Snapshot 1023
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Kaltura Data Processing Agreement
- Confidential -
DATA PROCESSING AGREEMENT
This Data Processing Agreement, including the annexes hereto, (the “DPA”) is entered into between Kaltura, Inc., a Delaware
corporation, having its principal place of business at 860 Broadway, 3rd Floor, New York, NY, 10003 USA (“Kaltura”) on behalf
of itself and the Kaltura Affiliates, and Customer on behalf of itself and its Affiliates. This DPA forms part of the Agreement (as
defined below) between the parties and sets out the parties’ agreement with respect to the Processing of Personal Data.
1. DEFINITIONS j. "Deidentified Data" shall mean information that
a. “Affiliate” means any entity controlling, under cannot reasonably identify, relate to, describe, be
common control with, or controlled by either capable of being associated with, be linked
party, where “control” means ownership of more directly or indirectly with, or be reasonably be
than 50% of the equity of such entity. used to infer information about an identifiable
b. “Agreement” shall mean, collectively, the Master natural person, all as defined under applicable
License and Professional Services Agreement, US Data Protection Laws.
the Kaltura Customer Agreement, or any other k. “Input(s)” shall mean any data, content, text,
similarly titled services agreement and/or an audio, documentation, image, video, or
executed Order Form and/or any other valid information submitted, uploaded, or otherwise
contract in force between Kaltura and Customer provided by or on behalf of Customer or Users to
governing the Customer’s use of the Services. the Kaltura AI systems including, to the extent
c. “Biometric Data” shall mean Personal Data applicable, through integration with Customer’s
resulting from specific technical processing systems, or communications such as Chatbots,
relating to the physical, physiological, or AI calls and conversations, etc.
characteristics of a natural person, which allow or l. “Instructions” shall mean any reasonable,
may allow confirmation of unique identification of documented instructions given by Customer with
that natural person, including but not limited to respect to the lawful Processing of Personal
face data, facial geometry, and voice prints. Data. Instructions may include, without limitation,
d. “Controller” shall mean the natural or legal the correction, erasure and/or the blocking of
person, public authority, agency or other body Personal Data in the legal responsibility of the
which, alone or jointly with others, determines the Controller. Customer may also give Instructions
electronically by using the functionalities,
purposes and means of the Processing of
settings, and preferences available within the
Personal Data. Services.
e. “Customer” means the entity that enters into, or m. “Israeli Data Protection Laws” means,
has entered into, the Agreement with Kaltura. collectedly, the: (i) Israeli Protection of Privacy
f. “Customer Admin” means any of Customer’s Law, 5741-1981 (as amended under Amendment
authorized staff, personnel, agents, employees, 13); (ii) the regulations promulgated pursuant
or Users who directly engage with Kaltura on thereto, including the Israeli Protection of Privacy
behalf of Customer concerning their Kaltura (Data Security) Regulations, 5777-2017 and the
account to use the Services. Israeli Protection of Privacy (Transfer of Data to
g. “Customer Data” shall mean Customer content, Databases Abroad) Regulations, 5761-2001; (iii)
information, text, image, photos, as uploaded to any amendments or legislation replacing or
the Kaltura platform, as well as any Input, Output updating any of the foregoing; and (iv) any judicial
(as defined below), including video, audio and or administrative interpretation of any of the
images, that is Processed by Kaltura to the extent above, including any binding guidance,
such content contains Personal Data, in the guidelines, codes of practice, approved codes of
course of providing the Services, all as detailed in conduct or certification mechanisms approved by
Annex 1 attached herein. the Israeli Privacy Protection Authority.
h. “Data Protection Regulations” means all n. “Output(s)” means any data, content, or material
applicable and binding privacy and data generated by the Kaltura AI systems in response
protection laws and regulations, including to Inputs submitted by Users, Customer Admin or
Regulation (EU) 2016/679 of the European otherwise individuals interacting with the Kaltura
Parliament and of the Council (the “GDPR”), AI systems.
Regulation (EU) 2016/679 as it forms part of the o. “Personal Data” and/or “Personal Information”
law of the law of England and Wales, Scotland shall mean any information relating to an
and Northern Ireland by virtue of the European identified or identifiable natural person (a “Data
Union (Withdrawal) Act 2018 and as amended by Subject”), or Consumer (as defined in the CCPA,
the Data Protection, Privacy and Electronic to the extent applicable) Processed by Kaltura
Communications (Amendments etc.) (EU Exit) solely on behalf of Customer in connection with
Regulations 2019 (SI 2019/419) (the “UK the Services; an identifiable natural person is one
GDPR”), the Swiss Federal Act on Data who can be identified, directly or indirectly, in
Protection of 19 June 1992 and the Swiss particular by reference to an identification number
Ordinance on the Federal Data Protection Act of or to one or more factors specific to the physical,
14 June 1993 (the “FADP”), the US Data physiological, mental, economic, cultural or social
Protection Laws (as defined below) and the identity of that natural person.
