Data Processing Agreement
Art. 28 GDPR agreement — we process customer content on your behalf.
1. Roles
For content you upload or generate (Inputs, prompts, Outputs, product data), you are the controller and [Company legal name] is your processor. For account, billing, security and product-analytics data we act as an independent controller (see Privacy Notice).
2. Subject matter and duration
Processing of customer content to provide the Service, for the term of the Terms plus the deletion periods below.
3. Categories of data and data subjects
Images (which may depict persons such as models, employees, customers), product data, marketing texts, metadata. Data subjects: persons depicted in uploads; your users. We do not intentionally process special categories of data; we do not create biometric templates.
4. Instructions and confidentiality
We process only on your documented instructions (use of the Service constitutes such instructions), ensure personnel confidentiality and do not use your content for training AI models.
5. Security (Art. 32)
Encryption in transit and at rest, encrypted storage of credentials and tokens, tenant isolation (row-level security), least-privilege access, audit logging, backups, incident response. [Annex TOMs to be completed.]
6. Sub-processors
You authorise the sub-processors listed on the Sub-processors page. We notify you at least [30] days before adding or replacing a sub-processor; you may object on reasonable grounds. Workspaces set to “EU only” are not routed to non-EU AI providers.
7. International transfers
Transfers to third countries (e.g. OpenAI in the USA) rely on the EU-US Data Privacy Framework where the recipient is certified and, in addition, on the EU Standard Contractual Clauses (Module 3). A transfer impact assessment is available on request.
8. Assistance, deletion and audits
We assist with data-subject requests (including erasure of all data relating to a depicted person), DPIAs and breach notifications (without undue delay, at the latest within [48] hours of becoming aware). Uploads depicting real people are deleted automatically after the workspace retention period; other content is deleted within [30] days after termination. Audit rights per Art. 28(3)(h) GDPR.