1. Introduction, Scope, Definitions

1.1 GotPhoto as Processor or Sub-processor

This is a data processing agreement between the Photographer and Fotografen Online Service GmbH, Hausvogteiplatz 12, 10117 Berlin, Germany (“GotPhoto”)

The Photographer may act as Controller. The term “Controller” is defined within this agreement as follows:

“Controller” is the natural person or legal entity, public authority, agency or other body which alone or jointly with others determines the purposes and means of processing personal information.

If the Photographer obtains the consent for lawful processing of personal information directly from an individual (or in the case of a minor, from their parent(s) or legal guardian) or otherwise lawfully gathers personal information, the Photographer is considered a data controller. In this case GotPhoto acts as a processor for the Photographer. This is a non-exhaustive list of examples how the Photographer can become a controller:

• Parent or legal guardian fills out and signs a physical QR code card consenting to a minor’s participation in a photoshoot and the provision of photos for sale to the parent or legal guardian,
• Parent or legal guardian registers a minor for “photo day” via a notice in the facility, 
• Parent or legal guardian registers a minor online for a photoshoot using an online form,
• Person of legal age consents to the photoshoot and sale of photos through implied behaviour,
• Person of legal age consents to the use of personal information for sending e-mail reminders in the Photographer’s online store.

Alternatively, the Photographer acts as a processor. The term “Processor” is defined within this agreement as follows:

“Processor” is a natural person or legal entity, public authority, agency or other body which processes personal information on behalf of the controller.

If the Photographer receives the data on the basis of a data processing agreement with a third party (who is not the individual, whose personal information is processed, or their parent or legal guardian), e.g. a school / nursery, this third party acts as the controller, the Photographer as the processor and GotPhoto as the sub-processor. 

The term “Processing” or “To Process” is defined in this agreement as follows: 

“Processing” is the collection, use or disclosure of personal information in the course of commercial activities. 

1.2 Scope and Definitions

This agreement applies to all activities in which GotPhoto, employees of GotPhoto or sub-processors commissioned by GotPhoto process personal information that GotPhoto receives from the Photographer.

Terms not specifically defined in this agreement are to be understood as defined in part 1 section 2 of the Personal Information Protection and Electronic Documents Act (PIPEDA). Declarations under this agreement may be made in text form, including by email, unless a stricter form is expressly required in the agreement. Notices of termination must be made in text form.

In the event of any conflict or inconsistency between this Data Processing Agreement and the Principal Contract, the provisions of this Data Processing Agreement shall prevail.

2. Subject and Duration of Processing

2.1 Subject

The processing is based on the conclusion of a contract between GotPhoto and the Photographer (“Principal Contract”), which is formed when the Photographer creates a user account on the GotPhoto website and accepts GotPhoto’s general terms and conditions in their then-current version.

The Principal Contract governs the provision of services by GotPhoto to the Photographer. The Photographer may use these services to serve its own customers (e.g. processing of orders or production and shipping of photo products). Except as otherwise contemplated under this agreement, GotPhoto acts as a (sub)processor with respect to the processing of personal information under this agreement.

2.2 Duration

The duration of this agreement corresponds to the duration of the Principal Contract.

3. Details of the Processing

Information on the nature, the purpose of the processing, the types of personal information processed and the categories of individuals, whose personal information is processed, are detailed in Annex 1 (Processing Details).

4. Obligations of GotPhoto

4.1 GotPhoto processes personal information exclusively as contractually agreed or as instructed by the Photographer, unless GotPhoto is legally required to process personal information in a certain way. If such legal requirements exist, GotPhoto will inform the Photographer before processing any personal information, provided that the communication is not prohibited by law. 

4.2 GotPhoto confirms that it is aware of the applicable privacy and data protection laws.

4.3 GotPhoto and its employees are committed to keeping all personal information confidential. 

4.4 GotPhoto shall assist the Photographer, taking into account the nature of the processing and the information available to GotPhoto, in complying with applicable obligations under privacy and data protection laws. Such assistance shall be provided by making available relevant information through GotPhoto’s standard communication channels (e.g. customer support, documentation, website).

4.5 If GotPhoto receives requests from individuals regarding their personal information, GotPhoto shall, taking into account the nature of the processing, assist the Photographer by appropriate technical and organisational measures in responding to such requests, insofar as this is possible. 

4.6 GotPhoto shall only correct, delete or otherwise restrict the processing of personal information in accordance with this agreement or the documented instructions of the Photographer.