Israeli Data Protection Laws (as defined below), p. “Processing” and/or "Process" shall mean any
known or reasonably expected by Kaltura to be operation or set of operations which is performed
applicable to the Processing of Personal Data on Personal Data or on sets of Personal Data,
hereunder and in effect at the time of Kaltura’s whether or not by automated means, such as
performance hereunder. collection, recording, organization, structuring,
i. “Data Subject” shall mean an individual to whom storage, adaptation or alteration, retrieval,
the Personal Data relates. consultation, use, disclosure by transmission,
dissemination or otherwise making available,
Version: January 2026 Page 1 of 10
Kaltura Data Processing Agreement
- Confidential -
alignment or combination, restriction, erasure or Act (“MODPA”), effective October 1, 2025; and
destruction. (xx) Oregon Consumer Data Privacy Act
q. “Processor” shall mean a natural or legal person, (“OCPA”). All as amended or superseded from
public authority, agency or other body which time to time and including any implementing
Processes Personal Data on behalf of the regulations and amendments thereto.
Controller. w. “User” means a natural person that uses the
r. “Sensitive Personal Data” shall mean Personal Services. Users can include employees, students
Data that requires a higher level of protection or the audience of Customer, unless otherwise
under Data Protection Regulations, such as specified in an applicable Order Form.
“special categories of personal data” under x. The terms, "Member State" and "Supervisory
GDPR, “sensitive data” or other materially similar Authority" shall have the same meaning as in the
terms under applicable Data Protection GDPR. The terms “Business”, “Business
Regulations. Purpose”, “Consumer” and “Service Provider”
s. “Service(s)” shall mean the Hosted Services, the shall have the same meaning as in the CCPA.
Service Offerings, and/or any work, product, or For the purpose of clarity, within this DPA
service which Kaltura provides to Customer, “Controller” shall also mean “Business”, and
Customer’s Affiliates, and/or Users of any of the “Processor” shall also mean “Service Provider”,
foregoing under the terms of the Agreement. to the extent that the CCPA applies. In the same
t. “Sub-Processor” shall mean (i) Kaltura, when manner, Processor’s Sub-processors shall also
Kaltura Processes Personal Data on behalf of refer to the concept of Service Provider.
Customer, and Customer itself is a Processor of
such Personal Data, or (ii) Kaltura Affiliates Any capitalized terms used but not defined herein shall
and/or third-party processors engaged by Kaltura have the meanings ascribed to them in the Agreement.
to Process the Personal Data, pursuant to
Section 6 below. 2. DATA PROCESSING
u. "SCCs” refer to the contractual clauses annexed a. Roles of the parties.
to the European Commission’s Implementing i. The parties acknowledge and agree that with
Decision 2021/914 of 4 June 2021 on standard respect to the Users’ Personal Data, (1)
contractual clauses for the transfer of personal Customer is the Controller and Kaltura is the
data to third countries pursuant to Regulation Processor of Personal Data, or (2) Customer
(EU) 2016/679 of the European Parliament and of is the Processor and Kaltura is the Sub-
the Council. Processor of Personal Data.
v. “US Data Protection Laws” means any and all ii. For avoidance of doubt and without
applicable federal and state privacy laws and derogating from any other provisions in this
regulations applicable to the Wonderful.ai Section 2, the parties acknowledge that with
Processing activities of Customer Data under this respect to Customer Admins’ Personal Data,
DPA, and any implementing regulations and Kaltura acts as a separate independent
amendment thereto, including without limitation Controller, and will process such Personal
the: (i) California Consumer Privacy Act (Cal. Civ. Data in accordance with Kaltura’s Privacy
Code §§ 1798.100 - 1798.199) of 2018 including Policy located at
as modified by the California Privacy Rights Act https://corp.kaltura.com/legal/privacy/privacy
as well as all regulations promulgated thereunder -policy/. Customer Admins’ Personal Data
from time to time ('CCPA'); (ii) the Colorado may include the Customer Admins’ name and
Privacy Act C.R.S.A. § 6-1-1301 et seq. (SB 21- Email address as detailed in the Privacy
190) ('CPA'); (iii) the Connecticut Data Privacy Policy.
Act, S.B. 6 (Connecticut 2022) ('CTDPA'); (iv) the b. Kaltura’s Processing of Personal Data. Kaltura
Florida Digital Bill of Rights S.B 262 ('FDBR'); the shall Process Personal Data under the
Montana Consumer Data Privacy Act 68th Agreement only on behalf or under the instruction
Legislature 2023, S.B. 0384 ('MTCDPA'); the of Customer, and: (i) in accordance with the
Oregon Consumer Data Privacy Act ORS Agreement, this DPA, and Customer’s
646A.570-646A.589 ('OCDPA'); (vii) the Texas reasonable Instructions, to the extent these
Data Privacy and Security Act, Tex. Bus. & Com. Instructions are consistent with the terms of the
Code Ann. § 541.001 et seq ('TDPSA'); (viii) the Agreement in relation to the manner Processing
Utah Consumer Privacy Act, Utah Code Ann. § shall be performed, (ii) as necessary to provide
13-61-101 et seq ('UCPA'); (ix) the Washington the Services, (iii) as required by laws applicable
“My Health My Data” Act, Wash. Rev. Code § to Kaltura, and/or as required by a court of
19.373.005 et seq., and Nev. Rev. Stat. § 603A, competent jurisdiction or other competent
as amended by Nevada S.B. 370 (together, the governmental or semi-governmental authority,
“Washington and Nevada Consumer Health provided that Kaltura shall inform Customer of the
Data Laws”); (x) the Virginia Consumer Data legal requirement before Processing, unless such
Protection Act, Va. Code Ann. § 59.1-575 et seq. law or order prohibit such information on
(SB 1392) (“VCDPA”); (xi) the Delaware Personal important grounds of public interest, and (iv) in
Data Privacy Act (“DPDPA”), effective January 1, order to render Personal Data fully anonymous,
2025; (xii) the Iowa Consumer Data Protection non-identifiable and non-personal in accordance
Act (“ICDPA”), effective January 1, 2025; (xiii) the with applicable standards recognized by Data
Indiana Consumer Data Protection Act Protection Regulations and guidance issued
(“INCDPA”), effective January 1, 2026; (xiv) the thereunder.
