Data processing and your responsibilities
How responsibility is shared when you create video with Mozaik — guest consent, the data-relevant controls, and the DPA (AVV) under Art. 28.
Written By David Kettner
Last updated About 6 hours ago
When you create video with Mozaik, data protection is a shared responsibility. Mozaik acts as a processor: it provides the platform, hosting, and controls, and processes personal data on your behalf. As the customer, you are the controller: you decide who is recorded, what you upload, and how the footage is used — so the lawful use of that data is your responsibility. This article explains the practical steps and settings that help you meet your own obligations. It's a starting point, not legal advice.
Get consent from the people you record
Anyone who appears in a recording — employees, customers, and especially external guests you invite — has rights over their own personal data. Before you record or upload footage of a person, make sure you have a lawful basis for it, which usually means their consent.
Mozaik gives you a built-in control for this. Under Settings → Organization → Organization settings, the Request consent from guests toggle means, in Mozaik's own words: "If activated, guests will be asked to agree via a consent link before accessing their account." Turn it on if your organization wants recorded consent from external contributors before they start.
Good to know: A guest invitation is a single-use, per-project recording invite. Consent covers the person and the footage — it's separate from the invitation itself.
The organization controls that affect data
A few settings change how and where data is handled. Review them with your data-protection needs in mind:
Request consent from guests (Settings → Organization → Organization settings) — asks guests to agree via a consent link before they access their account.
Stream content via global CDN (Settings → Organization → Organization settings) — Mozaik describes it as: "Improves loading times and reduces buffering through global CDN streaming, while data may be streamed through servers outside the EU." Turn it off if content must stay within EU-based infrastructure.
Integration of U.S. third-parties (Settings → Preferences) — a preference that controls whether U.S.-based third-party services are integrated. Review it if your organization needs to limit data transfers to U.S. providers.
Good to know: Enabling U.S. third-party integrations can mean personal data is transferred to providers in the USA — a third country without a level of data protection equivalent to the GDPR. Only enable it if your organization accepts that trade-off; where such transfers happen, Mozaik relies on Standard Contractual Clauses (SCCs) and additional safeguards.
The data processing agreement (DPA / AVV)
If your organization needs a data processing agreement, Mozaik offers one under Art. 28 GDPR — in German, an Auftragsverarbeitungsvertrag (AVV). According to Mozaik's privacy policy, you can request it via the chat on Mozaik's website or by emailing datenschutz@mozaik-app.com. Where personal data is transferred to third countries such as the USA, Mozaik states that it relies on Standard Contractual Clauses (SCCs) together with further safeguards.
Good to know: A DPA/AVV is usually what your legal or procurement team wants on file before rolling Mozaik out across the organization.
Where the legal and privacy details live
For the binding specifics, always rely on Mozaik's own documents rather than this help article:
Privacy policy — mozaik-app.com/privacy
Data processing agreement (DPA / AVV) — on request
Terms / GTC — mozaik-app.com/terms
For a high-level overview of how Mozaik supports GDPR (DSGVO), see the GDPR compliance article in this collection. For where your data is stored, see the EU hosting article.
Good to know: Mozaik provides the tools, controls, and agreements to support your compliance, but the lawful use of the data — consent and what you upload — is your responsibility. This article is general guidance, not legal advice; for anything binding, rely on the documents above and your own legal counsel.