This Data Processing Agreement ("DPA") forms part of the PhotoPostman Terms of Service between the customer ("you") and BrandPacks Limited, Unit 1603, 16/F, The L. Plaza, 367-375 Queen's Road Central, Sheung Wan, Hong Kong ("we"). It applies automatically when you accept the Terms of Service, and you do not need to sign it separately. If you need a countersigned copy, email privacy@photopostman.com.
It applies whenever we process Customer Personal Data, meaning personal data contained in the event media and related information you upload, import, connect or enter in PhotoPostman, which we process on your behalf (details in Annex 1).
Data we process as a controller for our own purposes, such as your account, security logs and billing records, is covered by our Privacy Notice, not by this DPA.
Words such as controller, processor, personal data, processing, data subject and personal data breach have the meaning given in the EU General Data Protection Regulation (GDPR) or, where it applies, the UK GDPR.
1. Roles
1.1 For Customer Personal Data, you are the controller and we are your processor. If you act on behalf of another controller (for example, an event organiser who engaged you), you are a processor and we are your sub-processor. In that case you confirm that the other controller has authorised you to use us, and you pass on any instructions and information this DPA requires.
1.2 You are responsible for having a lawful basis for the processing, including for photographing or recording guests and children, for giving data subjects the information the law requires, and for the accuracy and lawfulness of the content you provide.
2. Instructions
2.1 We process Customer Personal Data only on your documented instructions. You give those instructions through:
- the Terms of Service and this DPA;
- your settings and actions in PhotoPostman (for example, gallery access mode, expiry, downloads, sharing, deletion and restoration); and
- any other written instructions we agree.
2.2 This includes the standard lifecycle described in our Retention and Recovery Policy: the 14-day export windows, the 90-day recovery archive for hosted files, and permanent deletion. By using a paid plan, you instruct us to keep hosted files in the recovery archive for that period, unless you choose Permanently delete now.
2.3 If the law requires us to process Customer Personal Data in another way, we will tell you before doing so, unless the law forbids it.
2.4 We will tell you if we believe an instruction infringes data protection law. We may then decline to follow it until it is confirmed or changed.
3. Confidentiality and staff access
3.1 Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
3.2 Staff access to media is limited to what is needed for a support request you make, for security, or for a legal obligation or content report. Access is time-limited and recorded in an audit log. Ordinary support does not require viewing media.
4. Security
4.1 We implement the technical and organisational measures in Annex 2, which are designed to be appropriate to the risk. We may update them, provided the overall level of protection is not reduced.
4.2 You are responsible for the security choices you control: gallery passwords and access modes, who you share organiser links with, protecting your account (including enabling two-step sign-in), and the security of your own devices and cloud accounts.
5. Sub-processors
5.1 You give us general authorisation to engage sub-processors. Our current sub-processors are listed on our Subprocessors page.
5.2 We impose data protection obligations on each sub-processor that are substantially the same as those in this DPA. We remain responsible to you for their performance.
5.3 We give at least 30 days' notice before adding or replacing a sub-processor, by email to account owners and by updating the Subprocessors page. In an emergency, for example where a provider fails, we may need to give shorter notice and will explain why.
5.4 You may object on reasonable data protection grounds within the notice period by emailing privacy@photopostman.com. We will discuss your concern in good faith. If we cannot resolve it, you may cancel the affected service before the change applies, and we will refund any prepaid fees for the period after cancellation.
5.5 Dropbox, Google Drive, OneDrive and TemplatesBooth are not our sub-processors. When you connect them, they act under your own agreement with them, and we access them on your instructions.
6. Assistance
6.1 Data subject requests. The dashboard lets you find, hide, export and permanently delete media. If we receive a request from a data subject about Customer Personal Data, we will not answer it ourselves except to redirect the person to you, and we will forward it to you promptly. We will give you reasonable help to respond, considering the nature of the processing.
6.2 Other obligations. We will give you reasonable help, considering the information available to us, with security, breach notification, data protection impact assessments and prior consultation with authorities.
7. Personal data breaches
7.1 We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We send the notice to your account email address.
7.2 As far as we know at the time, the notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. If we do not yet have all the information, we will provide it in stages as it becomes available.
7.3 We will take reasonable steps to contain the breach, reduce its effects and preserve evidence. We keep a register of personal data breaches, including those that did not need to be reported.
7.4 Notifying you is not an admission of fault.
8. Deletion and return
8.1 During the service you can download (export) your hosted files at any time, and delete them, including by Permanently delete now.
8.2 When the service ends, you have 14 days of read-only access to export your hosted files. Hosted files then remain in the recovery archive until 90 days after the service ended, unless you choose earlier permanent deletion. At the end of that period, we permanently delete them, including originals, previews, temporary ZIP files and restoration manifests. Trial files are deleted at the end of their 14-day export window and are not archived.
8.3 Connected cloud sources. We delete our previews and access tokens. We never delete originals stored in your own cloud accounts.