Tennessee Information Protection Act (“TIPA”), c. Instructions. Kaltura shall inform Customer if, in
effective July 1, 2025; (xv) the New Hampshire Kaltura’s opinion, a Customer’s Instruction(s) for
Data Privacy Act (“NHDPA”), effective January 1, the Processing of Personal Data is unreasonable
2025; (xvi) the Kentucky Consumer Data or contrary to applicable Data Protection
Protection Act (“KCDPA”), effective January 1, Regulations, the Agreement, or this DPA. To the
2026; and (xvii) the Maryland Online Data Privacy extent that Kaltura cannot, for any reason, comply
Version: January 2026 Page 2 of 10
Kaltura Data Processing Agreement
- Confidential -
with an Instruction from Customer, (i) Kaltura Customer of such Security Incident without
shall inform Customer, providing relevant details undue delay.
of the issue, and (ii) Kaltura may, per its sole ii. Kaltura shall take all steps it deems
discretion, temporarily cease all Processing of the reasonable and necessary to remediate the
affected Personal Data (other than securely cause of any Security Incident and mitigate its
storing such Personal Data) and/or suspend impact.
Customer’s access to the Services, without iii. Kaltura shall provide any assistance
imposing any liability on Kaltura, (iii) the Parties reasonably required by Customer to comply
will undertake prompt, good faith negotiations to with Customer’s obligations under Data
resolve the issue(s) with the instructions, and (iv) Protection Regulations to notify regulatory
if the Parties cannot agree on a good faith, authorities and/or Data Subjects impacted by
reasonable resolution to the instruction issue in a Security Incident, to the extent the
question and the costs thereof, Customer may, as remediation and/or mitigation is within
its sole remedy, terminate the Agreement and this Kaltura’s reasonable control. These
DPA with respect to the affected Processing, and obligations shall not apply to Security
Customer shall pay to Kaltura all the amounts Incidents that are caused by Customer or
owed to Kaltura. Customer will have no further anyone who uses the Services on Customer’s
claims against Kaltura (including, without behalf.
limitation, requesting refunds for Services) iv. Customer will not make, disclose, release or
pursuant to the termination of the Agreement and publish any finding, admission of liability,
the DPA as described in this paragraph. communication, notice, press release or
d. Ownership of Personal Data. As between report concerning any Security Incident which
Customer and Kaltura, all Personal Data directly or indirectly identifies Kaltura
Customer provides to Kaltura under the (including in any legal proceeding or in any
Agreement and this DPA, are the property of notification to regulatory or supervisory
Customer. authorities or affected individuals) without
e. Deletion. Upon termination of this DPA and the Kaltura’s prior written approval, unless, and
Agreement, the Personal Data shall be promptly solely to the extent that, Customer is
destroyed or returned to Customer per its compelled to do so pursuant to applicable
request. Where Customer has not expressed a law. In the latter case, unless prohibited by
request with respect to the return or deletion of such laws, Customer shall provide Kaltura
Personal Data at the termination of this DPA, with reasonable prior written notice to provide
Kaltura shall destroy the Personal Data within a Kaltura with the opportunity to object to such
reasonable amount of time at its discretion, not to disclosure and in any case, Customer will limit
exceed 90 days from the termination of this DPA the disclosure to the minimum scope
and/or the Agreement. required.
f. Kaltura’s Retention Policy. Kaltura retains
automatically archiving production and back-up 4. CUSTOMER RESPONSIBILITIES
logs in accordance with its internal policies and a. Customer, in its use of the Services, and
procedures for business operation and security Customer’s Instructions to Kaltura, shall comply
purposes. Upon the expiry or termination of this with Data Protection Laws. Customer shall
DPA and the Agreement, to the extent that ensure that (i) it has established an appropriate
Kaltura’s logs contain Personal Data, such legal basis to Process, and transfer Personal
Personal Data (i) shall not be further Processed Data to Kaltura for Processing, in accordance
by Kaltura, (ii) shall be protected by Kaltura in with this DPA, the Agreement, and the
accordance with the terms of this DPA so long as Instructions, including obtaining express consent
Kaltura retains such Personal Data, and (iii) shall from the Data Subjects, to the extent required by
be destroyed in accordance with Kaltura’s data Data Protection Regulations, (ii) all Data Subjects
retention policies. (including any Users) have been informed of the
g. Details of the Processing. The subject-matter of Processing and transfer to Kaltura of their
Processing of Personal Data by Kaltura is Personal Data.
specified in Schedule 1 (Details of Processing) to b. Customer shall review the information Kaltura
this DPA. makes available regarding its data security,
including the technical and organizational
3. DATA SECURITY measures set out in Annex 2, and independently
a. Security Measures. Kaltura has implemented, determine whether the Services are suitable for
and shall maintain, so long as Kaltura Processes Customer’s requirements.
