1. Introduction, Scope, Definitions

1.2 GotPhoto as Processor or Subprocessor

This is a data processing agreement between the Studio and GotPhoto, Inc., 305 Broadway – Floor 7, New York, NY 10007, United States (“GotPhoto”)

The Studio may act as Controller. 

“Controller” means the natural person or legal entity, public authority, agency or other body which alone or jointly with others determines the purposes and means of processing personal information.

If the Studio obtains consent for the lawful processing of personal information directly from an individual (or in the case of a minor, from the individual’s parent(s) or legal guardian) or otherwise lawfully collects personal information, the Studio is considered a Controller. In this case GotPhoto acts as a Processor for the Studio. This is a non-exhaustive list of examples how the Studio can become a Controller:

• Parent or legal guardian fills out and signs a physical QR code card consenting to a minor’s participation in a photoshoot and the provision of photos for sale to the parent /  legal guardian
• Parent or legal guardian registers a minor for “photo day” via a notice in the facility 
• Parent or legal guardian registers a minor online for a photoshoot using an online form
• Person of legal age consents to the photoshoot and sale of photos through implied behaviour
• Individual consents to the use of personal information for sending e-mail reminders in the Studio’s online store.

Alternatively, the Studio acts as a processor. 

“Processor” means a natural person or legal entity, public authority, agency or other body which processes personal information on behalf of the controller.

If the Studio receives the data on the basis of a data processing agreement with a third party (who is not the individual concerned or the individual’s parent / legal guardian), e.g. a school / nursery, such third party acts as the Controller, the Studio as the Processor and GotPhoto as the sub-processor. 

1.2 Scope and Definitions

This agreement applies to all activities in which GotPhoto, employees of GotPhoto or subprocessors commissioned by GotPhoto process personal data that GotPhoto receives from the Studio.

Terms not specifically defined in this agreement shall have the meaning given to them under applicable Data Protection Laws. Data Protection Laws means any applicable United States federal, state or local laws, regulations or other legal requirements relating to privacy, data protection, data security or the processing of personal information. Notices under this agreement may be provided electronically, including by email, unless a stricter form is expressly required.

In the event of any conflict or inconsistency between this Data Processing Agreement and the Principal Contract, the provisions of this Data Processing Agreement shall prevail.

2. Subject and Duration of Processing

2.1 Subject

The processing is based on the conclusion of a contract between GotPhoto and the Studio (“Principal Contract”), which is formed when the Studio creates a user account on the GotPhoto website and accepts GotPhoto’s general terms and conditions in their then-current version.

The Principal Contract governs the provision of services by GotPhoto to the Studio.  The Studio may use these services to serve its own customers (e.g. processing of orders or production and shipping of photo products). Except as otherwise contemplated under this agreement, GotPhoto acts as a (sub)processor with respect to the processing of personal information under this agreement.

2.2 Duration

The duration of this agreement corresponds to the duration of the Principal Contract.

3. Details of the Processing

Information on the nature, the purpose of the processing, the types of personal data processed and the categories of data subjects are detailed in Annex 1 (Processing Details).

4. Obligations of GotPhoto

4.1 GotPhoto processes personal information exclusively as contractually agreed or as instructed by the Studio, unless GotPhoto is legally required to process personal information in a certain way. If such legal requirements exist, GotPhoto will inform the Studio before processing any data, provided that the communication is not prohibited by law. 

4.2 GotPhoto confirms that it is aware of the applicable Data Protection Laws.

4.3 GotPhoto and its employees are committed to keeping all personal information confidential. 

4.4 GotPhoto shall assist the Studio, taking into account the nature of the processing and the information available to GotPhoto, in complying with applicable Data Protection Laws. Such assistance shall be provided by making available relevant information through GotPhoto’s standard communication channels (e.g., customer support, documentation, website, etc.).

4.5 If the Studio receives requests from an individual, GotPhoto shall, taking into account the nature of the processing, assist the Studio by appropriate technical and organisational measures in responding to such requests, insofar as this is possible. 

4.6 GotPhoto shall not respond to an individual’s or third party’s requests directly unless required by applicable law or upon instruction from the Studio. GotPhoto shall inform the Studio of such requests without undue delay, to the extent the relevant Studio can be identified based on the information directly provided in the request or otherwise readily available to GotPhoto without disproportionate effort. GotPhoto shall not be obliged to verify the identity of the requester, assess the validity of the request or undertake additional efforts, searches or investigations to identify the relevant Studio.

