Data Processing Agreement for FotoboxSuite

Last updated: 27 September 2026 · Including service provider list and description of safeguards

1. Parties, scope and duration

The processor is Patrick Loewe, Völkerhausen 16, 31860 Emmerthal, Germany, info@fotoboxsuite.de. The client is the respective FotoboxSuite customer. This agreement specifies the obligations under Article 28 GDPR where FotoboxSuite processes personal data on the client's behalf. Processing continues for the agreed use and the subsequent orderly return or deletion of data. If the customer itself acts as a processor, it must obtain the necessary authorisation from its controller.

FotoboxSuite's own processing, particularly contract administration and billing, is separate from this processing and described in the Privacy policy .

2. Subject matter, nature and purpose

The subject matter includes operation of the portal and server interfaces, device synchronisation, event management, online galleries, transfer, temporary storage, storage, display, download, additional cloud backups, configured webhook delivery, the customer API, support and deletion. The purpose is to provide the FotoboxSuite functions selected by the customer. Using event photos for our own advertising, selling data or training general-purpose AI models is not within the scope of the engagement.

3. Data and data subjects

Depending on usage, processing includes contact and account data, event and device identifiers, device status, photo and image files including thumbnails and print layouts, session and file identifiers, timestamps, sharing permissions, print quotas, technical diagnostics, IP addresses, delivery logs and protected access authorisations. Data subjects may include photographed guests, including minors, organisers, customers, their employees and representatives, and portal users. In individual cases, the content of a photo may require particular protection. Biometric identification or facial recognition is not part of these functions.

4. Instructions and the client's obligations

Processing takes place solely on the client's documented instructions, including instructions concerning transfers to third countries, unless a legal obligation requires otherwise. Instructions arise from the main contract, the selected event, device, cloud and automation settings, and communications in text form. If a conflicting legal obligation applies, the processor informs the client before processing to the extent legally permitted. If the processor considers an instruction to infringe data protection law, it informs the client without undue delay and may suspend execution pending clarification.

The client determines purposes, legal bases, permissions and retention and ensures the necessary information, consent and authorisations. A single acknowledgement of the app notice does not cover subsequent guests. The client assesses the lawfulness of its selected cloud accounts, webhook recipients and local scripts.

5. Confidentiality and security

Persons with access to data are bound by confidentiality obligations or an appropriate statutory duty of secrecy. Risk-appropriate measures under Article 32 GDPR are implemented, taking account of the state of the art. Key measures are set out in Annex 2. Changes must not reduce the agreed level of protection.

6. Subprocessors

The client grants general authorisation for the necessary subprocessors listed in Annex 1. Intended additions or replacements are notified in advance in text form, giving the client an opportunity to object on data protection grounds. The processor binds subprocessors to substantively equivalent data protection obligations and remains responsible to the client for their performance.

Cloud accounts connected by the customer itself or specified webhook recipients must be assessed separately. Their selection is an instruction to transfer data, but does not replace necessary agreements or the assessment of third-country transfers under Articles 44 et seq. GDPR. This agreement alone does not authorise disclosure to arbitrary new recipients.

7. Assistance, incidents and oversight

Taking account of the nature and scope of processing, the processor assists the client with data subject rights and obligations under Articles 32 to 36 GDPR. Data subject requests received directly concerning data processed on behalf of the client are forwarded to the responsible client where it can be identified. The processor informs the client without undue delay of a personal data breach affecting the client's data and provides the available information about its nature, possible consequences and remedial measures.

The processor provides the information necessary to demonstrate compliance with its obligations and permits reasonable audits, including inspections by the client or an appointed auditor. Operational security and the confidentiality of other customers are maintained. Statutory audit rights are not excluded. Support access is provided when required and limited to the necessary scope.

8. Return, deletion and separate data holdings

After the engagement ends, data processed on the client's behalf is returned or deleted at the client's choice, including existing copies, unless a legal obligation requires retention. Exceptions and time limits must be communicated to the client. A general reference to security or evidentiary interests does not justify unlimited retention of event photos.

Event deletions cover the related data in active server storage, backup jobs, automation journals and staging copies. A persistent clean-up list allows file deletion to be retried after problems. Minimal deletion markers prevent recreation by devices previously operated offline. Fully deleting an account also removes cloud access authorisations, API keys and account-related diagnostics. A separate data holding is required for invoice records subject to statutory retention.

Successful cloud staging copies are removed during maintenance after a short confirmation period. Incomplete copies are scheduled for deletion after no more than 30 days or earlier event expiry. Online gallery photos are blocked at the configured expiry time and removed during the subsequent maintenance run. Details of diagnostic and transfer logs and the rotation of technical recovery backups are set out in Section 13 of the privacy policy. Restricted backup holdings are used solely for recovery. Previous deletions must be taken into account before access is re-enabled.

Server-side deletion does not remove local originals, USB exports, previous downloads or files already stored in the client's own cloud account. Information already received by webhook recipients also remains within their responsibility. The client arranges deletion of these separate holdings itself. On devices operated offline, a changed state takes effect only after synchronising again.

Annex 1: Service providers and instructed recipients

Google sign-in and Stripe payment processing additionally concern our own account or contract processes and are explained separately in the privacy policy. This list does not categorically classify them as processors of event photos. The relevant provider terms and existing safeguards for international transfers must be taken into account according to the specific contract and account arrangements.

Annex 2: Technical and organisational measures

• HTTPS for the portal, API and transfers to cloud providers, time-limited sessions, password hashing and protection against forged form requests.
• Customer-specific access checks, limited API permissions, revocable access and protected storage of persistent cloud authorisations.
• Private server staging storage outside the guest gallery, file checksums, size and storage limits, and separate jobs for each destination.
• Transfer limits and retries, deletion locks to prevent subsequent transfer of deleted events, and a persistent clean-up list.
• Limited technical error reports with recognised credentials, email addresses, URLs and file paths removed, administrator-only access and limited retention.
• Regular backups, technical maintenance and restricted administration. Local Windows devices, USB storage, guest access and the operator's own cloud accounts are secured by the event operator.

9. Precedence

In the event of a conflict, mandatory data protection law and the obligations of this Data Processing Agreement take precedence.