Personal Data, technical and organizational c. Kaltura makes available various security controls,
measures set out in Annex 2, as may be features, and functionalities that Customer may
amended from time to time, to protect the choose to enable, as described in the
confidentiality, integrity, and accuracy of Personal Documentation. Customer is responsible for
Data. selecting and implementing the appropriate
b. Confidentiality. Kaltura shall ensure that its security measures for securing Personal Data.
personnel who have access to Personal Data are d. Customer shall not use the Services to Process
subject to a duty of confidentiality with respect to any Sensitive Personal Data (excluding Biometric
the Personal Data. Data) where such Processing would impose on
c. Security Incidents. Kaltura any data security or data protection
i. If Kaltura becomes aware of a breach of obligations that differ from or are in addition to
security leading to the accidental or unlawful those set out in the Agreement and this DPA.
destruction, loss, alteration, unauthorized e. Customer shall use the Services in accordance to
disclosure of, or access to, Personal Data Kaltura’s Acceptable Use Policy (“AUP”),
(each a “Security Incident”), Kaltura shall, to available at
the extent permitted by applicable law, notify https://corp.kaltura.com/legal/tos/acceptable-
Version: January 2026 Page 3 of 10
Kaltura Data Processing Agreement
- Confidential -
use-policy/#, which is incorporated herein by personnel, and business/operations while
reference. Customer agrees to comply, and to conducting such audit or inspection,
ensure that its Users comply, with the AUP at all respecting a mutually agreed timeline,
times. Kaltura’s normal business hours, and scope,
(y) maintain the Confidential Information of
5. ASSISTANCE AND COOPERATION Kaltura’s other customers, and (z) shall not
a. Use of Services. For the term of the Agreement compromise any of Kaltura’s security policies.
and taking into account the nature of the v. If the Customer is entitled, pursuant to any
Processing, Kaltura will provide Customer with other contractual arrangement (e.g. the
the ability to correct, delete, or block Processing Agreement) to audit Kaltura’s business for
of Personal Data, or, upon Customer’s any other purpose, this clause shall not give
Instructions, make such corrections, deletions, or rise to an additional audit by the Customer,
blockages on Customer’s behalf. but rather shall solely entitle the Customer to
b. Data Subject Requests ,Privacy Impact include the scope of this clause within the
Assessments and Prior Consultations. Kaltura audit.
shall provide reasonable assistance to Customer
with respect to (a) requests from Data Subjects 6. SUB-PROCESSORS
exercising their rights to access, rectify, erase or a. Appointment of Sub-Processors. Customer
object to processing of Personal Data pursuant to acknowledges and agrees that: (a) Kaltura may
Data Protection Regulations; (b) privacy impact engage Kaltura Affiliates as Sub-Processors, and
assessments carried out by Customer; and (c) (b) Kaltura and Kaltura Affiliates, on behalf of
Customer’s prior consultations with Supervisory Kaltura, may each engage third parties as Sub-
Authorities. Kaltura reserves the right to charge a Processors to Process Personal Data on its
fee for complying with a request for assistance behalf. Kaltura makes available to Customer the
requiring significant effort and/or resources. current list of applicable Sub-Processors used by
c. Audits. Kaltura to Process Personal Data via
i. Kaltura will submit to an audit by an https://corp.kaltura.com/legal/privacy/subprocess
independent, reputable, third-party auditor ors-list. Such Sub-processor list includes the
(“Auditor”) designated by Customer (provided identities of those Sub-processors, the location of
that the Auditor is mutually agreed upon by the Processing and the type of service rendered
the Parties and is not a competitor, or related by each Sub-processor (“Sub-Processor List”).
to or controlled by a competitor, of Kaltura), to Additional optional Sub-Processors may be
demonstrate Kaltura’s compliance with this included in an Order Form approved by
DPA, at Customer’s sole expense, provided Customer. By entering into this DPA, the Sub-
that Kaltura has been given reasonable prior Processor List is hereby deemed authorized by
notice, which shall not be less than twenty Customer.
(20) business days. Customer shall require b. Purpose of Sub-Processing. All Sub-
that the Auditor execute a standard Processors shall be permitted to Process
confidentiality and nondisclosure agreement Personal Data only as necessary to perform the
with Kaltura with respect to the confidential services Kaltura has engaged them to provide
treatment and restricted use of information and shall be prohibited from Processing Personal
gathered in conducting the audit. If required Data for any other purpose.
by Data Protection Regulations, access to c. Agreements with Sub-Processors. Kaltura or a
Kaltura’s facilities by the Auditor shall be Kaltura Affiliate has entered into a written
subject to Kaltura’s reasonable access agreement with each Sub-Processor containing
requirements and security policies. data protection obligations no less protective of
ii. Before conducting any audit, Kaltura shall Personal Data than those in this DPA to the
make available all reasonable information extent applicable to the nature of the services
necessary to demonstrate compliance with provided by such Sub-Processor.
