1. Introduction, Scope, Definitions

1.2 GotPhoto as Processor or Subprocessor

This is a data processing agreement between the Photographer and Fotografen Online Service GmbH, Hausvogteiplatz 12, 10117 Berlin, Germany (“GotPhoto”)

The Photographer may act as Controller. The term “Controller” is defined within the GDPR as follows:

“Controller” is the natural person or legal entity, public authority, agency or other body which alone or jointly with others determines the purposes and means of processing personal data.

If the Photographer obtains the consent for lawful processing of personal data directly from a data subject (or in the case of a minor, from their parent(s) or legal guardian) or gathers personal data directly on the basis of Art. 6 par. 1 GDPR, the Photographer is considered a data controller. In this case GotPhoto acts as a processor for the Photographer. This is a non-exhaustive list of examples how the Photographer can become a controller:

• Parent or legal guardian fills out and signs a physical QR code card consenting to a minor’s participation in a photoshoot and the provision of photos for sale to the parent /  legal guardian
• Parent or legal guardian registers a minor for “photo day” via a notice in the facility 
• Parent or legal guardian registers a minor online for a photoshoot using an online form
• Person of legal age consents to the photoshoot and sale of photos through implied behaviour
• Data subject consents to the use of personal data for sending e-mail reminders in the Photographer’s online store.

Alternatively, the Photographer acts as a processor. The term “Processor” is defined within the GDPR as follows:

“Processor” is a natural person or legal entity, public authority, agency or other body which processes personal data on behalf of the controller.

If the photographer receives the data on the basis of a data processing agreement with a third party (who is not the data subject or their parent / guardian), e.g. a school / nursery, this third party acts as the controller, the photographer as the processor and GotPhoto as the subprocessor. 

1.2 Scope and Definitions

This agreement applies to all activities in which GotPhoto, employees of GotPhoto or subprocessors commissioned by GotPhoto process personal data that GotPhoto receives from the Photographer.

Terms used in this agreement are to be understood as defined in Art. 4 of the GDPR. Declarations under this agreement may be made in text form (Section 126b of the German Civil Code (“GCC”)), including by email, unless a stricter form is expressly required in this agreement. Notices of termination must be made in text form.

In the event of any conflict or inconsistency between this Data Processing Agreement and the Principal Contract, the provisions of this Data Processing Agreement shall prevail.

2. Subject and Duration of Processing

2.1 Subject

The processing is based on the conclusion of a contract between GotPhoto and the Photographer (“Principal Contract”), which is formed when the Photographer creates a user account on the GotPhoto website and accepts GotPhoto’s general terms and conditions in their then-current version.

The Principal Contract governs the provision of services by GotPhoto to the Photographer.  The Photographer may use these services to serve its own customers (e.g. processing of orders or production and shipping of photo products). Except as otherwise contemplated under this agreement, GotPhoto acts as a (sub)processor with respect to the processing of personal data under this agreement.

2.2 Duration

The duration of this agreement corresponds to the duration of the Principal Contract.

3. Details of the Processing

Information on the nature, the purpose of the processing, the types of personal data processed and the categories of data subjects are detailed in Annex 1 (Processing Details).

4. Obligations of GotPhoto

4.1 GotPhoto processes personal data exclusively as contractually agreed or as instructed by the Photographer, unless GotPhoto is legally required to process personal data in a certain way. If such legal requirements exist, GotPhoto will inform the Photographer before processing any data, provided that the communication is not prohibited by law. 

4.2 GotPhoto confirms that it is aware of the applicable data protection regulations.

4.3 GotPhoto and its employees are committed to keeping all personal data confidential. 

4.4 GotPhoto shall assist the Photographer, taking into account the nature of the processing and the information available to GotPhoto, in complying with the obligations set out in Articles 32 to 36 of the GDPR. Such assistance shall be provided by making available relevant information through GotPhoto’s standard communication channels (e.g., customer support, documentation, website, etc.).

4.5 If the Photographer receives requests from data subjects, GotPhoto shall, taking into account the nature of the processing, assist the Photographer by appropriate technical and organisational measures in responding to such requests, insofar as this is possible. 

4.6 GotPhoto shall not respond to data subject or third party requests directly unless required by applicable law or upon instruction from the Photographer. GotPhoto shall inform the Photographer of such requests without undue delay, to the extent the relevant Photographer can be identified based on the information directly provided in the request or otherwise readily available to GotPhoto without disproportionate effort. GotPhoto shall not be obliged to verify the identity of the requester, assess the validity of the request or undertake additional efforts, searches or investigations to identify the relevant Photographer.

4.7 Personal data is processed exclusively on the territory of the Federal Republic of Germany, in a member state of the European Union or the European Economic Area. Any transfer to a third country may only take place if the special requirements of art. 44 et seq. of the GDPR are met. 

5. Technical and Organisational Measures

5.1 GotPhoto shall implement appropriate technical and organisational measures in accordance with Article 32 GDPR, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of individuals.

5.2 The data security measures displayed at www.gotphoto.co.uk/dpa-attachments at the time the contract is concluded shall apply. These measures define the baseline level of security to be implemented by GotPhoto.

