--- title: Data Processing Terms | Dive video work instruction platform description: "How Episotech processes personal data for Dive customers: scope, security measures, subprocessors, breach notification and international transfers. English reference translation." --- [![Diveロゴ\_240507\_w250px](https://divedx.com/hubfs/Dive%E3%83%AD%E3%82%B4_240507_w250px.png)](https://divedx.com/ja/?hsLang=en) - [English](https://divedx.com/en/data-processing-terms) - [日本語](https://divedx.com/data-processing-terms) - [Home](https://divedx.com/?hsLang=en) - [Pricing](https://divedx.com/pricing?hsLang=en) - [Demo](https://divedx.com/online-demo?hsLang=en) - [Blog](https://divedx.com/blog?hsLang=en) - [Download Apps](https://divedx.com/ja/app-list?hsLang=en) - [English](https://divedx.com/en/data-processing-terms) - [日本語](https://divedx.com/data-processing-terms) [Login](https://dive-dashboard.vercel.app/) [Free trial](https://dive-dashboard.vercel.app/signup) # Data Processing Terms ## Training DX with Dive - ## **With minimal effort,** - ## **turn tacit knowledge into explicit knowledge** - ## **and help new staff work on their own sooner** *This is an English reference translation of the Japanese [個人データの取扱いに関する条件](https://divedx.com/data-processing-terms?hsLang=en) (established October 22, 2026). Only the Japanese version is legally binding. If this translation and the Japanese version differ, the Japanese version prevails.* Episotech Ltd. (the "Company") sets out below, as "Other Rules" under Article 2, paragraph 2 of the [Dive Terms of Service](https://divedx.com/en/service-terms?hsLang=en) (the "Terms"), the terms that apply when it processes personal data on behalf of the Customer in providing the Service under the Terms (these "Data Processing Terms"). Terms not defined in these Data Processing Terms have the meanings given in the Terms. ### Article 1 (Scope) 1. These Data Processing Terms apply where the Company, on behalf of the Customer and in order to provide the Service, processes personal data contained in Submitted Information or other information that the Customer or Users register in the Service ("Customer Personal Data"). 2. Personal information, such as contact details of the Customer's representatives and Users, that the Company processes for its own purposes, including concluding and managing contracts, billing usage fees, receiving and answering inquiries and sending notices about the Service, is processed by the Company at its own responsibility under its [Privacy Policy](https://divedx.com/privacy-policy?hsLang=en) (Japanese) and not under these Data Processing Terms. 3. These Data Processing Terms supplement the Terms. Matters not provided for in these Data Processing Terms are governed by the Terms. ### Article 2 (Roles of the Parties and Details of Processing) 1. The Customer determines the purposes and means of the processing of Customer Personal Data (a controller under the EU General Data Protection Regulation (the "GDPR") and similar laws, and the entrusting party under Japan's Act on the Protection of Personal Information), and the Company processes Customer Personal Data on behalf of the Customer (a processor under the GDPR and similar laws, and the entrusted party under that Act). 2. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1. 3. The Customer is responsible for having in place the notices to data subjects, consents and any other basis required by applicable law for having Customer Personal Data processed in the Service. ### Article 3 (Instructions) 1. The Company processes Customer Personal Data only in accordance with the Terms, these Data Processing Terms and the settings and operations of the Service made by the Customer and Users (together, the "Customer's Instructions"), and does not process it beyond what is necessary to provide the Service. However, where processing is required by law, the Company follows that law. In that case, unless the law prohibits it, the Company informs the Customer in advance. 2. If the Company considers that any of the Customer's Instructions infringes applicable law, it informs the Customer. 3. The Company does not use Customer Personal Data to train artificial intelligence models. ### Article 4 (Confidentiality) The Company imposes confidentiality obligations on its officers and employees and on the personnel of Subprocessors who process Customer Personal Data. The Company's personnel access Customer Personal Data only in the cases set out in Article 10, paragraph 4 of the Terms and where required by law. ### Article 5 (Security Measures) The Company operates an information security management system based on ISO/IEC 27001 and takes the measures set out in Annex 2 to prevent leakage, loss or damage of Customer Personal Data and otherwise keep it secure. The Company may review these measures as technology advances, but will not lower the overall level of protection. ### Article 6 (Subprocessors) 1. The Customer authorizes the Company to entrust the processing of Customer Personal Data to the parties listed in Annex 3 ("Subprocessors"). 2. The Company enters into contracts with Subprocessors (including the standard terms set by the Subprocessors) that impose obligations to protect Customer Personal Data at a level equivalent to these Data Processing Terms, and supervises the Subprocessors. The Company is responsible for the processing of Customer Personal Data by Subprocessors in accordance with the Terms and these Data Processing Terms. 3. When adding or replacing a Subprocessor, the Company will, as a rule, update Annex 3 at least 14 days in advance and inform the Customer by posting on the Website or by email. However, where urgently necessary to ensure security or the continuity of the Service, the Company will inform the Customer promptly after the addition or replacement. 4. The Customer may object to the Company, stating reasonable grounds, within 14 days of the date of the notice under the preceding paragraph. In that case, the Company and the Customer will discuss the matter in good faith, and if it is not resolved, the Customer may cancel the Agreement. ### Article 7 (International Transfers) 1. Customer Personal Data is stored or processed in the countries and regions listed in Annex 3. 2. Transfers of Customer Personal Data from the European Economic Area to the Company rely on the adequacy decision adopted by the European Commission for Japan. Transfers from the Company to Subprocessors outside Japan are made on the basis of the standard contractual clauses included in the contracts with those Subprocessors or other safeguards permitted by applicable law. 3. If the laws of any country or region other than those referred to in the preceding paragraph require additional measures for international transfers, the Company will cooperate to a reasonable extent at the Customer's request. ### Article 8 (Requests from Data Subjects) 1. So that the Customer can respond to requests from data subjects for disclosure, correction, deletion, suspension of use and other requests, the Service provides functions to view, edit, delete and export Customer Personal Data. 2. If the Company receives a request directly from a data subject, it passes the request on to the Customer to the extent permitted by law and does not respond to it without the Customer's instructions. 3. Where the functions of the Service are not sufficient, the Company will cooperate to a reasonable extent at the Customer's request. ### Article 9 (Notification of Breaches) 1. When the Company becomes aware of any leakage, loss or damage of Customer Personal Data, or any situation in which these are likely to have occurred (a "Breach"), it notifies the Customer without undue delay. 2. To the extent known at the time, the notice under the preceding paragraph includes a description of the Breach, the types and approximate numbers of the personal data and data subjects affected, the measures the Company has taken and plans to take, and the Company's contact point. Matters not yet known will be provided as soon as they become known. 3. The Company provides, to a reasonable extent, the information the Customer needs to report to supervisory authorities or to notify data subjects, extracts and provides records of access to Customer Personal Data at the Customer's request, and endeavors to investigate the cause and prevent recurrence. 4. Notification or cooperation under the preceding paragraphs is not an acknowledgment by the Company of responsibility for the Breach. ### Article 10 (Cooperation with Impact Assessments) If the Customer carries out a data protection impact assessment or a prior consultation with a supervisory authority, the Company will cooperate to a reasonable extent by providing these Data Processing Terms, the Annexes, its public information on security and its answers to the Customer's questionnaires. ### Article 11 (Handling at the End of the Agreement) 1. The Customer may export Customer Personal Data using the functions of the Service until the end of the Agreement. If the Customer so requests within 30 days after the end of the Agreement, the Company will cooperate to a reasonable extent in the export of Customer Personal Data. 2. The Company deletes Customer Personal Data in accordance with Article 10, paragraph 3 of the Terms. 