Customer’s privacy, compliance, and d. Objection to new Sub-Processors. Kaltura
information security obligations under this shall inform Customer of any intended addition or
DPA. The Customer will take into replacement of Sub-Processors prior to such
consideration as proof of compliance with this addition or replacement. If Customer objects to
DPA, relevant certifications (such as ISO or such additional or replacement Sub-Processors
SOC), security questionnaires, or other for reasons relating to the protection of Personal
relevant compliance reports held by, or Data to be Processed by the additional or
produced for, Kaltura. replacement Sub-Processor, Customer must
iii. All audits, and any findings or reports notify Kaltura in writing within 10 business days of
resulting from any audit, shall remain subject Kaltura’s such notice of replacement, and the
to the confidentiality obligations set forth in parties shall negotiate in good faith to reach a
the Agreement, shall only be used by mutually acceptable resolution. If the parties are
Customer to assess compliance with this unable to reach a mutually acceptable resolution,
DPA, and shall not be used for any other Customer’s sole remedy shall be termination of
purpose or disclosed to any third party without the Agreement and this DPA with respect to the
Kaltura’s prior written approval. portion of the Services that cannot reasonably be
iv. Customer shall conduct no more than one provided by Kaltura without the use of the
such audit in any twelve-month period unless objected-to Sub-Processor. Failure to object to
(1) otherwise required by Data Protection such new Sub-processor in writing within 10
Regulations, or (2) due to a significant business days following Kaltura’s notice shall be
Security Incident. The Customer shall ensure deemed acceptance of the new Sub-Processor.
that (x) any audit will not cause (or, if it cannot e. Kaltura’s responsibilities for Sub-Processors.
avoid, minimize) any damage, injury, or Kaltura shall remain at all times responsible to
disruption to Kaltura’s premises, equipment,
Version: January 2026 Page 4 of 10
Kaltura Data Processing Agreement
- Confidential -
Customer for the Sub-Processors’ compliance such a way as to exclude Data Subjects in
with this DPA. Switzerland from the possibility of suing for
their rights in their place of habitual residence
7. CROSS-BORDER DATA TRANSFERS (Switzerland) in accordance with Clause
a. Customer acknowledges and agrees that Kaltura 18(c) of the SCCs; and
may Process Personal Data globally to the extent iii. The Swiss Federal Data Protection and
necessary to provide the Services and to fulfil Information Commissioner shall act as the
Kaltura’s other obligations under the Agreement. “competent supervisory authority” insofar as
To the extent any Personal Data subject to the the relevant data transfer is governed by the
GDPR, the UK GDPR, or the FADP is Processed FADP, and the SCCs shall be governed by
by Kaltura outside the European Economic Area, Swiss law and subject to the jurisdiction of the
the United Kingdom, or Switzerland, respectively courts of Switzerland.
,or any country deemed to offer an adequate level iv. Where Swiss Transfers are exclusively
of data protection under or pursuant to the subject to the FADP, all references to the
adequacy decisions published by the European GDPR in the EU SCCs are to be understood
Commission, the UK Secretary of State or the to be references to the FADP;
applicable Swiss authority, as applicable v. Where Swiss Transfers are subject to both
(“Adequacy Decision”), such Personal Data the FADP and the GDPR, all references to the
shall be transferred on the basis of such GDPR in the EU SCCs are to be understood
Adequacy Decision without any further to be references to the FADP insofar as the
safeguards being necessary. If the Processing of Swiss Transfer is subject to the FADP.
Personal Data by Kaltura includes a transfer d. Where a transfer of Personal Data is subject to
(either directly or via onward transfer) from the the UK GDPR, the SCCs shall apply, as amended
EEA, the UK, or Switzerland to other countries by the UK Addendum to the SCCs issued by the
which have not been subject to a relevant Information Commissioner’s Office under
Adequacy Decision, and such transfers are not s.119A(1) of the UK Data Protection Act 2018 and
performed through an alternative recognized attached hereto as Annex 3.
compliance mechanism as may be adopted by e. To the extent any provision of this DPA
Kaltura for the lawful transfer of personal data (as contradicts or is inconsistent with the terms of the
defined in the GDPR, the UK GDPR or the FADP, SCCs with respect to the transferred Personal
as relevant) outside the EEA, the UK or Data, the terms of the SCCs shall prevail, and the
Switzerland, as applicable, then such transfers inconsistent provision of this DPA shall be
shall be made in accordance with Sections 7.b – deemed amended accordingly.
