Data Processing Addendum

Version 1.1 · Effective January 1, 2027

This Data Processing Addendum ("DPA") is part of the Terms of Service between Fylix Digital LLC, a Texas limited liability company ("felyx-photos," "processor"), and the Studio ("controller"). It applies when felyx-photos processes personal data of the Studio's clients ("Client Data") that is protected by the EU GDPR, the UK GDPR or the Swiss Data Protection Act (together "Data Protection Law"). Words such as "personal data," "processing," "controller" and "processor" have the meaning they have in Data Protection Law.

1. Subject matter, duration and purpose

felyx-photos processes Client Data to provide the booking, agreement, payment, messaging and photo delivery Service to the Studio, for as long as the Studio's account exists plus the retention periods in our Privacy Policy. The types of personal data are names, email addresses, phone numbers, addresses, booking details, questionnaire answers, messages, signature records, payment history and photos. The people concerned are the Studio's clients, their guests and people shown in photos.

2. Instructions (Art. 28(3)(a))

We process Client Data only on the Studio's documented instructions, which are these Terms, this DPA and the Studio's use of the Service's features. We tell the Studio if we think an instruction breaks Data Protection Law. We process Client Data otherwise only where the law requires, and tell the Studio first unless the law forbids it.

3. Confidentiality (Art. 28(3)(b))

Everyone we authorize to process Client Data is bound by confidentiality.

4. Security (Art. 28(3)(c) and Art. 32)

We keep appropriate technical and organizational measures, including encrypted connections, hashed passwords, encrypted storage keys, private photo storage with short-lived signed links, separation of each Studio's data, access limited to authorized staff, rate limiting and security logging.

5. Subprocessors (Art. 28(2) and (4))

The Studio gives general authorization for the subprocessors on our subprocessors page. We bind each by a contract with data protection terms no less protective than this DPA, and we remain responsible for them. We give at least 30 days' notice of a new or replacement subprocessor by email and on that page; a Studio may object on reasonable data protection grounds within that time, and if we cannot resolve the objection, the Studio may cancel without penalty.

6. Helping with people's rights (Art. 28(3)(e))

We give the Studio tools to answer clients' requests: a client can download their data and ask for deletion from their account, and a Studio owner can download an export of its data from the dashboard. If a client contacts us directly, we pass the request to the Studio. We help with further requests as far as reasonably possible.

7. Help with compliance (Art. 28(3)(f))

We help the Studio with its duties on security, breach notification, data protection impact assessments and consulting regulators, taking into account the nature of the processing and the information we have.

8. Personal data breaches

We tell the Studio without undue delay, and where practical within 72 hours, after we confirm a breach affecting its Client Data, with the information we have to help it meet its own notification duties.

9. Deletion or return (Art. 28(3)(g))

When the Studio's account ends, the Studio may export its data first. After that we delete Client Data, except records we must keep by law or under our retention schedule, such as archived signed agreements (7 years), which we keep protected and use only for that purpose.

10. Audits (Art. 28(3)(h))

We give the Studio the information needed to show we comply with this DPA and allow audits by the Studio or its auditor, no more than once a year (unless a breach or regulator requires more), with reasonable notice, during business hours, under confidentiality, and at the Studio's cost. We may satisfy this by sharing current third-party reports or certifications of our hosting providers where available.

11. International transfers

felyx-photos is in the United States, so Client Data may be transferred outside the EEA, the UK and Switzerland. Where it is, the parties agree:

EU: the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), apply and are incorporated by reference. The options are: clause 7 (docking) included; clause 9(a) option 2 (general authorization, 30 days); clause 11 optional language not used; clause 17 option 1 and clause 18(b): the law and courts of Ireland; Annex I is Sections 1 and 5 of this DPA; Annex II is Section 4; Annex III is the subprocessors page.
UK: the International Data Transfer Addendum to the EU SCCs (version B1.0, issued by the UK Information Commissioner under s.119A Data Protection Act 2018) applies, with the tables completed from this DPA and either party able to end it as set out in its Section 19.
Switzerland: the SCCs apply with references to the GDPR read as references to the Swiss Data Protection Act, "member state" read to include Switzerland, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.
Where we or a subprocessor are certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), that may be relied on instead for transfers to that company.

If the SCCs and this DPA conflict, the SCCs win.

12. Studio's responsibilities

The Studio is the controller: it must have a lawful basis for collecting Client Data, give its clients a privacy notice (we provide a template on every Studio Site) and respond to their requests.

13. Liability and general terms

Liability under this DPA is subject to the limits in the Terms, except where the SCCs or the law do not allow it. This DPA ends when we stop processing Client Data. The governing law is that of the Terms, except that the SCCs are governed as stated in Section 11.

Contact

Fylix Digital LLC, 436 Cold Mountain Trl, Fort Worth, TX 76131, privacy@felyxphotos.com.