4.7 GotPhoto shall not respond to requests from individuals or third parties directly unless required by applicable law or upon instruction from the Photographer. GotPhoto shall inform the Photographer of such requests without undue delay, to the extent the relevant Photographer can be identified based on the information directly provided in the request or otherwise readily available to GotPhoto without disproportionate effort. GotPhoto shall not be obliged to verify the identity of the requester, assess the validity of the request or undertake additional efforts, searches or investigations to identify the relevant Photographer.

5. Technical and Organisational Measures

5.1 GotPhoto shall implement appropriate technical and organisational measures to protect the personal information processed under this agreement against unauthorized access, loss, destruction, alteration or disclosure. Such measures shall take into account the state of the art, the implementation costs and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and interests of individuals, and shall ensure a level of security appropriate to the risk.

5.2 The data security measures displayed at www.gotphoto.co.uk/dpa-attachments at the time the agreement is concluded shall apply. These measures define the baseline level of security to be implemented by GotPhoto.

5.3 GotPhoto may update the technical and organisational measures from time to time, provided that the level of protection afforded by the measures is not materially reduced. The current version of the technical and organisational measures shall be made available to the Photographer, for example via GotPhoto’s website. 

5.4 GotPhoto shall ensure that personal information processed under this agreement is separated from other data. Logical separation is sufficient. 

6. Data Processing outside of Canada

6.1 Photographer acknowledges and consents that personal information may be processed outside of Canada by GotPhoto using cloud computing or other information technology infrastructure selected by GotPhoto and managed using third parties. Photographer is responsible for providing any notices and obtaining any consents or other authorizations required under applicable privacy laws in connection with the processing of personal information under this agreement, including any cross-border processing of personal information. 

6.2 GotPhoto processes personal information primarily within Germany, the European Union and the European Economic Area. Where personal information is processed in other jurisdictions through GotPhoto or its sub-processors, GotPhoto shall ensure that such processing remains subject to appropriate contractual and organisational protections consistent with this agreement. 

7. Sub-processing

7.1 The Photographer grants GotPhoto a general authorization to engage sub-processors for the processing of personal information under this agreement, including sub-processors located outside of Canada. GotPhoto shall remain fully responsible for the performance of its sub-processors’ obligations in accordance with this agreement.

7.2 GotPhoto maintains an up-to-date list of sub-processors, including their name, address and processing activities, available at www.gotphoto.co.uk/dpa-attachments. By accepting the terms of this agreement the Photographer acknowledges and agrees to the engagement of the sub-processors listed therein. 

7.3 GotPhoto may engage or replace sub-processors at any time. GotPhoto shall update the list of sub-processors accordingly and inform the Photographer of such updates via a global means of communication within the GotPhoto system (e.g. Newsfeed) or by other appropriate means.

7.4 The Photographer may object to the engagement or replacement of a sub-processor on reasonable privacy or data protection grounds within fourteen (14) days of being informed of such change in accordance with section 7.3. In the event of an objection, the Photographer may terminate the agreement in accordance with its terms.

7.5 GotPhoto shall ensure that its sub-processors are contractually bound by privacy and data protection obligations no less protective than those set out in this agreement. 

7.6 The Photographer may request information from GotPhoto regarding the privacy and security measures implemented by its sub-processors. To the extent required and appropriate, GotPhoto shall provide relevant documentation, summaries or third-party certifications (such as audit reports or compliance attestations).

7.7 GotPhoto shall select sub-processors with due care, taking into account their technical and organisational measures and their ability to comply with applicable privacy and data protection laws.

7.8 Where a sub-processor processes personal information outside of Canada, GotPhoto shall ensure that such processing remains subject to appropriate contractual and organisational protections consistent with this agreement. 

8. Obligations of the Photographer

8.1 The Photographer, or where the Photographer acts as a processor, the respective controller, is responsible for ensuring that the processing of personal information complies with applicable privacy laws and that the rights of individuals are protected.  

8.2 The Photographer shall ensure that the processing of personal information is based on a valid legal basis under applicable privacy laws, including obtaining any consents required by law. Where the individual is a minor, the Photographer shall obtain consent from the minor’s parent(s) or legal guardian, if required by applicable law. 

9. Audits and Investigations

9.1. GotPhoto shall make available to the Photographer, upon request, all information reasonably required to demonstrate compliance with its obligations under this agreement and applicable privacy laws. This may include, in particular, documentation, summaries of technical and organisational measures and relevant third-party certifications or audit reports.

9.2. If the Photographer reasonably determines, based on specific and documented grounds, that the information provided pursuant to section 9.1 is insufficient to demonstrate compliance, the Photographer may request additional information or assurance. GotPhoto may satisfy such requests by providing up-to-date certifications, audit reports or other independent third-party attestations. Audits shall primarily be conducted through the provision of documentation and remote means, taking into account the nature of the services, in particular GotPhoto’s use of cloud-based infrastructure and a distributed workforce.