8.4 Backups. Media objects are stored so that each can be deleted individually, including our own operational copies. Database backups used for disaster recovery may still contain deleted records for a limited period, currently up to 30 days, after which they expire automatically. Until then:
- we do not use them except to recover from an incident;
- we keep a minimal deletion record (identifiers and dates, no media or file contents); and
- we re-apply all deletions before any restored data is used to serve the service.
8.5 We may keep Customer Personal Data after this period only where the law requires it. Such data stays protected by this DPA and is used only for that legal purpose.
9. Audits and information
9.1 We will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR. This includes this DPA, Annex 2, our sub-processor list and written answers to reasonable security questionnaires, no more than once a year unless there has been a breach.
9.2 If that information is not enough, you may have an audit carried out by an independent auditor bound by confidentiality, at your cost. You must give at least 30 days' written notice, the audit must take place during business hours, it may happen no more than once a year (unless a supervisory authority requires it or after a breach), and it must not compromise the security or confidentiality of other customers' data. Audits of our sub-processors are conducted by relying on their own audit reports and certifications where available.
10. International transfers
10.1 Customer Personal Data is stored at rest in the European Union (see the Subprocessors page). It may also be accessed or processed in other countries, including:
- Hong Kong, for administration and support by BrandPacks Limited;
- the countries where Cloudflare's global network handles requests; and
- the countries where our sub-processors operate.
10.2 Where Customer Personal Data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the parties will rely on an appropriate safeguard. To be confirmed Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two controller-to-processor and/or Module Three processor-to-processor, as applicable) and the UK International Data Transfer Addendum. Module selection, the annex details, the docking and governing-law options, and a transfer impact assessment to be completed by counsel. Once completed, they will be incorporated here by reference.
10.3 If a transfer mechanism becomes invalid, we will work with you to adopt an alternative.
11. Liability and duration
11.1 Each party's liability under this DPA is subject to the limitations in the Terms of Service, so far as data protection law allows. Nothing limits a data subject's rights under the law.
11.2 This DPA lasts as long as we process Customer Personal Data for you. Any obligation that by its nature should continue, including deletion and confidentiality, continues after that.
11.3 If this DPA conflicts with the Terms of Service, this DPA applies to the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses apply.
Annex 1 – Details of processing
Subject matter and duration: providing PhotoPostman to you for the term of your account and the export, recovery and deletion periods that follow.
Nature and purpose: storing, organising, converting (previews, playable versions, waveforms, ZIP files), displaying, streaming and delivering event media; sending delivery emails you request; protecting galleries with passwords and expiry; recording coarse download activity for your dashboard; recovery archiving and deletion.
Categories of data subjects:
- people shown or heard in event media (guests, event hosts, staff, performers, including children where present);
- event organisers and transfer recipients whose details you enter; and
- people who open your galleries and transfers.
Categories of personal data:
- images, video and audio recordings, including likeness and voice;
- file names, captions and embedded metadata (for example capture time, camera details and location, which are kept in originals and removed from previews);
- names and email addresses you enter; and
- coarse download records and related technical data.
Special categories: we do not seek special category data. Event media may incidentally reveal it, for example religious ceremonies or health conditions. You are responsible for any lawful basis needed. We do not use face recognition or biometric matching.
Frequency: continuous, while the service is used.
Annex 2 – Technical and organisational security measures
- Encryption: all connections use TLS (HTTPS). Data at rest is encrypted by our storage providers. Cloud connection tokens are additionally encrypted by us with application-managed keys.
- Private storage: media storage is private, with no public file URLs. Media is delivered only through authorised requests and links that last about 10 minutes.
- Tenant isolation: every database query, file access, background job and export is checked against the business that owns the data. We test this with separate accounts.
- Access control for recipients: gallery passwords are stored as strong hashes and checked with rate limits. Gallery sessions are scoped to one event and expire. Changing a password ends existing sessions. Expiry and download settings are checked on every request, including for previews, streams and ZIP files.
- Account security: passwords are stored as strong hashes. Email verification, rate-limited sign-in and recovery, optional two-step sign-in (authenticator app) for customers and mandatory two-step sign-in for our staff. Sessions use secure, HTTP-only cookies with CSRF protection.
- Separate credentials: customer sessions, gallery sessions, media links, desktop devices, integrations and our processing server each use separate, revocable credentials.
- Least-privilege staff access: media is hidden in our admin console by default. Media access is time-limited, requires a reason and is audit-logged. Dangerous actions require confirmation.
- Safe file handling: file types are checked by content, not just by name. Executables are blocked. Uploaded archives are never extracted. Processing runs with limits on size, duration and resources.
- Location data: location and similar metadata are removed from generated previews.
- Logging: operational logs are kept for 14 days and exclude media, passwords and tokens. Security and audit records are kept for 90 days.
- Resilience: verified copies of hosted originals are kept in a separate provider's storage. Restore and deletion procedures are tested, and a deletion record prevents deleted files from being restored.
- Maintenance: we update dependencies, review privileged changes, and keep an incident response procedure and breach register.
Annex 3 – Sub-processors
See the current list at our Subprocessors page.