The policy establishes that enterprise customers (employers or other purchasing entities) act as data controllers for Customer Data submitted to the platform, while Synthesia acts as data controller for Other Information it independently collects. Synthesia processes Customer Data only on customer instructions.
This analysis describes what Synthesia's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision allocates primary compliance responsibility for Customer Data governance to enterprise customers, establishing that those customers determine the purposes and conditions of processing for user-submitted content including avatar samples, scripts, and videos. Authorized users with questions about Customer Data handling are directed to their employer or the relevant enterprise customer rather than Synthesia.
Under this clause, individual users authorized by an enterprise customer have limited direct recourse against Synthesia regarding Customer Data processing, as the policy positions the enterprise customer as the data controller responsible for those processing decisions. Users seeking information about how their employer's Synthesia instance handles their data should contact the enterprise customer directly.
Cross-platform context
See how other platforms handle Controller and Processor Role Allocation and similar clauses.
Compare across platforms →"Certain jurisdictions distinguish between a "controller" or "processor" of personal data. A controller is the decision-maker and exercises overall control over how and why personal data is collected and used. In general, the Customer is the controller of Customer Data. A processor acts on behalf of, and only on the instructions of, the relevant controller. In general, Synthesia is the processor of Customer Data and the controller of Other Information (which is described in the 'Personal data that we process' section below). Synthesia is the controller of Other Information and a processor of Customer Data.Excerpt from Synthesia's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision allocates primary compliance responsibility for Customer Data governance to enterprise customers, establishing that those customers determine the purposes and conditions of processing for user-submitted content including avatar samples, scripts, and videos. Authorized users with questions about Customer Data handling are directed to their employer or the relevant enterprise customer rather than Synthesia.
Under this clause, individual users authorized by an enterprise customer have limited direct recourse against Synthesia regarding Customer Data processing, as the policy positions the enterprise customer as the data controller responsible for those processing decisions. Users seeking information about how their employer's Synthesia instance handles their data should contact the enterprise customer directly.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Synthesia.