3. If the Customer requests deletion by email or another method prescribed by the Company, the Company deletes the Customer Personal Data without undue delay and informs the Customer that it has done so. 4. Customer Personal Data contained in backups is erased when the backup retention period (up to 91 days) expires. 5. Personal data that must be retained by law is retained only for the period required by that law and is not processed for any other purpose. ### Article 12 (Audits) 1. As information necessary to demonstrate compliance with these Data Processing Terms, the Company provides information on its ISO/IEC 27001 certification, these Data Processing Terms and the Annexes, its public information on security and its answers to the Customer's questionnaires. 2. If the information under the preceding paragraph is not sufficient and an audit is required by applicable law or by a supervisory authority, the Customer may conduct an audit by reviewing documents and holding online interviews, after giving the Company at least 30 days' notice. Such audits are limited to once a year, except where a Breach has occurred or a supervisory authority requires otherwise. 3. The Customer bears the cost of audits under the preceding paragraph and treats information learned in an audit as confidential. Audits do not include entry into the facilities of Subprocessors, information of other customers or the source code of the Service. For Subprocessors, the third-party certifications and similar information they publish are used instead. Where necessary to investigate a serious incident, the Company will discuss alternative means, such as extracting records, with the Customer. ### Article 13 (Liability) The Company's liability in connection with these Data Processing Terms is subject to Article 16 of the Terms. ### Article 14 (Changes) The Company may change these Data Processing Terms by applying Article 19 of the Terms mutatis mutandis. However, except where required by applicable law, the Company will not make changes that lower the level of protection of Customer Personal Data. Updates to Annex 3 are made in accordance with Article 6. ### Article 15 (Language) The Japanese text of these Data Processing Terms is the original. The English translation is provided for reference only, and if the two differ, the Japanese version prevails. ### Annex 1: Details of Processing - Subject matter and purpose: provision of the Service, including the creation, management and sharing of work instructions, records of viewing and training, analysis and generation by artificial intelligence, translation, text-to-speech, AR, remote support calls, delivery of notification emails, and support at the Customer's request - Nature: storage, viewing, editing, delivery, analysis, translation, speech synthesis, deletion and other processing necessary to provide the Service - Duration: the term of the Agreement and the period until deletion under Article 11 - Categories of data subjects: the Customer's Users (employees, temporary staff, personnel of the Customer's contractors and business partners, etc.), people recorded in the videos, images or audio of work instructions, people who view work instructions through the external sharing function, and participants in remote support calls - Types of personal data: names, email addresses, identifiers such as employee numbers, roster information such as affiliation, department, job title and site, login and usage records (including IP addresses, dates and times, and device information), training, evaluation and qualification records, answers to questions, videos, images, audio and text contained in work instructions, video and audio of remote support calls, and camera images for AR positioning - Special care-required personal information under Japanese law and special categories of personal data under Article 9 of the GDPR: not expected to be processed. The Customer shall not have such data processed in the Service. ### Annex 2: Security Measures - Organizational: operation of an information security management system certified under ISO/IEC 27001:2022 (certificate number GIJP-1469-IC), establishment and communication of the [Information Security