5. Technical and Organizational Measures

5.1 GotPhoto shall implement appropriate technical and organizational measures, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of individuals.

5.2 The technical and organizational measures published at https://www.gotphoto.com/technical-and-organizational-measures/ at the time the Principal Contract is concluded form the baseline security measures implemented by GotPhoto. These measures define the baseline level of security to be implemented by GotPhoto.

5.3 GotPhoto may update the technical and organizational measures from time to time, provided that the level of protection afforded by the measures is not materially reduced. The current version of the technical and organizational measures shall be made available to the Studio, for example via GotPhoto’s website. 

5.4 GotPhoto shall ensure that the personal information processed under this agreement is separated from other data. The logical separation is sufficient. 

6. International Processing

6.1 The Studio acknowledges that personal information may be processed by GotPhoto and its sub-processors in the United States, Germany, other member states of the European Union or the European Economic Area and in other countries in which GotPhoto or its sub-processors operate. GotPhoto shall ensure that any such processing is carried out in accordance with applicable Data Protection Laws. 

6.2 Where applicable Data Protection Laws require additional safeguards for international transfers of personal information, GotPhoto shall implement appropriate transfer mechanisms, including contractual safeguards where required by law.

7. Sub-processing

7.1 The Studio grants GotPhoto a general authorization to engage sub-processors for the processing of personal information under this agreement, including sub-processors located in third countries. GotPhoto shall remain fully responsible for the performance of its sub-processors’ obligations in accordance with this agreement.

7.2 GotPhoto maintains an up-to-date list of sub-processors, including their name, address and processing activities, available at www.gotphoto.com/toms-and-sub-processors-us. By accepting the terms of this agreement, the Studio acknowledges and agrees to the engagement of the sub-processors listed therein.

7.2 GotPhoto may engage or replace sub-processors at any time. GotPhoto shall update the list of sub-processors accordingly and inform the Studio of such updates via a global means of communication within the GotPhoto system (e.g. Newsfeed) or by other appropriate means.

7.3 The Studio may object to the engagement or replacement of a sub-processor on reasonable privacy or data protection grounds within fourteen (14) days of being informed of such change in accordance with section 7.3. In the event of an objection, the Studio may terminate the agreement in accordance with its terms.

7.4 GotPhoto shall ensure that its sub-processors are contractually bound by data protection obligations no less protective than those set out in this agreement. 

7.5 The Studio may request information from GotPhoto regarding the data protection measures implemented by its sub-processors. To the extent required and appropriate, GotPhoto shall provide relevant documentation, summaries or third-party certifications (such as audit reports or compliance attestations).

7.6 GotPhoto shall select sub-processors with due care, taking into account their technical and organizational measures and their ability to comply with applicable Data Protection Laws.

7.7 GotPhoto may use sub-processors in third countries. Where applicable Data Protection Laws require safeguards for the transfer of personal information to another country, GotPhoto shall implement appropriate transfer mechanisms required by such laws and shall ensure that equivalent obligations are imposed on the relevant sub-processor.

8. Rights and Obligations of the Studio

8.1 The Studio, or where the Studio acts as a Processor, the respective Controller, is responsible for ensuring that the processing of personal information complies with applicable Data Protection Laws and the rights of individuals are protected.  

8.2 The Studio shall ensure that the processing of personal information complies with applicable Data Protection Laws, including obtaining any notices, consents or other authorizations required by law. Where the individual is a minor, the Studio shall obtain consent from the individual’s parent(s) or legal guardian, where required by applicable law. 

8.3 GotPhoto shall make available to the Studio, upon request, all information reasonably required to demonstrate compliance with its obligations under this agreement and applicable Data Protection Laws. This may include, in particular, documentation, summaries of technical and organisational measures and relevant third-party certifications or audit reports.

8.4 If the Studio reasonably determines, based on specific and documented grounds, that the information provided pursuant to section 8.3 is insufficient to demonstrate compliance, the Studio may request additional information or assurance. GotPhoto may satisfy such requests by providing up-to-date certifications, audit reports or other independent third party attestations. Audits shall primarily be conducted through the provision of documentation and remote means, taking into account the nature of the services, in particular GotPhoto’s use of cloud-based infrastructure and a distributed workforce. 

