Data Processing Agreement

This DPA is between the business customer that has accepted the Business & API Terms ("Customer") and Jorge Saez, an individual based in Rio de Janeiro, Brazil ("Processor", "we"), postal address for legal notices: CEP 21920-455, Rio de Janeiro - RJ, Brazil, contact: support@photo-rescue.com.

It applies to Customer Personal Data: personal data contained in the images and files that Customer submits to the Service and in the results, that we process on Customer's behalf to provide the Service.

Account, billing, security and fraud-prevention data about Customer and its users (such as login details, payment records and abuse-prevention hashes) is processed by us as an independent controller under our privacy policy, not under this DPA.

Capitalised terms not defined here have the meaning given in the Business & API Terms or in the Data Protection Laws.

Data Protection Laws: all data protection laws that apply to the processing of Customer Personal Data under the Agreement, which may include the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, the Brazilian General Data Protection Law 13.709/2018 ("LGPD"), the California Consumer Privacy Act as amended by the CPRA ("CCPA") and similar US state privacy laws, Canada's PIPEDA and the Australian Privacy Act 1988.

Controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the GDPR; the equivalent terms in other Data Protection Laws (such as "business" and "service provider" under the CCPA, or "controlador" and "operador" under the LGPD) are read accordingly.

Sub-processor: a third party we engage to process Customer Personal Data.

SCCs: the standard contractual clauses adopted by European Commission Implementing Decision (EU) 2021/914.

UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, as amended.

Customer is the controller of Customer Personal Data (or a processor acting for its own clients, in which case we are its sub-processor) and we are the processor.

We process Customer Personal Data only on Customer's documented instructions. Customer instructs us to process it to provide, secure and support the Service in accordance with the Agreement, Customer's use and configuration of the Service, and any further reasonable written instructions that are consistent with the Agreement. Instructions that change the scope of the Service may require an Order Form and Fees.

We tell Customer if, in our opinion, an instruction infringes the Data Protection Laws; we may then suspend that processing. We may process Customer Personal Data otherwise where the law requires it; in that case we inform Customer before processing, unless the law prohibits it.

Customer is responsible for the lawfulness of the processing, including having a legal basis, giving notices to and obtaining any consents from data subjects (including the people shown in images), and for the accuracy and content of Customer Personal Data. Customer will not submit special categories of personal data or data about children unless it is strictly necessary and lawful.

We do not use Customer Personal Data to train, fine-tune or evaluate AI models, and we do not sell it.

We ensure that every person authorised to process Customer Personal Data is bound by a duty of confidentiality. Today the Service is run by the operator alone; anyone who later gets access will be bound in the same way and will receive access only to the extent needed.

We implement and maintain the technical and organisational measures described in Annex II, which are designed to provide a level of security appropriate to the risk. We may update these measures, provided the overall level of security is not reduced.

Customer is responsible for its own security, including protecting its account credentials and API keys, and for deciding whether the measures in Annex II meet its needs.

Customer gives us general authorisation to engage Sub-processors. The current Sub-processors are listed on our sub-processors page (Annex III).

We impose on each Sub-processor data protection obligations that, in substance, provide the protection required by Article 28(3) GDPR, and we remain responsible to Customer for its performance of those obligations, subject to section 13.

We announce a new or replacement Sub-processor by updating the sub-processors page at least 14 days before it starts processing Customer Personal Data, except where an urgent replacement is needed for security or service continuity, in which case we update the page as soon as possible. Customers can ask to be notified by email.

Customer may object to a new Sub-processor on reasonable data protection grounds by email within that 14-day period. We will consider the objection in good faith. If we do not resolve it, Customer may, as its sole and exclusive remedy, end the affected Service by written notice, and we will refund the prepaid Fees for the unused part of the period.

Taking into account the nature of the processing, we assist Customer by appropriate technical and organisational measures, insofar as this is possible, to respond to requests from data subjects to exercise their rights. Because images and results are deleted within 24 hours, in most cases there is nothing left to access or delete.

If we receive a request directly from a data subject about Customer Personal Data, we refer them to Customer where we can identify Customer, and we do not respond further except as the law requires.

We notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information may be provided in phases.

We take reasonable steps to contain and remedy the breach. Our notification is not an admission of fault or liability. Customer is responsible for any notifications it must make to supervisory authorities and data subjects.

Taking into account the nature of the processing and the information available to us, we provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, mainly by making available the information in this DPA and its annexes. Assistance beyond that may be charged at reasonable rates.

Uploaded images and results are deleted automatically within 24 hours. Job records (file name, tool, time, status and credits charged, without image data) are deleted after 30 days, except that a job with a pending refund is kept until the refund is resolved.

Because files are deleted automatically, we cannot return them after that time; Customer must download the results it needs. When the Agreement ends, we delete any remaining Customer Personal Data within 30 days, unless the law requires us to keep it. Copies in our providers' backups and logs are overwritten in their normal cycles.

We make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR. Customer agrees that this right is met by: this DPA and its annexes; our written answers to a reasonable security questionnaire; and, where available, summaries of our Sub-processors' audit reports or certifications.

Customer may request this information no more than once in any 12-month period, with at least 30 days' written notice, at Customer's own cost, unless a supervisory authority requires otherwise or after a personal data breach affecting Customer. Information provided is our Confidential Information.

We do not offer on-site audits. Where a supervisory authority or Data Protection Law mandatorily requires an inspection that cannot be satisfied by documentation, the parties will agree its scope, timing and reasonable cost in advance, and it will be carried out by an independent auditor bound by confidentiality, at Customer's cost.

We are based in Brazil, and our Sub-processors process data in the United States and other countries. Customer authorises these transfers, subject to this section.