Policy](https://divedx.com/en/security-policy?hsLang=en), and training of employees - Personnel: confidentiality obligations for officers, employees and Subprocessor personnel, and limitation of the people who can access Customer Personal Data - Access control: control of Users' access by team and role, multi-factor authentication, restriction of access by IP address (where set by the Customer), and account lockout after repeated failed logins - Encryption: encryption in transit (TLS) and encryption at rest provided by the cloud infrastructure - Logging and monitoring: audit logs (which the Customer's owners can export from the admin screen), access records in the cloud infrastructure, and blocking of malicious traffic by a web application firewall - Availability: daily backups of the database (retained for up to 91 days) - Vulnerability management: regular automated scans of the source code and of the software used (including dependent packages) - Subprocessor management: contractual obligations imposed on Subprocessors and review of their third-party certifications and similar information ### Annex 3: List of Subprocessors (as of October 22, 2026) | Subprocessor | Processing entrusted | Countries and regions where data is processed | | --- | --- | --- | | Google LLC (Google Cloud, Firebase) | Database, file storage, servers, authentication, analysis by artificial intelligence (Vertex AI), video conversion, translation, text-to-speech, content delivery network | Singapore (main database); Japan (storage of videos and images, analysis by artificial intelligence, servers, notification emails waiting to be sent); and the United States (authentication, translation). Text-to-speech is processed in regions determined by Google, and the content delivery network uses locations in various regions | | Vercel Inc. | Delivery and execution of the web application | Japan (Tokyo). The content delivery network uses locations in various regions | | Microsoft Corporation (Azure AI Speech) | Text-to-speech for languages not supported by Google's text-to-speech (the text to be read aloud) | Japan (Japan East region) | | RAKUS Light Cloud Co., Ltd. (blastengine) | Delivery of notification emails (recipient, subject and body) | Japan | | Agora, Inc. | Video calls for remote support (video and audio) | United States and other regions (calls are relayed through locations in various regions) | | Immersal Oy | AR positioning in the browser (camera images) | European Economic Area | Processing is entrusted to Microsoft Corporation, Agora, Inc. and Immersal Oy only when the respective functions are used. Contact for these Data Processing Terms: Personal Information Protection Manager, Episotech Ltd. ([privacy@episotech.com](mailto:privacy@episotech.com))   Established October 22, 2026 [![Diveロゴ\_240507\_w250px](https://divedx.com/hubfs/Dive%E3%83%AD%E3%82%B4_240507_w250px.png)](https://divedx.com/ja/?hsLang=en) Episotech Ltd. 2-40-12, Honamanuma, Suginami-ku, Tokyo, Japan, 167-0031 ![スクリーンショット 2024-12-09 102515](https://divedx.com/hs-fs/hubfs/%E3%82%B9%E3%82%AF%E3%83%AA%E3%83%BC%E3%83%B3%E3%82%B7%E3%83%A7%E3%83%83%E3%83%88%202024-12-09%20102515.png?width=1472&height=586&name=%E3%82%B9%E3%82%AF%E3%83%AA%E3%83%BC%E3%83%B3%E3%82%B7%E3%83%A7%E3%83%83%E3%83%88%202024-12-09%20102515.png)   ### Product - [Pricing](https://divedx.com/ja/pricing?hsLang=en) - [Features](https://divedx.com/feature?hsLang=en) - [Security](https://help.divedx.com/hc/en-us/articles/4971856107038) ### Support - [Contact](https://divedx.com/contact?hsLang=en) - [Documents](https://help.divedx.com/hc/en-us) - [Release info](https://help.divedx.com/hc/en-us/categories/4948410523422) - [Download Apps](https://divedx.com/ja/app-list?hsLang=en) - [Online demo](https://divedx.com/en/online-demo?hsLang=en) - [Partner](https://divedx.com/partnerlist?hsLang=en) ### Media - [Dive blog](https://divedx.com/blog?hsLang=en) ### Policy - [Service terms](https://divedx.com/service-terms?hsLang=en) - [Information Security Policy](https://divedx.com/security-policy?hsLang=en) - [Privacy Policy](https://divedx.com/privacy-policy?hsLang=en) - [Service terms for Equipment Rental](https://divedx.com/rental-service-terms?hsLang=en) ### Company - [About](https://www.episotech.com/) - [Recruitment](https://www.episotech.com/recruit/) © 2026 Episotech Ltd. [無料プランで開始Start for free](https://app.divedx.com/signup) [資料ダウンロード](https://share.hsforms.com/1xVJ9-MXuTQeYbDAe2izGfwrznxi) [Book a demo](https://divedx.com/en/online-demo?hsLang=en)