Snapveil Logo

Data Processing Agreement (DPA)

Agreement on the processing of personal data on behalf of a controller pursuant to Art. 28 GDPR

Who needs this agreement

Anyone who uses Snapveil to collect photos and videos of an event decides on the purpose and scope of that collection themselves. If the organizer is subject to the GDPR in doing so, for example as a company, association, school, agency or commercial photographer, the organizer is the controller and Pivoda GbR processes the gallery content on the organizer's behalf. Art. 28 GDPR requires a contract for this: this DPA.

Anyone celebrating privately, such as a wedding or a birthday, generally does not need this agreement (Art. 2(2)(c) GDPR). The commitments below on security, sub-processors and deletion apply regardless.

How the agreement takes effect: For everyone who uses Snapveil professionally or for an organization, this DPA becomes part of the contract upon acceptance of the Terms of Service. No separate signature is needed.

Download and signed copy: You can download the agreement as a PDF. If you need a copy signed by us for your records, write to us at contact@snapveil.com.

Parties

Controller (hereinafter "Customer"): the customer who holds an organizer account with Snapveil and creates events.

Processor (hereinafter "Provider"):

Pivoda GbR Partners: Daniel Wagner, Jens Schwoon Friedensstraße 7 48151 Münster Germany Email: contact@snapveil.com

§1 Subject Matter and Duration

(1) The subject matter of this agreement is the processing of personal data by the Provider on behalf of the Customer in the course of using the Snapveil platform under the Terms of Service (hereinafter "Main Contract").

(2) This agreement applies to content that the Customer and the Customer's guests contribute to the Customer's galleries. For data the Provider processes for its own purposes, in particular the Customer's account data, payment data and website usage data, the Provider is itself the controller; the Privacy Policy applies to that data.

(3) The term of this agreement corresponds to the term of the Main Contract. It ends as soon as the Provider no longer processes any personal data of the Customer.

§2 Nature and Purpose of Processing

(1) The Provider processes the data exclusively in order to provide the contractually agreed services: receiving, storing, preparing (generating preview versions), displaying, making available for download and export, and deleting photos and videos in event galleries, managing guests and their permissions, and sending gallery-related service emails.

(2) If the Customer has booked the "Pro + AI" plan, the AI and location features are switched on by default; the Customer can switch each of them off per event. While they are switched on, processing additionally includes the automatic tagging and description of photos, building a search index, and the conversion of GPS coordinates into place names. Videos are not analyzed with AI. No detection or grouping of faces takes place; no biometric data is processed.

(3) The Provider uses the data neither for its own purposes nor for advertising or for training AI models; it does not sell the data.

(4) The data is stored within the European Union. Processing in a third country takes place only through the sub-processors listed in Annex 2 and only subject to the requirements of Art. 44 et seq. GDPR.

§3 Types of Data and Categories of Data Subjects

(1) Types of data:

(2) Categories of data subjects:

(3) In individual cases, photos and videos may reveal special categories of personal data within the meaning of Art. 9 GDPR. The Provider does not search the content for such characteristics and does not derive categories or profiles from it.

§4 Instructions

(1) The Provider processes the data only on documented instructions from the Customer, unless required to do so by Union or Member State law. In that case the Provider informs the Customer of the legal requirement before processing, unless that law prohibits such information.

(2) Instructions consist of the Main Contract, this agreement, and the settings and actions the Customer performs in the application, for example creating and deleting events, enabling features and assigning permissions. Further individual instructions are given in text form to contact@snapveil.com.

(3) If the Provider believes that an instruction infringes data protection law, it informs the Customer without undue delay. It may suspend execution until the Customer confirms or changes the instruction.

§5 Obligations of the Customer

(1) The Customer is responsible for the lawfulness of the processing. This includes in particular a legal basis for collecting and making available the photos and videos, and informing data subjects in accordance with Art. 13 and 14 GDPR.

(2) The Customer informs the Provider without undue delay if it detects errors or irregularities in the processing.

§6 Confidentiality

The Provider ensures that all persons authorized to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Only a tightly limited group of people has access to the production systems. The confidentiality obligation continues after this agreement ends.

§7 Technical and Organizational Measures

(1) The Provider implements the technical and organizational measures required under Art. 32 GDPR. The current state is described in Annex 1.

(2) The measures are subject to technical progress. The Provider may adapt them as long as the level of protection is not reduced. Material changes are documented in Annex 1.

