Personal data processing agreement
Annex 1 to the Phottate terms of service (version 2026-10-01)
This personal data processing agreement (the “Agreement”) is entered into by:
- Controller — the user of the Service (“you”), who is the controller of personal data contained in material you upload or import into the Service;
- Processor — [COMPANY NAME], with its registered office at [REGISTERED OFFICE ADDRESS], tax identification number [NIP], operating Phottate (“we”).
The Agreement is concluded when you accept the terms of service. It applies only to the personal data of third parties contained in your material. We process your account data as a controller under the privacy policy, rather than under this Agreement.
1. Subject matter, nature and purpose of processing
We process entrusted data only on your documented instructions (the terms of service and your choice of operations in the application), to provide the service you request: generating animations, video shots, photo corrections, voiceovers, music and edits. We do not use the data for our own purposes. In particular, we do not train our own models on it or disclose it beyond the subprocessors listed in section 5.
2. Duration of processing
Processing continues for the period during which material is stored in your account, until the material, project or entire account is deleted. When the Agreement ends, we delete data from the active Service. It may remain for a limited period in backups: up to 14 days in local backups and up to 90 days in optional encrypted off-server backups. We do not use these copies to provide ongoing services. The privacy policy describes other exceptions to deletion.
3. Types of data and categories of individuals
- Categories of individuals: property owners and tenants, people visible in photos, and listing contacts (for example, a seller’s telephone number in an imported description).
- Categories of data: likenesses (photos), contact and identification details contained in descriptions and listings, and property location addresses.
- We process only data you supply. We do not profile individuals or make automated decisions about them.
4. Obligations of the Processor
Within the scope of Article 28(3) GDPR, we undertake to:
- process data only on the Controller’s documented instructions, including transferring data outside the EEA only on the terms in section 6;
- ensure confidentiality: only authorised people bound by confidentiality obligations have access to data;
- implement the security measures described in Article 32 GDPR (details in section 13 of the privacy policy);
- notify the Controller of a data breach threatening individuals’ rights and freedoms no later than 48 hours after discovering it, with the information needed for the controller to meet its notification obligations;
- assist with individuals’ rights (access, rectification, erasure, restriction, portability and objection) and consultations with the supervisory authority;
- delete or return data after the services end (section 2);
- make available all information needed to demonstrate compliance with processor obligations and allow audits (section 7);
- refrain from appointing another processor (a subprocessor) without the Controller’s general authorisation (section 5).
5. Subprocessors
- You give general authorisation for us to use subprocessors to the extent necessary. Our supplier and subprocessor register (document docs/rodo/subprocesorzy.md) distinguishes suppliers in use from candidates and other data recipients. The list includes AI model providers (fal.ai and third-party models), infrastructure providers (Hetzner and Cloudflare) and geographic services (Mapbox and MapTiler).
- We announce each intended change to the list on the register page. You may object to a change by ending the agreement (deleting your account) or deleting the data covered by the relevant subprocessor.
- We enter into a data processing agreement with each subprocessor on terms no less restrictive than this Agreement.
6. Transfers outside the EEA
If a subprocessor processes data outside the European Economic Area, we provide an appropriate transfer safeguard: Data Privacy Framework certification or standard contractual clauses (Module 3 — processor to processor) in the version approved by European Commission Implementing Decision 2021/914. A copy of the clauses is available on request at kontakt@phottate.com.
7. Audit
Instead of an inspection right, we provide for an audit by questionnaire. At your request (once every 12 months, at kontakt@phottate.com), we complete a questionnaire on technical and organisational measures and provide confirmation of agreements with subprocessors. In the event of a serious breach or an allegation of a legal violation, we will allow an audit that is not limited to a questionnaire.
8. Liability
We are liable to you for damage caused by our acts or omissions only where we have failed to comply with GDPR obligations or have carried out your instructions unlawfully, in accordance with Article 82(2) GDPR. We are liable for subprocessors’ actions to the same extent as for our own.
9. Final provisions
The Agreement is governed by Polish law and ends automatically when the account or data is deleted. The Agreement may change together with the terms of service. We give notice of changes 14 days before they take effect.