Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Photographer Terms of Service (the "Terms") between HPK AI Labs ("we", "us", "Processor") and the photographer or studio using SpotMe ("you", "Photographer"). It applies to Event Data that we process on your behalf. Capitalised terms not defined here have the meaning given in the Terms. You accept this DPA when you accept the Terms.

1. Roles

1.1 For Event Data, you are the Data Fiduciary (controller) and we are your Data Processor under the Digital Personal Data Protection Act, 2023 and its rules ("DPDP Act") and, where applicable, the EU or UK General Data Protection Regulation ("GDPR").

1.2 We act as a Data Fiduciary, independently of you, only for the limited processing we decide ourselves and describe in our Privacy Policy: keeping the Service secure, preventing fraud and abuse, recording the consent of couples and guests, handling grievances and following up rights requests that reach us (which we forward to you under Section 5), and complying with the law.

2. Details of the processing

3. Your instructions

3.1 We process Event Data only on your documented instructions. The Terms, this DPA and the settings and actions you choose in the Service (such as uploading photos, running face detection, turning links and downloads on or off, and deleting photos or Events) are your complete instructions. We may also process Event Data where the law requires it, in which case we will tell you before processing unless the law prohibits it.

3.2 We will tell you if we believe an instruction breaches Data Protection Law.

4. Your obligations

You confirm that you have, and will keep, a lawful basis for the processing, including the notices and consents described in Section 7 of the Terms, the consent of a parent or lawful guardian where required for children, and that your instructions comply with Data Protection Law.

5. Our obligations

We will:

• process Event Data only as described in Section 3;
• make sure that anyone we authorise to process Event Data is bound by confidentiality;
• implement and maintain the security measures in Annex 1;
• not use Event Data to train, test or improve any AI or machine-learning model, not combine it across Events or photographers, and not sell it;
• forward to you any request from a Data Principal about Event Data that reaches us, and help you, taking into account the nature of the processing, to respond to such requests, to meet your security and breach notification obligations, and to carry out any data protection impact assessment;
• inform you of a personal data breach affecting Event Data without undue delay, and in any event within 48 hours of becoming aware of it, with the information reasonably available to us, and keep you updated as we learn more; and
• delete Event Data as described in Section 9.

6. Sub-processors

6.1 You authorise us to use the sub-processors listed in Section 9 of our Privacy Policy. We will impose on each sub-processor data protection obligations that are no less protective than those in this DPA, and we remain responsible to you for their performance.

6.2 We will give you at least 15 days' notice (by email or in the dashboard, or by updating the Privacy Policy) before adding or replacing a sub-processor that processes Event Data. If you object on reasonable data protection grounds, we will discuss your concerns in good faith. If we cannot resolve them, you may stop using the Service and delete your Account.

7. Transfers

Event Data is stored primarily in Mumbai, India. We transfer Event Data outside India only as described in the Privacy Policy and in accordance with Section 16 of the DPDP Act. Where the GDPR applies to your processing and a transfer to us requires appropriate safeguards, we will enter into the European Commission's Standard Contractual Clauses (and, for the UK, the UK Addendum) with you on request.

8. Information and audits

On your written request, not more than once a year (or more often if required by a regulator or following a personal data breach), we will provide information reasonably necessary to demonstrate our compliance with this DPA, such as a written description of our security measures and sub-processors.

9. Deletion

9.1 During the Terms, you can delete Event Data at any time in the Service. When an Event is archived, web-optimised photos and Face Data from Event photos are deleted, and original photos and Guest and Couple records are kept until you permanently delete the Event, as described in Section 9 of the Terms.

9.2 When your Account is deleted, we will delete all Event Data 7 days after deletion is requested, except where the law requires us to keep it. Copies in backups expire within a further 7 days.

10. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

Annex 1: Security measures

• Encryption in transit: all traffic uses HTTPS (TLS).
• Encryption at rest: photos and database backups are stored encrypted (AES-256) in storage that blocks all public access.
• Access to photos: photos are delivered only through signed links that expire after a short time.
• Authentication: photographer passwords are stored as bcrypt hashes; logins and couple and guest access are verified with one-time passwords that expire after 5 minutes and allow a limited number of attempts; login and OTP requests are rate-limited.
• Network isolation: the database and internal services are not reachable from the internet.
• Least privilege: storage and computing use separate cloud accounts and credentials with only the permissions they need.
• Personnel: access to Event Data is limited to the proprietor and any person authorised by the proprietor who needs it, and who is bound by confidentiality.
• Data minimisation: guest selfie images are never stored; the "very young child" estimate is never stored; web-optimised photos do not carry embedded metadata.
• Resilience: daily database backups, kept for 7 days.
• Monitoring: monitoring and alerting for failures and unusual activity, and logs kept for up to 180 days.