§8 Sub-processors

(1) The Customer grants the Provider general authorization to engage sub-processors. The sub-processors engaged at the time the contract is concluded are listed in Annex 2 and are deemed approved.

(2) The Provider informs the Customer at least 30 days before engaging a new sub-processor or replacing an existing one, by email to the address stored in the account. Within this period the Customer may object to the change in text form for good cause relating to data protection.

(3) If the Customer objects and no amicable solution can be found, either party may terminate the Main Contract for the affected events with effect from the time of the change.

(4) The Provider contractually imposes on each sub-processor data protection obligations that are essentially equivalent to those in this agreement. If a sub-processor is located in a third country, the Provider ensures that the requirements of Art. 44 et seq. GDPR are met, in particular through an adequacy decision or the European Commission's Standard Contractual Clauses.

(5) The Provider is liable to the Customer for its sub-processors' compliance with their obligations.

§9 Assistance with Data Subject Rights

(1) The Provider assists the Customer with appropriate technical and organizational measures in responding to data subject requests under Art. 12 to 22 GDPR. In particular, the application enables the Customer to view, export and delete content and to remove guests and their contributions.

(2) If a data subject contacts the Provider directly with a request concerning one of the Customer's galleries, the Provider forwards the request to the Customer without undue delay and does not respond to it without the Customer's instruction.

(3) Taking into account the nature of the processing and the information available to it, the Provider assists the Customer in complying with the obligations under Art. 32 to 36 GDPR, in particular with data protection impact assessments.

§10 Notification of Personal Data Breaches

(1) The Provider notifies the Customer of personal data breaches affecting the Customer's data without undue delay after becoming aware of them, by email to the address stored in the account.

(2) As far as known, the notification contains a description of the nature of the breach, the categories of data concerned and the approximate number of data subjects and records concerned, the likely consequences, and the measures taken and proposed. If not all information is available immediately, it is provided in phases.

(3) The Provider takes the necessary measures without undue delay to secure the data and to mitigate possible adverse effects.

§11 Deletion and Return

(1) The Customer can download content at any time using the export function and delete individual items or entire events.

(2) After the storage period of the respective plan expires (Free: 2 months, Pro and Pro + AI: 12 months from creation of the event, in each case plus any booked extensions), the Provider deletes the event's photos, videos, preview versions, metadata and AI results. Before deletion it sends the Customer several reminder e-mails so that the Customer can export the content.

(3) Upon termination of the Main Contract, the Provider deletes the data after the export period of 30 days (§13 of the Terms of Service) has expired, unless there is a statutory obligation to retain it. Data contained in backups is deleted when the backups are overwritten on their regular cycle and is not processed any further until then.

(4) On request, the Provider confirms the deletion in text form.

§12 Evidence and Audits

(1) On request, the Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and this agreement.

(2) The Customer may verify compliance itself or through an auditor bound to confidentiality. Audits are carried out primarily through written information and inspection of existing documentation. On-site audits take place after reasonable advance notice, during normal business hours and without disrupting operations; they are limited to one per calendar year unless there is a specific reason.

(3) Where processing takes place in data centers of sub-processors, evidence is provided through the audit reports and certificates made available by them.

§13 Liability

The liability provisions of the Main Contract (§16 of the Terms of Service) apply to the parties' liability under this agreement. Liability towards data subjects under Art. 82 GDPR remains unaffected.

§14 Final Provisions

(1) In the event of conflicts between this agreement and the Main Contract, the provisions of this agreement prevail as far as the protection of personal data is concerned.

(2) Amendments to this agreement require text form. The Provider may amend the agreement in accordance with the procedure for amending the terms set out in the Main Contract.

(3) Should individual provisions be invalid, the validity of the remaining provisions is not affected.

(4) German law applies.

Annex 1: Technical and Organizational Measures

Confidentiality

Integrity

Availability and Resilience

Procedures for Regular Review

Annex 2: Sub-processors

Payment processing (Stripe), sign-in with a Google account and the feedback window in the organizer area (Featurebase) concern only the Customer's own data, for which the Provider is the controller. They are described in the Privacy Policy and do not constitute sub-processing within the meaning of this agreement.

This is a courtesy English translation of the German Auftragsverarbeitungsvertrag. In the event of any discrepancy between the English and German versions, the German version shall prevail.

Last updated: 20 September 2026