Data Processing Addendum

For account administration and its own platform security, billing, and compliance purposes, Photaaz may act as an independent controller. For visitor inquiries and portfolio content processed only for a business customer, the customer generally determines the purpose and Photaaz acts as processor, subject to applicable law.

Photaaz processes customer personal data only to provide, secure, support, and improve the contracted service, follow documented customer instructions, or comply with law.

Photaaz applies access controls, tenant authorization, encryption in transit, restricted secrets, backups, logging, upload validation, and incident response appropriate to the service risk. Personnel and contractors with access must be bound by confidentiality obligations.

Photaaz will notify affected business customers without undue delay after confirming a personal-data breach affecting their data and will provide reasonably available information needed for lawful notices.

Photaaz may use the published subprocessors to provide hosting, database, media, payment, email, and monitoring services. Equivalent data-protection obligations are required where applicable.

Photaaz will reasonably assist with data-subject requests, security assessments, deletion or return at termination, and transfer safeguards. Customers remain responsible for their notices, lawful basis, and instructions.