9.3. On-site inspections shall only take place where strictly necessary to verify compliance and where such verification cannot reasonably be achieved by other means. Any on-site inspection shall be subject to prior reasonable notice, confidentiality obligations and agreement on scope and timing, shall be conducted during normal business hours and in a manner that does not unreasonably interfere with GotPhoto’s business operations.

9.4. By way of exception, the Photographer may request an on-site inspection without prior notice or on shorter notice if the Photographer can demonstrate specific facts giving rise to a reasonable suspicion of a material breach of this agreement or applicable privacy laws, or where such inspection is required by applicable law or a competent authority. This right shall only apply where prior notice would be reasonably likely to frustrate the purpose of the inspection. Any such inspection shall be limited in scope to what is strictly necessary to investigate the relevant risk, incident or suspected breach. The Photographer shall inform GotPhoto of the reasons for the inspection as soon as reasonably practicable.

10. Reporting Obligations

10.1. GotPhoto shall inform the Photographer without undue delay after becoming aware of a breach of security safeguards involving personal information.

10.2. Such notification shall include, to the extent available, information regarding the nature of the incident, the categories of personal information affected, the measures taken or proposed to address the incident and any other information reasonably available to GotPhoto that may assist the Photographer in complying with its obligations under applicable privacy laws. Information may be provided in phases as further details become available.

10.3. GotPhoto shall assist the Photographer in complying with any obligations relating to breaches of security safeguards involving personal information. Such assistance shall be limited to the processing activities carried out by GotPhoto on behalf of the Photographer and to the information available to GotPhoto in this context.

11. Instructions

11.1. The Photographer may issue documented instructions regarding the processing of personal information within the scope of this agreement.

11.2. As a rule, instructions shall be issued in text form (e.g. by email to a contact address designated by GotPhoto). In urgent cases, instructions may be given verbally, provided that they are confirmed by the Photographer in text form without undue delay.

11.3. GotPhoto shall inform the Photographer without undue delay if, in its opinion, an instruction infringes applicable law. In such cases, GotPhoto is entitled to suspend the execution of the relevant instruction until it has been confirmed or amended by the Photographer.

11.4. GotPhoto shall document instructions received from the Photographer and their implementation.

12. Use of Anonymized Data

12.1. GotPhoto may anonymize personal information processed under this agreement, provided that such anonymization is carried out in accordance with the requirements set out in this section

12.2. The Photographer acknowledges that the anonymization of personal information may serve both the Photographer’s interests and GotPhoto’s legitimate business purposes, including the improvement and development of GotPhoto’s services through the analysis of customer behaviour, product performance and service usage in aggregated and non-identifiable form.

12.3. GotPhoto shall ensure that any anonymization is performed in such a manner that the information can no longer be attributed to an identified or identifiable individual, taking into account all means reasonably likely to be used by any party to re-identify the information.

12.4. The parties agree that information which has been anonymized in accordance with this section no longer constitutes personal information within the meaning of applicable privacy laws.

12.5. The parties acknowledge and agree that GotPhoto may use anonymized information for its own business purposes, including but not limited to:

• internal analytics and statistical analysis;
• product development and improvement;
• benchmarking and business intelligence; and
• the creation of aggregated reports.

12.6. GotPhoto shall not attempt to re-identify anonymized information and shall implement appropriate measures to prevent re-identification.

12.7. The Photographer shall ensure that all processing of personal information under this agreement, including any anonymization of personal information, is based on a valid legal basis under applicable privacy laws and that individuals are provided with any notices required by law regarding such processing.

13. Termination of the Agreement

13.1. Upon termination of the agreement, GotPhoto shall, at the choice of the Photographer, delete or return all personal information processed on behalf of the Photographer and delete existing copies, unless applicable law requires retention of the personal information. Deletion shall be carried out in a manner that ensures that the personal information cannot be reconstructed or recovered using reasonable means.

13.2. GotPhoto shall ensure that any sub-processors return or delete the personal information processed on behalf of the Photographer without undue delay after termination of their services, unless applicable law requires retention.

13.3. GotPhoto may retain documentation necessary to demonstrate compliance with this agreement and applicable privacy laws for the applicable statutory retention periods. Such documentation shall be subject to appropriate safeguards and shall not be used for any other purposes.

13.4. Notwithstanding the foregoing, personal information contained in backup systems shall be deleted in accordance with GotPhoto’s standard backup retention cycles, provided that such information remains protected and is not actively processed.

