Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Fotoflo Terms of Service between the account holder ("Customer", the photographer) and Ventured Oy ("Fotoflo", "Processor"). It applies to Fotoflo's processing of personal data on the Customer's behalf under the GDPR (Regulation (EU) 2016/679) and other applicable data protection law, and forms the contract required by article 28 GDPR. Terms used in the GDPR have the same meaning here.

1. Roles and scope

1.1 For personal data that the Customer uploads or collects through Fotoflo about other people ("Customer Personal Data"), the Customer is the controller and Fotoflo is the processor. 1.2 Fotoflo is a controller (not a processor) for its own purposes described in its Privacy Policy: the Customer's account and billing data, support, security logs, content reports and legal compliance. This DPA does not apply to that processing. 1.3 The subject matter, nature, purpose, duration, data and data subjects are in Annex I.

2. Customer's instructions

2.1 Fotoflo processes Customer Personal Data only on the Customer's documented instructions, which are these Terms, this DPA and the Customer's use and configuration of the service, unless EU or Member State law requires otherwise (in which case Fotoflo informs the Customer first, unless the law forbids it). 2.2 The Customer is responsible for having a lawful basis for the processing, for informing the people concerned, and for obtaining any consent required (including consent to marketing through the optional contact form and consent for photographing minors). 2.3 If Fotoflo believes an instruction infringes data protection law, it will tell the Customer.

3. Confidentiality

Fotoflo ensures that people authorised to process Customer Personal Data are bound by confidentiality.

4. Security

Fotoflo implements the technical and organisational measures in Annex II, appropriate to the risk.

5. Sub-processors

5.1 The Customer gives Fotoflo general authorisation to use the sub-processors in Annex III. 5.2 Fotoflo will tell the Customer (by email, or on this page with the date of change) at least 14 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that time; if the parties cannot agree, the Customer may stop using the service and request a refund of unspent credits. 5.3 Fotoflo imposes on each sub-processor data protection obligations no less protective than this DPA and remains responsible for their performance.

6. International transfers

Customer Personal Data is stored in the EU (see Annex III). Where a sub-processor (or its affiliate) accesses or transfers Customer Personal Data outside the EEA, Fotoflo ensures an appropriate safeguard: an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, which are incorporated by reference to the extent needed.

7. Assistance

7.1 Fotoflo helps the Customer respond to requests from data subjects. If a data subject contacts Fotoflo about Customer Personal Data, Fotoflo forwards the request to the Customer where it can identify the Customer, and does not respond to it itself, except to say that it has been forwarded. 7.2 Fotoflo helps the Customer with its obligations on security, personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to Fotoflo.

8. Personal data breaches

Fotoflo notifies the Customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information it has (nature, categories and approximate numbers, likely consequences, measures taken), and keeps the Customer informed as more becomes known.

9. Deletion and return

9.1 Photo files in a project are deleted automatically a few days after the project's delivery window closes (see Annex I). The Customer can delete photos, contacts or a project at any time, and can delete the account, which deletes the Customer's projects, files and collected contacts. 9.2 Customer Personal Data that the Customer has not deleted (project records and collected contact details) is deleted when the Customer deletes it, or within 30 days after the account is closed, except where the law requires Fotoflo to keep it. 9.3 The Customer can export collected contact details from the app before deleting them. Fotoflo does not offer a return of photo files after the project has closed; see section 6 of the Terms (no backup).

10. Audits and information

Fotoflo makes available the information needed to show compliance with article 28 GDPR and allows for audits, including inspections, by the Customer or an auditor the Customer appoints, no more than once a year (unless a regulator requires otherwise or a breach has occurred), on 30 days' written notice, during business hours, subject to confidentiality and at the Customer's cost.

11. Liability, duration, law

11.1 Each party's liability under this DPA is subject to the limitations in the Terms, to the extent the law allows. 11.2 This DPA applies for as long as Fotoflo processes Customer Personal Data. It is governed by the law that governs the Terms (Finland), without prejudice to the GDPR. 11.3 If this DPA conflicts with the Terms on personal data processing, this DPA prevails.

Annex I — Details of the processing

• Subject matter and purpose: hosting and delivering the Customer's photos to the people photographed through client gallery pages; optional collection of viewers' contact details for the Customer; operating, securing and supporting the service.
• Duration: while the Customer's account exists and, for each project, during its delivery window plus the retention periods below.
• Nature of processing: storing, resizing and watermarking images, creating previews, serving them by link, PIN code or QR code, recording gallery access events, storing contact-form entries, deleting data.
• Data subjects: people shown in the Customer's photos; viewers who open the Customer's galleries; people whose contact details are entered in the optional contact form; the Customer's clients.
• Types of personal data: photographs and their file metadata (file name, size, dimensions, capture time, camera make and model; location data is cleared from JPEG originals at upload, and from desktop version 0.6.9); optional contact details (name, email address, phone number, company, a flag showing whether the viewer ticked the marketing box); gallery access logs including IP address, browser details and (for PIN entries) referrer and country, kept for 90 days.
• Special categories: photographs may reveal special-category data (for example ethnic origin or health). Fotoflo does not analyse images for such data or for biometric identification.
• Retention: photo files are deleted about 3 days after the project's delivery window closes (Trial 7 days, paid 20 days); project records and collected contacts are kept until the Customer deletes them or closes the account; IP address and browser details in logs are cleared after 90 days.

Annex II — Security measures

• Encryption in transit (TLS) for all connections; encryption at rest by the infrastructure providers.
• Each account's data is separated by access rules enforced in the database (row-level security); service credentials are used only on the server side.
• Gallery pages are reached by unguessable links; galleries in website mode are additionally protected by PIN codes with rate limiting and a server-side check of the guest session.
• Rate limiting and abuse controls on the main public endpoints.
• Access to production systems limited to the people who need it, using individual accounts.
• Monitoring of errors and security events; personal data breaches are handled and notified in line with GDPR articles 33 and 34.
• Confidentiality undertakings for people with access to personal data.
• Data minimisation: visitor IP addresses and browser details are cleared after 90 days; location data is cleared from JPEG originals; no biometric processing.

Annex III — Sub-processors