EU/EEA. To the extent Customer Personal Data subject to the GDPR is transferred to us in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference: Module 2 (controller to processor) where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor. For the SCCs: Clause 7 (docking) applies; in Clause 9, Option 2 (general written authorisation) applies with the notice period in section 6; the optional language in Clause 11 does not apply; in Clause 13, the competent supervisory authority is the one determined under that Clause; in Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes are resolved by the courts of Ireland. Annexes I, II and III of this DPA complete the corresponding annexes of the SCCs.

United Kingdom. For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference and completed with the information in the SCCs as set out above and in Annexes I to III. For Table 4 of the UK Addendum, neither party may end it under its Section 19.

Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act and the competent authority being the Federal Data Protection and Information Commissioner.

Brazil. For processing subject to the LGPD, we act as "operador" and process Customer Personal Data in accordance with Customer's instructions and the LGPD. International transfers from Brazil rely on the mechanisms of Article 33 of the LGPD, including the standard contractual clauses approved by the ANPD, which are incorporated by reference where required.

If a transfer mechanism is invalidated or replaced, the parties will cooperate to put in place a valid alternative; we may do so by updating this DPA.

Each party's liability under or in connection with this DPA (including the SCCs and the UK Addendum, to the extent permitted by them) is subject to the exclusions and the limitation of liability in the Business & API Terms, and counts towards the same overall cap. Nothing in this section limits the rights of data subjects under the SCCs or liability that cannot be limited by law.

Where the CCPA or a similar US state privacy law applies, we act as Customer's "service provider" or "processor" and process Customer Personal Data only for the business purpose of providing the Service described in the Agreement. We will not: sell or share it (as those terms are defined in the CCPA); retain, use or disclose it for any purpose other than the business purposes in the Agreement, including any other commercial purpose; retain, use or disclose it outside the direct business relationship between Customer and us; or combine it with personal data we receive from other sources, except as the CCPA permits.

We will comply with the obligations that apply to service providers under those laws, provide the same level of privacy protection they require, and notify Customer if we determine that we can no longer meet our obligations. Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data. We certify that we understand and will comply with these restrictions.

This DPA lasts as long as we process Customer Personal Data under the Agreement. If this DPA conflicts with the Business & API Terms on the processing of personal data, this DPA prevails; if it conflicts with the SCCs or the UK Addendum, those prevail.

We may update this DPA to reflect changes in law, transfer mechanisms or the Service, with at least 30 days' notice of a change that reduces Customer's protection. The Business & API Terms govern everything this DPA does not address, including governing law and jurisdiction (except as required by the SCCs).

A. Parties. Data exporter: Customer, as identified in its account or Order Form, acting as controller (or processor). Data importer: Jorge Saez, an individual based in Rio de Janeiro, Brazil, contact support@photo-rescue.com, acting as processor. Activities: provision of the PhotoRescue image enhancement and upscaling service. Signature and date: acceptance of the Business & API Terms constitutes signature of this DPA and of the SCCs.

B. Categories of data subjects. People shown in images that Customer uploads (for example customers, employees, models or members of the public); Customer's own end users where Customer builds on the API; Customer's authorised users, to the extent their data appears in files or file names.

C. Categories of personal data. Image content, which may include faces and other identifying features, and any personal data visible in images (such as names, text or number plates); embedded image metadata (such as EXIF data, if present); file names; job metadata (tool used, time, status, credits charged).

D. Special categories. None intended. Customer must not submit special categories of personal data unless strictly necessary and lawful. Applied safeguards: automatic deletion within 24 hours, private storage with short-lived signed links, no human review except as described in the Business & API Terms, no model training.

E. Frequency of transfer. Continuous, whenever Customer uses the Service.

F. Nature and purpose of processing. Receiving, storing, processing with AI models (enhancement, noise and artefact removal, upscaling), returning and deleting images, solely to provide the Service to Customer.

G. Duration and retention. Images and results: deleted automatically within 24 hours. Job records: 30 days (longer only while a refund is pending). Remaining data: deleted within 30 days after the Agreement ends, unless the law requires otherwise.

H. Transfers to Sub-processors. As listed in Annex III, for the same nature, purpose and duration as above.

I. Competent supervisory authority. As determined under Clause 13 of the SCCs.

Encryption in transit: all traffic to the website, the API and between our systems and providers is encrypted with TLS.

Encryption at rest: data is stored with storage and database providers that encrypt it at rest.

Private storage and access links: uploaded images and results are stored in a private bucket and are reachable only through short-lived signed links issued to the visitor or account that created them; each request is checked against the owning account or anonymous visitor ID.

Data minimisation and pseudonymisation: images are not used for training; logs and job records contain no image data; IP addresses and device identifiers used for abuse prevention are stored only as keyed one-way hashes (HMAC).

Automatic deletion: a storage lifecycle rule deletes uploads and results within 24 hours; a daily job deletes database records when their retention period ends.

Access control and least privilege: production access is limited to the operator; service credentials are kept in the hosting provider's encrypted environment settings and not in source code; administrative accounts use strong, unique credentials and multi-factor authentication where the provider supports it.

Integrity of integrations: payment and account webhooks are accepted only with a valid cryptographic signature; requests are rate-limited.

Payment data: card data is collected and processed by Stripe and never reaches our servers.

Incident handling: suspected incidents are investigated and contained promptly, and personal data breaches are notified as described in section 8.

Sub-processor selection: we use established infrastructure providers that offer data processing terms and transfer safeguards.

We do not currently hold security certifications (such as ISO 27001 or SOC 2).

The authorised Sub-processors, their purposes and the data they process are listed on our sub-processors page, which forms part of this Annex and is updated as described in section 6.