14. Termination for Cause

14.1. The Photographer may terminate the Principal Contract and this agreement for cause in the event of a material breach by GotPhoto of the terms of this agreement (“Termination for Cause”).

14.2. A breach shall be considered material if GotPhoto fails to fulfil essential obligations stipulated in this agreement, in particular the implementation of the agreed technical and organisational measures.

14.3. Prior to Termination for Cause, the Photographer shall provide GotPhoto with a reasonable period of time to remedy the breach. If the breach is not remedied within such period, the Photographer shall be entitled to terminate for cause.

14.4. Either party shall have the right to terminate this agreement for cause if the Photographer objects to the engagement or replacement of a sub-processor in accordance with Section 7 of this agreement and the parties are unable to reach agreement.

15. Liability

Any liability arising under or in connection with this agreement shall be subject to the limitations and exclusions of liability set out in the Principal Contract.

16. Miscellaneous

16.1. Each party shall treat the confidential information of the other party, including in particular information relating to technical and organisational measures, as confidential. In case of doubt, information shall be treated as confidential until the other party confirms otherwise in text form. The obligation of confidentiality shall survive the termination of this agreement. Each party may use and disclose information resulting from this agreement to the extent necessary to establish, exercise or defend legal claims.

16.2. Any amendments or additions to this agreement must be made in text form. Text form may be satisfied through electronic communication or the use of electronic signature services.

16.3. If any provision of this agreement is held to be invalid or unenforceable by a court of competent jurisdiction, this shall not affect the validity or enforceability of the remaining provisions.

16.4. This agreement shall be governed by the laws governing the Principal Contract. Any dispute arising out of or in connection with this agreement shall be subject to the dispute resolution provisions set out in the Principal Contract.

Note: This Data Processing Agreement does not require signatures and shall come into effect upon the Photographer’s acceptance of GotPhoto’s general terms and conditions, which reference and incorporate this Data Processing Agreement.

Annex 1 – Processing Details

1. Photographer as Controller

1.1 Nature and Purpose of Processing

The nature and purpose of the processing of personal information by GotPhoto are determined by the Principal Contract. GotPhoto processes personal information on behalf of the Photographer in order to provide the services agreed therein. The processing activities include, in particular:

• the collection of personal information (including via the online shop),
• the storage and organization of personal information,
• the adaptation and modification of personal information,
• the retrieval and provision of personal information,
• the transmission of personal information to service providers engaged by or on behalf of the Photographer (e.g. for production, shipping or payment processing),
• the deletion or restriction of processing of personal information,
• the processing of customer inquiries (e.g. via contact forms),
• the anonymization and aggregation of personal information for statistical, analytical and service optimization purposes, and
• the performance of web audience analysis.

These processing activities serve the following purposes:

• enabling and supporting the processing of orders (e.g. production and shipping of photo products),
• providing and operating the GotPhoto platform, including customer and order management (e.g. complaints handling and payment status),
• enabling online sales and delivery of photos,
• organizing and managing image data (e.g. automatic sorting of photos),
• facilitating communication with customers of the Photographer (e.g. transactional or service-related communications),
• improving and developing GotPhoto’s services based on aggregated and anonymized information, and
• enabling payment processing, where required for the selected payment method.

1.2 Type of Personal Information

The following categories of personal information may be processed:

• image data (in particular photographs of individuals),
• identification data (e.g. first and last name),
• contact information (e.g. postal address, email address, telephone number),
• order and transaction information (e.g. order details, payment status),
• payment-related information (e.g. payment method, transaction identifiers),
• usage and behavioural information relating to the use of the online shop, and
• metadata and organisational information (e.g. group assignments, sorting criteria or similar classification information).

This information is provided either by the Photographer within the GotPhoto system or by the Photographer’s customers when using the online shop, in particular during the order process.

1.3 Categories of Individuals

The categories of individuals include:

• individuals photographed by the Photographer; and
• customers and prospective customers of the Photographer.

2. Photographer as Processor

To the extent that the Photographer processes personal information on behalf of a third-party controller, the Photographer shall act as a processor and GotPhoto as a sub-processor.

In such cases, the nature and purpose of the processing, the types of personal information and the categories of individuals are as described in Section 1 of this Annex.

3. GotPhoto as Controller

To the extent GotPhoto anonymizes personal information processed under the Principal Contract for its own business purposes in accordance with Section 12 of this agreement, GotPhoto acts as an independent controller with respect to the anonymization process only.

Such processing is limited to the anonymization of personal information and the subsequent use of anonymized information for statistical analysis, service improvement, product development, benchmarking, business intelligence and related business purposes.

Last update: 01 July 2026