7.d below. f. If, at any time:
b. Where a transfer of Personal Data is subject to i. the laws or regulatory procedures of any
the GDPR or the FADP, the SCCs shall apply. jurisdiction require any further steps to be
The SCCs shall be incorporated by reference into taken in order to permit the transfer of
this DPA and completed as follows: Personal Data as contemplated under this
i. The text of module 2 (Controller to Processor) DPA (including, without limitation, executing
shall apply where Customer is the Controller, or re-executing the SCCs as a separate
and Kaltura is the Processor. The text of document setting out the proposed transfers
module 3 (Processor to Processor) shall of Personal Data, and entering into additional
apply where Customer is the Processor, and cross-border transfer clauses); and/or
Kaltura is the Sub-Processor; ii. the transfer mechanisms in this Section 7 are
ii. The optional docking clause of clause 7 shall (i) amended, replaced or repealed under Data
apply; Protection Regulations, (ii) declared invalid by
iii. In clause 9(a), option 2 shall apply. The time a court of competent jurisdiction, or (iii)
period for providing advance notice of any otherwise terminated, annulled, replaced or
intended changes to the list of Sub- repealed under Data Protection Regulations;
Processors shall be as set forth in section then the parties shall work together to take all
6(d) to this DPA; steps reasonably required and negotiate in
iv. In clause 11(a), the optional language shall good faith any other solution to enable a
not apply; transfer in compliance with Data Protection
v. In clause 17, option 1 shall apply, and the Regulations.
SCCs shall be governed by the laws of the
Republic of Ireland; 8. CALIFORNIA CONSUMER PRIVACY ACT.
vi. In clause 18(b), any dispute arising from the Kaltura acknowledges and confirms that it does not
SCCs shall be resolved by the courts of the receive or process any Personal Information as
Republic of Ireland; and consideration for any services or other items that
vii. The information required by Annex I and Kaltura provides to Customer under the Agreement.
Annex II of the SCCs shall be as set out in As may be applicable to the Services provided under
Annex 1 and Annex 2 of this DPA, the Agreement, Kaltura certifies that it understands
respectively. the rules, requirements and definitions of the CCPA
c. Where a transfer of Personal Data is subject to and agrees to refrain from selling or sharing (as such
the FADP, in addition to the provisions of Section terms are defined in the CCPA) any Personal
7.b above, the following terms shall apply: Information Processed hereunder, without
i. The terms “General Data Protection Customer’s prior written consent or instruction, nor
Regulation” or “Regulation (EU) 2016/679” as take any action that would cause any transfer of
utilized in the EU SCCs shall be interpreted to Personal Information to or from Kaltura under the
include the FADP with respect to Swiss Agreement or this DPA to qualify as “selling” and/or
Transfers; “sharing” such Personal Information under the CCPA.
ii. The term “Union”, “EU” and “EU Member Kaltura acknowledges that Customer discloses
State” in the SCCs shall not be interpreted in Personal Information to Kaltura only for limited and
Version: January 2026 Page 5 of 10
Kaltura Data Processing Agreement
- Confidential -
specified business purposes (as such term is defined respond to such requests without Customer’s prior
in the CCPA) set out in this DPA and the Agreement. consent, except where legally required or to confirm
Kaltura shall process all Personal Information only (i) its receipt.
for such limited and specific business purpose(s), and
(ii) in compliance with applicable sections of the 10. LIMITATION OF LIABILITY
CCPA, in a manner that provides the same or The liability of each party and its respective Affiliates
materially similar level of privacy protection as arising out of or related to this DPA and the
required of Customer considering the Personal Agreement shall not, when taken together in the
Information processed and industry standards. aggregate, exceed the limitation of liability set forth in
Kaltura shall not (i) retain, use, or disclose Personal the Agreement.
Information outside the direct business relationship of
the parties, as described in the Agreement, or for any 11. MISCELLANEOUS
business or commercial purpose other than for the a. If any provision in this DPA is found to be
specific business purpose of performing the Services ineffective or void, this shall not affect the
or as otherwise permitted by the Agreement and/or remaining provisions. The parties shall replace
this DPA, nor (ii) combine Personal Information with the ineffective or void provision with a lawful
personal information Kaltura processes on behalf of provision that reflects the business purpose of the
other parties unless expressly permitted under the ineffective or void provision. The parties shall
CCPA and the Agreement between the parties. similarly add necessary and appropriate
As applicable to the Services provided, Kaltura shall provisions where such provisions are missing.
implement reasonable security measures, as b. The governing law of this DPA will be the same
described in Section 3 of this DPA, as appropriate as the governing law identified in the Agreement.
under the CCPA, and reasonably assist Customer or c. This DPA prevails over any additional, conflicting,
otherwise enable Customer to comply with its or inconsistent terms and conditions appearing in
obligations relating to any request received from an the Agreement and/or any document submitted
individual under the CCPA, as described in Section 5 by either party regarding the Processing of
of this DPA. Customer shall inform Kaltura of any Personal Data.
request received from an individual under the CCPA d. This DPA and its annexes set out the entire
which requires Kaltura’s assistance in order to be agreement and understanding between the
fulfilled by Customer, and shall provide Kaltura all Parties and supersede all previous proposals,
information necessary for it to assist with the request. agreements, and other communications between
Subject to the audit provisions in the Agreement and the parties (whether written, oral or otherwise) in
this DPA, Kaltura acknowledges that Customer has relation to the subject matter of this DPA or
the right to take reasonable and appropriate steps to regarding the Processing of Personal Data. This
ensure that Kaltura uses Personal Information in a DPA may be modified, supplemented, or
manner consistent with Customer’s obligations under amended only by a written agreement signed by
the CCPA. both parties thereto.
