent — but the request does reveal, to a resolution of a few hundred metres, roughly where the recording took place. We judge that a request for a map area rather than a disclosure of personal data, and we name it here so you can reach your own view. If you would rather it did not happen at all, tell us and we will turn it off for your account; the player then plots the route on a plain background, which is what it did before basemaps existed.
No analytics, advertising or tracking service is used anywhere on this service.
If you are assessing Veriframe and something here does not answer your question, ask — we would rather resolve it now than during an incident. enquiries@veriframe.co.uk