Data Processing Agreement

1. Parties and Roles

For the purposes of Photographer Personal Data, you act as the controller (or, where applicable, a processor acting on behalf of a further controller) and Osvio acts as a processor within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, where applicable, the Law of Ukraine "On Personal Data Protection".

You are responsible for determining the purposes and means of processing Photographer Personal Data, for having a valid legal basis for collecting and disclosing it to Osvio, and for providing any notices and obtaining any consents required from your Clients and Gallery Visitors under applicable law.

2. Subject Matter and Duration

The subject matter of this DPA is the processing of Photographer Personal Data by Osvio on your behalf in order to provide the Platform. Processing under this DPA begins when you first upload or otherwise submit Photographer Personal Data through the Platform and continues for as long as your Account remains active or until Osvio's processing of the relevant data ends, whichever is later, unless terminated earlier in accordance with the Terms of Use.

3. Nature and Purpose of Processing

Osvio processes Photographer Personal Data as necessary to provide the Platform, including:

• storing, organizing and delivering Galleries and Content;
• operating password-protected or otherwise access-controlled Client galleries;
• performing AI-assisted photo analysis, including face detection and clustering used to group photographs by the person appearing in them, and quality, defect or scene analysis;
• enabling Clients and Gallery Visitors to view, comment on, like or select photographs;
• processing orders for digital add-on products and Memory Vault storage requested through a Gallery;
• synchronizing selections back to a Photographer's Lightroom Classic library through the Osvio plugin;
• keeping records of Clients (contact details and the history of their interaction with Galleries) that the Photographer creates, or that are formed when a Gallery Visitor voluntarily gives their name or email;
• providing customer support relating to the above.

4. Categories of Data Subjects

Photographer Personal Data may relate to:

• your Clients and other individuals appearing in, or identifiable from, your Content;
• Gallery Visitors accessing a Gallery you have created;
• other individuals whose personal data you include in Content or gallery metadata.

5. Categories of Personal Data

Photographer Personal Data processed under this DPA may include:

• photographs and other Content, and metadata associated with them (including EXIF data, timestamps and, where present, geolocation);
• names, email addresses and other contact details used to grant access to a Gallery or deliver Content;
• comments, likes, selections and other interactions recorded within a Gallery;
• Client records kept by the Photographer: names, emails, phone numbers, Instagram handles, and the link between Gallery Visitors and those records;
• Face Data, consisting of facial detection results, numerical representations, embeddings, clustering identifiers and related technical outputs generated by Osvio's AI-assisted photo analysis in order to group photographs by the person appearing in them.

Face Data may constitute special category biometric data under Article 9(1) GDPR where it is used to uniquely identify a natural person. Osvio processes Face Data solely on your documented instructions, solely for the gallery-organization purpose described in Section 3, and does not use Face Data for any other purpose, including any form of identity matching or comparison across different Photographers' Accounts or Galleries.

6. Osvio's Obligations as Processor

Osvio will:

• process Photographer Personal Data only on your documented instructions, including as set out in the Terms of Use, the Privacy Policy and this DPA, unless required to do otherwise by applicable law, in which case Osvio will inform you before processing, unless that law prohibits such notice;
• ensure that personnel authorized to process Photographer Personal Data are bound by appropriate confidentiality obligations;
• implement appropriate technical and organizational measures under Article 32 GDPR, including access controls, authentication, encryption of data in transit and password-protection mechanisms for Client galleries, taking into account the nature of the processing and the risks involved;
• taking into account the nature of the processing, assist you, to a reasonable extent and using appropriate technical and organizational measures, in responding to requests from data subjects exercising their rights under applicable data protection law;
• taking into account the nature of the processing and the information available to Osvio, assist you in complying with your obligations relating to the security of processing, notification of personal data breaches and data protection impact assessments, where applicable;
• make available to you information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, subject to reasonable advance notice, confidentiality and no more than once per year absent a security incident or legal requirement.

7. Sub-processors

You provide Osvio with general authorization to engage sub-processors to support the provision of the Platform. Osvio currently engages the following categories of sub-processors:

• Cloudflare — object storage (R2) and content delivery infrastructure;
• Hetzner — server hosting infrastructure, deployed and managed using Kamal;
• Resend — transactional and account-related email delivery;
• LiqPay, Monopay and Stripe — payment processing for Subscription Plans, digital add-on products and Memory Vault purchases.

Osvio will impose data protection obligations on each sub-processor that are substantially equivalent to those set out in this DPA. Osvio remains responsible for a sub-processor's performance of its data protection obligations to the extent required by applicable law.

Where Osvio adds a new category of sub-processor materially affecting the processing of Photographer Personal Data, Osvio will provide reasonable advance notice, such as by updating this DPA or the Privacy Policy, giving you the opportunity to object on reasonable data protection grounds.

8. Assistance with Data Subject Rights

If Osvio receives a request from one of your Clients or another individual to exercise their rights under applicable data protection law in relation to Photographer Personal Data, Osvio will, where legally permitted, inform you without undue delay and will not respond directly except to confirm receipt and, where necessary, direct the individual to you as the controller, unless applicable law requires otherwise.

9. Security Incidents and Data Protection Impact Assessments

Osvio will notify you without undue delay after becoming aware of a personal data breach affecting Photographer Personal Data, and will provide the information reasonably available to Osvio to enable you to meet your own notification obligations under applicable law.

Osvio will provide reasonable assistance, taking into account the information available to Osvio, if you are required to carry out a data protection impact assessment or prior consultation with a supervisory authority in relation to processing carried out under this DPA.

10. Deletion or Return of Data

You may delete Content and manage access to your Galleries at any time through the Platform's available features. You may also delete your Account at any time through your account settings.

Upon termination of the Terms of Use or, if earlier, upon your request, Osvio will delete or, where technically feasible and reasonably requested, return Photographer Personal Data within a reasonable period, except to the extent applicable law requires Osvio to retain it, including for a limited period in backups, after which it will be deleted or rendered inaccessible in accordance with Osvio's backup procedures.

11. International Data Transfers

Osvio uses infrastructure providers located within the European Union where reasonably possible. Where Photographer Personal Data is transferred outside the European Economic Area, Osvio will implement the safeguards required by applicable data protection law for such a transfer, such as the European Commission's Standard Contractual Clauses or another legally recognized transfer mechanism.

12. Liability

Each party's liability arising out of or relating to this DPA is subject to the limitations of liability set out in the Terms of Use, which apply to this DPA as if fully set out here.

13. Governing Law

This DPA is governed by the law of Ukraine, consistent with the Terms of Use, without prejudice to any mandatory data protection provisions of the law applicable to you or to the relevant data subjects.

14. Effective Date and Term

This DPA takes effect on the date stated at the top of this page and remains in effect for as long as Osvio processes Photographer Personal Data on your behalf under the Terms of Use. Osvio may update this DPA from time to time in accordance with the Terms of Use.

15. Contact Information

Questions about this DPA, or requests relating to Photographer Personal Data, may be sent to: