Data Processing Agreement

Last updated: 14 October 2026

This Data Processing Agreement ("DPA") is part of the Capturely Terms of Service between Kamden MB, trading as Capturely ("Capturely", "we", the processor) and the photographer or business that holds a Capturely account ("you", the controller). It applies automatically when you accept the Terms; no signature is needed. If you need a signed copy for your records, email hello@capturely.me.

It sets out the terms required by Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") for the personal data we process on your behalf. If this DPA and the Terms conflict on data protection, this DPA prevails.

1. Scope and roles

1.1 This DPA covers the personal data of your Clients, gallery visitors, website visitors and the people shown in your photos that we process to provide the Service to you ("Client Data"). Annex 1 describes it.

1.2 You are the controller of Client Data and we are your processor. We are a separate controller only for the limited data described in our Privacy Policy (your own account data, and data we must process for security, abuse handling and legal obligations).

1.3 If you use Capturely as a consumer for a purely personal or household activity, the GDPR may not apply to your own processing. We still handle Client Data as this DPA describes.

1.4 You are responsible for the lawfulness of the processing you instruct, including having a legal basis for uploading and sharing photos of people, giving your Clients the information Articles 13 and 14 GDPR require, and obtaining any consent you need (for example for analytics or advertising tags you add to your galleries).

2. Our obligations

2.1 Instructions. We process Client Data only on your documented instructions. Your instructions are the Terms, this DPA and the settings and actions you take in the Service (for example uploading, sharing, setting an expiry date, connecting a messaging app or adding a webhook). If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process Client Data otherwise, we will tell you first unless the law forbids it.

2.2 Confidentiality. Everyone we authorise to process Client Data is bound by a duty of confidentiality.

2.3 Security. We take the technical and organisational measures in Annex 2, which we may improve over time but will not weaken materially.

2.4 Assistance with requests. If a data subject contacts us directly about Client Data, we will pass the request to you without undue delay and not answer it ourselves unless you ask us to. Most requests can be handled by you in the dashboard (for example deleting a gallery, which deletes its Client details, comments, selections, reviews and statistics). Where you cannot, we will help you by reasonable means.

2.5 Other assistance. Taking into account the information available to us, we will help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).

2.6 Personal data breaches. We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Client Data. We will give you the information we have and update it as we learn more.

2.7 Records and audits. We will make available the information reasonably needed to show compliance with this DPA, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. An audit must be requested with at least 30 days' notice, take place no more than once in 12 months unless a supervisory authority requires it or there has been a breach, be bound by confidentiality, and avoid disrupting the Service. Each party bears its own costs, unless the audit shows a material breach by us.

3. Subprocessors

3.1 You give us general authorisation to engage subprocessors. Annex 3 and our Subprocessors page describe the categories we use. The current named list of our subprocessors is available to you on request at hello@capturely.me.

3.2 We will tell you about any intended addition or replacement at least 30 days in advance, by email to the address of your account, and we will update the Subprocessors page. You may object on reasonable data protection grounds within that period. If we cannot address the objection, you may terminate the affected part of the Service before the change takes effect, and we will refund prepaid fees for the unused period.

3.3 We impose on each subprocessor data protection obligations that offer at least the same protection as this DPA, and we remain responsible to you for their performance.

3.4 Services you choose. When you connect a service yourself (a messaging app, your own webhook endpoint, analytics or advertising tools in your galleries, videos you embed on your site), we send data to it on your instruction. These services are not our subprocessors; you choose them and their terms apply.

4. Transfers outside the EEA

4.1 We host the application and its database in the European Economic Area and Switzerland, which benefits from an EU adequacy decision. Where a subprocessor processes Client Data in, or accesses it from, a country without an adequacy decision, we make sure the transfer is covered by the European Commission's Standard Contractual Clauses (Module 3, processor to processor) or another valid mechanism under Chapter V GDPR. Annex 3 describes the safeguards for each category of subprocessor.

4.2 If you are established outside the EEA, you instruct us to process Client Data in the EEA and Switzerland as described here.

5. Duration, deletion and return

5.1 This DPA lasts as long as we process Client Data for you.

5.2 During the contract, Client Data is deleted according to your settings and the rules in the Terms: a gallery is deleted in our regular clean-up once 14 days have passed since its expiry date or 30 days since you moved it to the trash, and at once if you delete it for good (Terms, section 11).

5.3 When your account is deleted, we delete the database records of your account, galleries, Clients and statistics at once, and the stored files in the background shortly after. Copies in our providers' backups are deleted when those backups expire on the provider's schedule.

5.4 Return. Before deleting your account you can download your Client selections (as a list of file names, a CSV file or a ZIP of the selected originals) for each gallery. If you need any other Client Data returned before deletion, ask us at hello@capturely.me before you delete your account and we will provide it in a common machine-readable format.

5.5 We may keep Client Data after the end of the contract only where EU or Member State law requires it, and then only for that purpose.

6. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where the GDPR or other applicable law does not allow it to be limited.

7. Governing law

This DPA is governed by the same law, and disputes go to the same courts, as the Terms.

---

Annex 1. Details of the processing

Annex 2. Technical and organisational measures

The following measures are in place in the Service today. We describe them by category; more detail is available to customers on request, under confidentiality, for example for an audit under section 2.7.

Access control

• Access to production systems and data is restricted to the people who need it.
• Account passwords are stored only in hashed form.
• Sign-ins expire after a period of inactivity and in every case 90 days after sign-in; photographers can see their signed-in devices and sign them out.
• Repeated failed sign-in attempts and mass account creation are limited.

Encryption

• Data is encrypted in transit.
• Data is encrypted at rest by our database and file storage providers.

Private storage of photos

• Photo files are kept in private storage and are shown only through private links that expire.

Data minimisation

• Gallery view statistics do not store the visitor's IP address.
• Analytics or advertising tools a controller adds are loaded only after the visitor's consent.
• Photographer portfolio sites start no session and store no visitor IP address.

Deletion

• Deleted data is removed on a schedule, as section 5 describes: expired and trashed galleries in a regular clean-up after their grace periods, and on account closure, records at once and files in the background.

Backups

• Any backups our providers keep are deleted when they expire on the provider's schedule.

Logging and monitoring

• Errors are logged for follow-up, and background tasks that fail are retried and logged.

Staff confidentiality

• Everyone with access to Client Data is bound by a duty of confidentiality.

Subprocessors

• Data processing agreements with subprocessors are in place or being put in place.

Incident handling

• We assess and contain security incidents, and we notify you of a personal data breach affecting Client Data as section 2.6 describes.

Annex 3. Subprocessors

Our Subprocessors page describes the categories of subprocessors we use. At the date of this DPA they are:

The current named list is available to you on request at hello@capturely.me.