Kaltura further acknowledges that Customer has the e. By using the Services, Customer accepts this
right, upon notice, to take reasonable and appropriate DPA and the undersigned represents and
steps to stop and remediate any unauthorized use of warrants that it has full authority to bind the
Personal Information by Kaltura, subject to the Customer to this DPA. If the undersigned cannot,
conditions agreed upon in this DPA, including audit or does not agree to, comply with and be bound
provisions. Kaltura shall notify Customer if Kaltura by this DPA, or does not have authority to bind
makes a determination that it can no longer meet its the Customer or any other entity, please do not
obligations under the CCPA. use the Services.
. f. This DPA shall become effective upon its
9. THIRD PARTY REQUESTS FOR ACCESS execution (the “DPA Effective Date”) and shall
Unless prohibited by applicable law, Kaltura shall automatically terminate upon the termination or
promptly inform Customer of any request, expiration or the Agreement in accordance with
correspondence, inquiry, or complaint received by the terms therein.
Kaltura from a Data Subject, Supervisory Authority,
or other third party in connection with Kaltura’s Both parties accept the terms of this DPA by signing below.
Processing of Personal Data. Kaltura shall not
Each party has read, understands, and agrees to the terms of this DPA. The parties agree that this DPA may be electronically
signed, and that any electronic signatures appearing on this DPA are the same as handwritten signatures for the purposes of
validity, enforceability, and admissibility. This DPA may be executed in counterparts, each of which shall be an original and all of
which, when taken together, shall constitute one and the same instrument.
AGREED TO AND ACCEPTED BY:
Kaltura, Inc. Customer:
Signature: Signature:
Name: Name:
Position: Position:
Date: Date:
Version: January 2026 Page 6 of 10
Kaltura Data Processing Agreement
- Confidential -
ANNEX 1
Details of the Processing
A. LIST OF PARTIES
Data exporter:
• Name: Customer’s entity name as identified in the Agreement
• Address: Customer’s address as specified in the Agreement
• Contact person’s name, position and contact details: Customer’s contact details as specified in the Agreement
• Activities relevant to the data transferred under these Clauses: Receipt of the Services
• Signature and date: These Clauses shall be deemed executed and entered into by Customer as of the DPA Effective Date.
• Role: The data exporter’s role shall be Controller or Processor specified in Section 2.a of the DPA.
Data importer:
• Name: Kaltura, Inc.
• Address: 860 Broadway, 3rd Floor, New York, NY 10003 USA
• Contact person’s name, position and contact details: Kaltura Data Protection Officer, DPO@kaltura.com
• Activities relevant to the data transferred under these Clauses: Provision of the Services
• Signature and date: These Clauses shall be deemed executed and entered into by Kaltura as of the DPA Effective Date.
• Role: The data importer’s role shall be Processor.
B. DESCRIPTION OF TRANSFER
Categories of Data Subjects
The categories of Data Subjects include the Customer and the Users who use the Services, as well as any individual whose
Personal Data is uploaded by the Customer or its Users as part of the Input while using the Services.
Categories of Personal Data Processed
1. Any content, information, text, audio, photo, images, videos or other materials submitted through the Services
(including the within the Input), which may contain Personal Data submitted by the Customer. The extent of such
Personal Data is determined and controlled solely by the Customer. Categories of Personal Data processed may
include: Technical identifiers, including user IDs, user agents, and IP addresses;
2. The names and email addresses of Users in cases where Customer’s User authentication configuration requires this
information;
3. Where Services include virtual event registration, any Personal Data contained in event registration forms;
4. Account activity (including media files uploaded, recorded live sessions, viewing history, likes and comments, chat
history in live meeting solutions, account analytics, and any quizzes taken);
5. Recording data (including video, audio, and screen recordings), face data, audio data, and other biometric data
(including potentially Biometric Data), to the extent captured, processed, or stored by the Services as enabled by
Customer or the Users; and Any Personal Data contained in media content and metadata uploaded to, or transmitted
via, the Services by Customer or its Users.
Special Categories of Data
The Services are not intended for Processing of Sensitive Personal Data, and the Customer agrees that such Sensitive Personal
Data is not included in the scope of the Processing or Services being provided to the Customer. However, to the extent Kaltura
AI systems are used, through certain features Kaltura may process on Customer’s behalf Biometric Data, which could be defined
in certain jurisdictions as Sensitive Data.
Duration and Frequency of the Processing
Processing shall take place on a continuous basis so long as Kaltura continues to provide the Services to Customer in accordance
with the Agreement.
Nature and Purpose of the Processing
Personal Data is Processed for the purpose of providing the Services as set out in the Agreement. Processing activities may
include:
1. Where Customer selects Kaltura’s standard SaaS offering, hosting of Customer’s media content, metadata, and User data
on secure data centers located in the United States; where Customer selects one of Kaltura’s regional SaaS offerings,
hosting of Customer’s media content, metadata, and User data on secure data centers located in Ireland, Canada,
Singapore, or Australia, as applicable. Customer’s media content and metadata may contain Personal Data.
