Parties and scope
This agreement is between you, the photographer or studio holding a Fotoloft account (the controller), and the operator of Fotoloft (the processor, “we”). It forms part of the Terms of Use and applies whenever we process personal data on your behalf. It is meant to meet Article 28 of the EU General Data Protection Regulation (GDPR) and the equivalent rules of other laws that apply to you, including the data protection law of Bosnia and Herzegovina and the UK GDPR.
Where this agreement and the Terms differ about personal data, this agreement prevails. If you need a signed copy, ask us and we will send one.
What we process, and why
- Subject matter and purpose: providing Fotoloft to you: booking, client records, galleries, delivery of photographs, email to your clients, storage and exports.
- Duration: for as long as you use the service, and afterwards until deletion as set out below.
- Nature: collection through your booking page and galleries, storage, generation of smaller versions of photographs, display, delivery, transmission by email, and deletion.
- Data subjects: your clients, the people they book for or share galleries with, the people who appear in your photographs, and your team members.
- Types of data: names, email addresses, phone numbers, booking details and notes, gallery activity (views, downloads, favourites, comments), and photographs with their metadata. Photographs may reveal special categories of data (for example health or religion) or show children; you decide what you upload and are responsible for having a lawful basis for it.
We act on your instructions
We process the data only on your documented instructions, which are these terms and the way you set up and use the service, including transfers outside the EEA described below, unless the law requires otherwise; in that case we will tell you first unless the law forbids it. If we think an instruction breaks data protection law, we will tell you.
We do not use the data for purposes of our own, sell it, use it for advertising, or use it to train machine-learning models.
Confidentiality
Everyone we authorise to process the data is bound by confidentiality, and only those who need access to run or support the service have it.
Security measures
We keep technical and organisational measures appropriate to the risk, including:
- encryption in transit (HTTPS) for all traffic
- private storage, with originals released only through links that expire within minutes
- passwords hashed with Argon2, and session, reset and invitation tokens stored only as hashes
- rate limits on sign-in, and limited, logged administrative access
- infrastructure from established providers who hold their own security certifications
We review these measures as the service changes, and may improve them without lowering the overall level of protection.
Sub-processors
You give us general authorisation to use sub-processors. The current list is in the Privacy Policy: Hetzner (servers and database), Cloudflare (storage and delivery), Backblaze (storage of originals) and Resend (email). Each is bound by data protection terms that give at least the protection of this agreement, and we remain responsible to you for their work.
We will tell you by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you may close your account before the change, and we will refund any prepaid, unused part of your plan.
Helping you meet your obligations
- If one of your clients contacts us directly about their data, we will pass the request to you and not answer it ourselves unless you ask us to. The service gives you the means to find, correct, export and delete their data, and we will help where it does not.
- We will help you, taking into account the information available to us, with security, data protection impact assessments and consulting an authority where that is required.
- If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any event within 48 hours, with what we know about it and what we are doing, and keep you updated.
Deletion at the end
You can export your photographs at any time. When your account is closed, we delete the personal data we process for you, including photographs, within 30 days, except where the law requires us to keep it. Download archives and exports already made expire after seven days.
Information and audits
We will give you the information you reasonably need to show compliance with this agreement, starting with written answers and our providers’ certifications. If that is not enough, you or an auditor bound by confidentiality may audit our processing once a year, at your cost, with at least 30 days’ notice and in a way that does not disrupt the service or expose other customers’ data.
International transfers
We operate from Bosnia and Herzegovina, which does not have an EU adequacy decision, and some sub-processors are in the United States. Where your data is transferred outside the EEA, the UK or Switzerland, the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914 apply: Module 2 between you and us, and Module 3 between us and our sub-processors, together with the UK Addendum and the Swiss adjustments where those laws apply. They are incorporated into this agreement by reference, with the law and courts of Ireland chosen under their clauses 17 and 18, and they prevail over this agreement where the two differ. Where a provider is certified under the EU-U.S. Data Privacy Framework, transfers to it may rely on that instead.
Liability
Each party’s liability under this agreement follows the Terms of Use, except where the law or the standard contractual clauses do not allow it to be limited.
Contact
Questions about this agreement, or a request for a signed copy: info@fotoloft.app.