9. Reporting Obligations

9.1 GotPhoto shall notify the Studio without undue delay after becoming aware of a security incident involving personal information processed on behalf of the Studio, to the extent such notification is required by applicable Data Protection Laws. Such notification shall include, to the extent available, information reasonably necessary for the Studio to comply with its obligations under applicable Data Protection Laws and may be provided in phases as additional information becomes available. 

9.2 GotPhoto shall reasonably assist the Studio in complying with its obligations relating to security incidents, breach notifications and communications with competent authorities or affected individuals, to the extent required by applicable Data Protection Laws. Such assistance shall be limited to the processing activities carried out by GotPhoto on behalf of the Studio and to the information available to GotPhoto in this context.

10. Instructions

10.1 The Studio may issue documented instructions regarding the processing of personal information within the scope of this agreement.

10.2 As a rule, instructions shall be issued in writing, including by email to a contact address designated by GotPhoto. In urgent cases, instructions may be given by other means, provided that they are confirmed in writing without undue delay.

10.3 GotPhoto shall inform the Studio without undue delay if, in its opinion, an instruction infringes applicable law. In such cases GotPhoto is entitled to suspend the execution of the relevant instruction until it has been confirmed or amended by the Studio.

10.4 GotPhoto shall document instructions received from the Studio and their implementation.

11. Use of Anonymized Data

11.1 GotPhoto may anonymize personal information processed under this agreement, provided that such anonymization is carried out in accordance with the requirements set out in this clause.

11.2 The Studio acknowledges that the anonymization of personal information may serve the Studio’s interest and GotPhoto’s legitimate business purposes, in particular the improvement and development of GotPhoto’s services, including through the analysis of customer behavior, product performance and service usage in aggregated and non-identifiable form.

11.3 GotPhoto shall ensure that any anonymization is performed in such a manner that the information can no longer reasonably be associated with, relate to, describe, identify or be linked, directly or indirectly to an identifiable individual, taking into account all means reasonably likely to be used for re-identification.      

11.4 The parties agree that information which has been anonymized in accordance with this clause no longer constitutes personal information within the meaning of applicable Data Protection Laws.

11.5 The parties acknowledge and agree that GotPhoto may use anonymized data for its own business purposes, including but not limited to:

• internal analytics and statistical analysis, 
• product development and improvement, 
• benchmarking and business intelligence, and 
• the creation of aggregated reports. 

11.6 GotPhoto shall not attempt to re-identify anonymized data and shall implement appropriate measures to prevent re-identification.

11.7 The Studio shall ensure that the processing of personal information under this agreement, including the anonymization of personal information in accordance with this section 11., complies with applicable Data Protection Laws and that individuals are provided with any notices, consents or other disclosures required by applicable law.

12. Termination of the Agreement

12.1 Upon termination of this agreement GotPhoto shall, at the choice of the Studio, delete or return all personal information processed on behalf of the Studio and delete existing copies, unless applicable law requires retention of the personal information. Deletion shall be carried out in a manner that ensures that the personal information cannot be reconstructed or recovered using reasonable means. 

12.2 GotPhoto shall ensure that any sub-processors return or delete the personal information processed on behalf of the Studio without undue delay after termination of their services, unless applicable law requires retention.

12.3 GotPhoto may retain documentation necessary to demonstrate compliance with this agreement and applicable Data Protection Laws for the applicable statutory retention periods. Such documentation shall be subject to appropriate safeguards and shall not be used for any other purposes.

12.4 Notwithstanding the foregoing, personal information contained in backup systems shall be deleted in accordance with GotPhoto’s standard backup retention cycles, provided that such information remains protected and is not actively processed. 

13. Termination for Cause

13.1 The Studio may terminate the Principal Contract and this agreement for cause  in the event of a material breach by GotPhoto of the terms of this agreement (“Termination for Cause”).

13.2 A breach shall be considered material, if GotPhoto fails to fulfil essential obligations stipulated in this agreement, in particular the implementation of the agreed technical and organizational measures.