2. Processing and transcoding of media content and metadata, and transmission of data over the internet and/or private
networks to Users via the Services. Processing network traffic and activity on the Services may involve Personal Data of
individuals interacting with the Services. Processing activities may be performed through Sub-Processors. Processing
may take place in any jurisdiction where Users interact with the Services.
3. Performing maintenance and support services on systems which may contain Personal Data or in connection with the
Services.
4. Managing Customer’s account with Kaltura.
Personal Data Retention Period
Personal Data shall be retained by Kaltura for the duration of the Agreement, or as long as it is necessary in order to provide the
Services.
Version: January 2026 Page 7 of 10
Kaltura Data Processing Agreement
- Confidential -
Sub-Processors
With respect to Sub-Processors engaged by Kaltura:
1. The nature and purpose of the Processing is to enable provision of the services that Kaltura has engaged the Sub-
Processors to provide. Each Sub-Processor Processes Personal Data solely to the extent necessary to provide the
contracted services.
2. The subject matter of the Processing may include providing (i) cloud computing infrastructure, (ii) logs analysis, (iii)
content delivery network (CDN) services, (iv) content transcription, translation, and captioning services, (v) customer
service and support, (vi) virtual or hybrid event management services, and (vii) other optional functions that Customer
chooses to enable and/or use via the Services.
3. The duration of the processing shall be for the duration of the Agreement.
To obtain the current list of Sub-Processors applicable to the Services provided to Customer, please visit
https://corp.kaltura.com/legal/privacy/subprocessors-list/.
C. COMPETENT SUPERVISORY AUTHORITY
The competent supervisory authority shall be as determined by the GDPR except insofar as the Processing is subject to the
FADP, in which case the competent supervisory authority shall be the Federal Data Protection and Information Commissioner of
Switzerland, or the UK GDPR, in which case the competent supervisory authority shall be the UK’s Information Commissioner’s
Office.
Version: May 2025 Annex 1 Page 8 of 10
Kaltura Data Processing Agreement
- Confidential -
Annex 2
Technical and Organizational Security Measures
Technical Measures
a. Information Security Program and Certifications: Kaltura maintains documented security policies and procedures
which are reviewed and updated on a regular basis. The Kaltura platform is certified compliant with the ISO27001 and
ISO27799 information security management standards. The scope of the certification encompasses Kaltura’s
production environments, corporate environments, and operations. Kaltura’s platform is hosted on public cloud
infrastructure operated by leading cloud providers that are SOC-1 (formerly SSAE 16) and SOC-2 Type II certified.
b. Encryption: Customer data is encrypted at-rest and in while transit over public or wireless networks using industry
standard encryption protocols.
Organizational Measures
a. Policies and Procedures for Government Access: Kaltura has implemented policies and procedures to manage and
respond to requests from government agencies for access to customer data. These policies and procedures include
determining whether each request is valid, legally binding and lawful, and notifying the affected customer unless
prohibited by applicable laws.
b. Data Minimization: Kaltura collects and processes personal data only to the extent necessary to provide Kaltura
products and services to customers.
c. Sub-Processors: Prior to engaging a sub-processor, Kaltura reviews the sub-processor’s business and operations,
including the sub-processor’s security, privacy, and compliance practices. With respect to each sub-processor that has
access to customer data, Kaltura remains accountable to the customer for the sub-processor’s acts and omissions.
Customer may request Kaltura’s latest security policies for review by contacting DPO@kaltura.com.
Version: May 2025 Annex 2 Page 9 of 10
Kaltura Data Processing Agreement
- Confidential -
Annex 3
UK International Data Transfer Addendum to the EU SCCs
Part 1: Tables
Table 1: Parties
Start date DPA Effective Date
Exporter (who sends the Restricted Importer (who receives the Restricted
The Parties
Transfer) Transfer)
Parties’ details Customer Kaltura
Key Contact Please see Annex 1 of this DPA Please see Annex 1 of this DPA
Signature (if required for Customer’s signature to this DPA shall be Kaltura’s signature to this DPA shall be
the purposes of Section deemed its signature of this UK Addendum. deemed its signature of this UK Addendum.
2)
Table 2: Selected SCCs, Modules and Selected Clauses
Addendum EU SCCs The version of the Approved EU SCCs to which this Addendum is appended is as described in
Section 7.b of this DPA.
Table 3: Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of
the Approved EU SCCs (other than the Parties), and which for this UK Addendum is set out in Annexes 1 and 2 of this DPA.
Table 4: Ending this Addendum when the Approved Addendum Changes
Ending this Addendum Which Parties may end this Addendum as set out in Section 19:
when the Approved
Addendum changes Importer and Exporter
Part 2: Mandatory Clauses
Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before
Parliament in accordance with s119A of the Data Protection Act 2018 on 28 January 2022, as it is revised under Section 18 of
those Mandatory Clauses.
Version: May 2025 Annex 3 Page 10 of 10