Data Processing Agreement

Last updated: November 4, 2026. Operated by GoChiHQ — Ontario sole proprietorship (BIN 1001793631), Kitchener, Ontario, Canada. This agreement supplements the privacy policy and the client services terms. For personal data you send us as a client, this agreement governs.

The arrangement, in plain language

GoChiHQ's work starts with your files: raw footage, audio and stems, scripts, logos and briefs — and those files can contain personal data (faces and voices in footage, names in a brief, contact details on a booking). When you send them, you are the controller of that personal data (under Canada's PIPEDA, the organization responsible for it; under the EU/UK GDPR, the controller) and GoChiHQ is your processor — we handle the data only to produce what you booked. This page is the written agreement for that handling, and it applies to business clients across the Services Hub and to Software Hub users who supply files or data to a hub tool.

1. What we process, and for whom

• Client-supplied files — footage, audio, images, scripts and project files you send through the raw-file intake, and the personal data inside them (for example, images and voices of you, your staff, your customers or performers).
• Engagement data — your name, business name, email address and the details of your booking, needed to run the engagement and deliver the finished work.
• Hub data — files and content you create or upload in a Software Hub tool under your GoChiHQ account.

2. Only on your instructions — purpose limitation

• We process your data only to provide the services you booked — producing, captioning, finishing and delivering your work, and communicating with you about it — following your instructions in the booking and intake exchange.
• Never for our own purposes: client files are never reused for anyone else, never used to train anything, never mined for marketing, and personal data is never sold. Raw or finished, your files are yours.
• If an instruction would require us to break privacy law, we will tell you before acting on it. We disclose your data to anyone else only where the law requires it (for example a court order), and we tell you first unless the law forbids it.

3. Confidentiality

Access to client files and data is limited to the people producing your work, and everyone who handles them works under the confidentiality terms in the client services terms. Unreleased footage, tracks and scripts are treated as confidential by default.

4. Security measures

• No public upload page. Your upload route is issued to you personally at intake, so unreleased footage and masters never sit on a public link.
• Files move over encrypted (TLS) connections through the providers in section 5 — the same encrypted channels your own email and browser use.
• GoChiHQ accounts are password-protected, each client's files are kept separate from every other client's, and we use only the providers named below — no shadow tools with your data.
• No card data, ever. Payments run on Stripe-hosted pages; no GoChiHQ system stores, processes or transmits card numbers (see Payments security).

5. Sub-processors — who else touches the data, and why

We rely on a short list of providers, each handling only what its job needs, under its own privacy and security terms. This list is the transparency record — if we ever change a provider that handles client data, the change is posted on this page.

• Hosting & content delivery — Cloudflare (this website and its delivery network).
• Payments — Stripe (card payments and receipts, on Stripe-hosted pages; Interac e-Transfer and PayPal run inside your own bank/PayPal account).
• Accounts — Supabase (the free GoChiHQ account used by /start and GoChi-Trade).
• Forms — Web3Forms (relays contact-form submissions to our inbox).
• Email — our email providers (intake, delivery and correspondence).
• File transfer & storage — the secure transfer/storage services used to issue your personal upload link and to hold working files during production.
• Merchandise — Fourthwall and Zazzle (only for store orders, under their own policies — they are the sellers of record there).

6. Help with people's rights

If a person whose data sits in files you sent us asks to access, correct or delete it — or asks under the GDPR to restrict or port it — that request is yours to answer as controller, and we will help: we will forward any request that reaches us, and we will act on your instructions for the copies we hold, within a reasonable time. Your own rights over data we hold about you directly are in the privacy policy.

7. International transfers

GoChiHQ is in Ontario, Canada, and serves clients worldwide. Some providers in section 5 process data in Canada, the United States or other countries where they operate. For clients in the EU/EEA: the European Commission has recognized Canada's PIPEDA as providing adequate protection for personal data transferred for commercial purposes, and the safeguards in this agreement apply wherever the data is handled for you.

8. If something goes wrong — breach notification

If we become aware of a security breach involving personal data we process for you, we will notify you without undue delay after becoming aware of it, with what we know about what happened and which data was involved, and we will cooperate with your own notification duties. We will also take the steps open to us to contain the breach and protect the data.

9. Return or deletion when the engagement ends

• When your engagement ends, or at any time on your request, we will return your client-supplied files to you and delete our working copies, or delete them outright if you prefer — and confirm in writing when it's done.
• The exception is the business record itself: invoices, receipts, booking and agreement records are kept for six years, as the Canada Revenue Agency requires for business records (see the privacy policy). That retention covers the paperwork — not your raw footage, tracks or project files.
• Finished deliverables we sent you are yours to keep forever; deleting our working copies never affects your copies.

10. Order of documents

For client engagements, the documents rank this way: your booking confirmation first, then this agreement and the client services terms, then the privacy policy and terms of service. We may update this agreement; the version published here when your booking was confirmed governs that engagement.

Contact

Data-protection questions and requests: hello@gochihq.com · +1 519-731-1860.