13.3 Prior to Termination for Cause the Studio shall provide GotPhoto with a reasonable period of time to remedy the breach. If the breach is not remedied within such period, the Studio shall be entitled to terminate for cause.

13.4 Either party shall have the right to terminate this agreement for cause if the Studio objects to the engagement or replacement of a sub-processor in accordance with section 7.4 of this agreement and the parties are unable to reach agreement.

14. Liability

Any liability between the parties arising under or in connection with this agreement shall be subject to the limitations and exclusions of liability set out in the Principal Contract.

15. Miscellaneous

15.1 Each party shall treat the confidential information of the other party, including in particular information relating to technical and organizational measures, as confidential. In case of doubt information shall be treated as confidential until the other party confirms otherwise in text form. The obligation of confidentiality shall survive the termination of this agreement. Each party may use and disclose information resulting from this agreement to the extent reasonably necessary to establish, exercise or defend legal claims or as otherwise required by applicable law.

15.2 Any amendments or additions to this agreement must be made in writing, including by electronic communication or the use of electronic signature services.

15.3 If any provision of this agreement is held to be invalid or unenforceable by a court of law, this shall not affect the validity of the remaining provisions.

15.4 This agreement shall be governed by and construed in accordance with the laws of the State of New York, without regard to its conflicts of laws principles. Any dispute arising out of or in connection with this agreement shall be subject to the exclusive jurisdiction of the state and federal courts located in New York, New York.

Note: This data protection agreement does not require signatures and shall come into effect upon the Studio’s acceptance of GotPhoto’s general terms and conditions, which reference and incorporate this data protection agreement.

Annex 1 – Processing Details

1. Studio as Controller

1.1 Nature and purpose of processing

The nature and purpose of the processing of personal information by GotPhoto are determined by the Principal Contract. GotPhoto processes personal information on behalf of the Studio in order to provide the services agreed therein. The processing activities include, in particular:

• the collection of personal information (including via the online shop),
• the storage and organization of personal information,
• the adaptation and modification of personal information,
• the retrieval and provision of personal information,
• the transmission of personal information to service providers engaged by or on behalf of the Studio (e.g. for production, shipping or payment processing),
• the deletion or restriction of processing of personal information,
• the processing of customer inquiries (e.g. via contact forms),
• the anonymization and aggregation of personal information for statistical, analytical and service optimization purposes, and
• the performance of web audience analysis.

These processing activities serve the following purposes:

• enabling and supporting the processing of orders (e.g. production and shipping of photo products),
• providing and operating the GotPhoto platform, including customer and order management (e.g. complaints handling and payment status),
• enabling online sales and delivery of photos,
• organizing and managing image data (e.g. automatic sorting of photos),
• facilitating communication with customers of the Studio (e.g. transactional or service- related communications),
• improving and developing GotPhoto’s services based on aggregated and anonymized data, and
• enabling payment processing, where required for the selected payment method.

1.2 Type of personal information

The following categories of personal information may be processed:

• image data (in particular photographs of individuals),
• identification data (e.g. first and last name),
• contact data (e.g. postal address, email address, phone number),
• order and transaction data (e.g. order details, payment status)
• payment-related data (e.g. payment method, transaction identifiers),
• usage and behavioural data relating to the use of the online shop, and
• metadata and organizational data (e.g. group assignments, sorting criteria or similar classification information).

This information is provided either by the Studio within the GotPhoto system or by the Studio’s customers when using the online shop, in particular during the order process. 

1.3 Categories of individuals

The categories of individuals include:

• individuals photographed by the Studio
• customers and potential customers of the Studio.

2. Studio as Processor

To the extent that the Studio processes personal information on behalf of a third-party controller, the Studio shall act as a processor and GotPhoto as a sub-processor.

In such cases, the nature and purpose of the processing, the types of personal information and the categories of individuals are as described in section 1 of this Annex. 

3. GotPhoto as Controller

To the extent GotPhoto anonymizes personal information processed under the Principal Contract for its own business purposes in accordance with section 11 of this agreement, GotPhoto acts as an independent controller with respect to the anonymization process only. 

Such processing is limited to the anonymization of personal information and the subsequent use of anonymized data for statistical analysis, service improvement, product development, benchmarking, business intelligence and related business purposes.

Last update: 01 July 2026