Data Processing Addendum

01Definitions

• Personal Data means any information relating to an identified or identifiable natural person that PixoProof processes on behalf of the Controller in connection with the Services.
• Processing has the meaning given in the GDPR.
• Sub-Processor means any third party engaged by PixoProof to process Personal Data on behalf of the Controller.
• Data Protection Laws means the GDPR, UK GDPR, Australian Privacy Act 1988 (Cth) and any other applicable data protection or privacy laws.
• Standard Contractual Clauses or SCCs means the standard contractual clauses approved by the European Commission for the transfer of personal data to third countries, including any UK Addendum or International Data Transfer Agreement where applicable.

02Roles of the parties

• The Controller determines the purposes and means of the processing of Personal Data.
• PixoProof acts as a Processor and processes Personal Data only on documented instructions from the Controller, unless required to do so by applicable law. The Controller’s use of the Services, including its gallery, invite, watermark and expiry settings, constitutes its documented instructions.
• The Controller is responsible for ensuring it has a valid lawful basis for the processing and for providing any required notices or obtaining any required consents, including parental consents where images of minors are involved.

03Annex I · Details of processing

04Processor obligations

PixoProof will:

• process Personal Data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by applicable law (in which case PixoProof will inform the Controller unless prohibited by law);
• ensure that persons authorised to process Personal Data are bound by confidentiality obligations;
• implement the technical and organisational measures in Annex II;
• assist the Controller, taking into account the nature of the processing, in responding to data subject requests, by locating and exporting or deleting the relevant Client’s data on request;
• assist the Controller in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to PixoProof;
• at the Controller’s choice, delete or return all Personal Data after the end of the Services as described in the Retention section, unless applicable law requires storage;
• make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits as described below.

05Annex II · Technical and organisational security measures

• Encryption in transit using TLS for all web, app and API traffic, with Cloudflare in front of every host.
• Encryption at rest for photo storage and generated previews (Cloudflare R2) and for database backups (encrypted before upload).
• Gallery PINs stored encrypted; passwords stored as salted hashes; sign-in sessions with short-lived tokens.
• Rate limiting on sign-in and gallery access to resist brute force, and an origin firewall that accepts traffic only from Cloudflare.
• Least-privilege, key-based administrative access to production infrastructure, limited to the PixoProof team.
• Audit logging of account and gallery actions, application monitoring and alerting, and error tracking with secrets scrubbed.
• Dependency and vulnerability advisories monitored, with security updates applied as part of regular releases.
• Nightly and pre-deployment encrypted database backups with a rehearsed restore procedure; photo files are not copied into backups.
• Documented incident response and breach notification procedure.

Further detail is in the Security & Data Retention Policy. PixoProof does not currently hold third-party certifications such as SOC 2 or ISO 27001.

06Annex III · Sub-processors

The Controller gives general authorisation for PixoProof to engage Sub-Processors to assist in providing the Services. The current list, with each provider’s role and location, is published on our Sub-processors page. PixoProof enters into written agreements with each Sub-Processor imposing data protection obligations equivalent to this DPA.

PixoProof will give at least 14 days’ notice of any intended addition or replacement of a Sub-Processor by updating that page and emailing account holders. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected Services.

07International data transfers

Personal Data is stored in Finland (European Union) for the application and database, and in the United States for photo files and backups (Cloudflare R2). It may also be accessed from Australia, where the PixoProof team operates. Where transfers leave the European Economic Area, the United Kingdom or another jurisdiction that restricts cross-border transfers, PixoProof ensures appropriate safeguards, including adequacy decisions, the Standard Contractual Clauses (Module 2 Controller to Processor, or Module 3 Processor to Processor, as applicable) together with the UK Addendum or International Data Transfer Agreement where required, and other lawful transfer mechanisms.

The Standard Contractual Clauses are incorporated by reference into this DPA where applicable. In the event of any conflict between this DPA and the SCCs, the SCCs prevail with respect to the restricted transfer.

08Data breach notification

PixoProof will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Personal Data processed under this DPA. The notification will include, to the extent reasonably available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. PixoProof will cooperate reasonably to assist the Controller in meeting its own notification obligations, which under the GDPR and UK GDPR run 72 hours from the Controller becoming aware.

09Retention, return and deletion

On request by email, or on closure of the Controller’s account, PixoProof will delete the Controller’s Personal Data within 30 days, or first export it to the Controller where requested. Deletion covers the database records and the photo files. Encrypted database backups are overwritten within a further 30 days. Audit and download logs are retained for the periods in the Security & Data Retention Policy for security and legal purposes.

10Audits

The Controller may request information or conduct an audit (including through a third-party auditor) to verify PixoProof’s compliance with this DPA, subject to reasonable prior written notice, conduct during normal business hours, confidentiality undertakings and no more than one audit per twelve-month period unless a material breach is reasonably suspected. PixoProof may satisfy audit requests by providing its security documentation and relevant evidence.

11Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service. Nothing in this DPA excludes or limits liability that cannot be excluded or limited under applicable Data Protection Laws.

12Duration and general

This DPA remains in effect for as long as PixoProof processes Personal Data on behalf of the Controller. It is governed by the laws of Victoria, Australia, except where the Standard Contractual Clauses require otherwise for restricted transfers. If any provision is held invalid or unenforceable, the remaining provisions continue in full force and effect. In the event of any conflict between this DPA and the Terms of Service regarding data protection, this DPA prevails.

Changes

PixoProof may update this DPA to reflect changes in law, guidance or operational practices. Material changes will be notified to the Controller by email.

13Contact

PixoProof · Email: [email protected] · Website: pixoproof.com

Version history: 1.0 (14 September 2016 [sic]) first release. 1.1 (8 October 2026) corrected the effective date typo, added Annexes I–III (processing details, security measures, sub-processors), removed client payment information from the data types, stated the real storage locations, replaced the SOC 2 / ISO 27001 reference, and fixed the 48-hour processor notice, 14-day sub-processor notice and 30-day deletion windows.