5.3 GotPhoto may update the technical and organisational measures from time to time, provided that the level of protection afforded by the measures is not materially reduced. The current version of the technical and organisational measures shall be made available to the Photographer, for example via GotPhoto’s website. 

5.4 GotPhoto shall ensure that the personal data processed under this agreement is separated from other data. The logical separation is sufficient. 

6. Rectification, Erasure and Restriction of Data Processing

6.1 GotPhoto shall only rectify, erase or restrict the processing of personal data in accordance with this agreement or the documented instructions of the Photographer. 

6.2 GotPhoto shall follow the documented instructions of the Photographer, unless GotPhoto considers that such instructions violate applicable law, in which case GotPhoto shall inform the Photographer without undue delay.

7. Sub-processing

7.1 The Photographer grants GotPhoto a general authorization to engage sub-processors for the processing of personal data under this agreement, including sub-processors located in third countries. GotPhoto shall remain fully responsible for the performance of its sub-processors’ obligations in accordance with this agreement.

7.2 GotPhoto maintains an up-to-date list of sub-processors, including their name, address and processing activities, available at www.gotphoto.co.uk/dpa-attachments. By accepting the terms of this agreement, the Photographer acknowledges and agrees to the engagement of the sub-processors listed therein.

7.3 GotPhoto may engage or replace sub-processors at any time. GotPhoto shall update the list of sub-processors accordingly and inform the Photographer of such updates via a global means of communication within the GotPhoto system (e.g. Newsfeed) or by other appropriate means.

7.4 The Photographer may object to the engagement or replacement of a sub-processor on reasonable data protection grounds within fourteen (14) days of being informed of such change in accordance with section 7.3. In the event of an objection, the Photographer may terminate the agreement in accordance with its terms.

7.5 GotPhoto shall ensure that its sub-processors are contractually bound by data protection obligations no less protective than those set out in this agreement. 

7.6 The Photographer may request information from GotPhoto regarding the data protection measures implemented by its sub-processors. To the extent required and appropriate, GotPhoto shall provide relevant documentation, summaries or third-party certifications (such as audit reports or compliance attestations).

7.7 GotPhoto shall select sub-processors with due care, taking into account their technical and organisational measures and their ability to comply with applicable data protection laws.

7.8 GotPhoto may use sub-processors in third countries. GotPhoto is required to implement appropriate safeguards, such as the EU Standard Contractual Clauses with all sub-processors, if and to the extent that a data transfer to a third country takes place in the context of the sub-processing. GotPhoto must include the foregoing obligation in any processing agreement with a sub-processor.

8. Rights and Obligations of the Photographer

8.1 The Photographer, or where the Photographer acts as a processor, the respective data controller, is responsible for ensuring that the processing of personal data complies with applicable law and the rights of data subjects are protected.  

8.2 The Photographer shall ensure that the processing of personal data is based on a valid legal basis in accordance with applicable law, including, where consent is relied upon, obtaining such consent from the data subject. Where the data subject is a minor, the Photographer shall obtain consent from the minor’s parent(s) or legal guardian, if required by applicable law. 

8.3 GotPhoto shall make available to the Photographer, upon request, all information reasonably required to demonstrate compliance with its obligations under this agreement and applicable data protection laws. This may include, in particular, documentation, summaries of technical and organisational measures and relevant third-party certifications or audit reports.

8.4 If the Photographer reasonably determines, based on specific and documented grounds, that the information provided pursuant to section 8.3 is insufficient to demonstrate compliance, the Photographer may request additional information or assurance. GotPhoto may satisfy such requests by providing up-to-date certifications, audit reports or other independent third party attestations. Audits shall primarily be conducted through the provision of documentation and remote means, taking into account the nature of the services, in particular GotPhoto’s use of cloud-based infrastructure and a distributed workforce. 

8.5 On-site inspections shall only take place where strictly necessary to verify compliance and where such verification cannot reasonably be achieved by other means. Any on-site inspection shall be subject to prior reasonable notice, confidentiality obligations and agreement on scope and timing, shall be conducted during normal business hours and in a manner that does not unreasonably interfere with GotPhoto’s business operations.     

8.6 By way of exception, the Photographer may request an on-site inspection without prior notice or on shorter notice if the Photographer can demonstrate specific facts giving rise to a reasonable suspicion of a material breach of this agreement or applicable data protection laws, or where such inspection is required by applicable law or a competent supervisory authority. This right shall only apply where prior notice would be reasonably likely to frustrate the purpose of the inspection. Any such inspection shall be limited in scope to what is strictly necessary to investigate the relevant risk, incident or suspected breach. The Photographer shall inform GotPhoto of the reasons for the inspection as soon as reasonably practicable.

9. Reporting Obligations

9.1 GotPhoto shall inform the Photographer of a personal data breach without undue delay after becoming aware of it. Such notification shall include, to the extent available, the information required under Article 33(3) GDPR and may be provided in phases as further information becomes available. 

9.2 GotPhoto shall assist the Photographer in complying with its obligations under Articles 33 and 34 GDPR. Such assistance shall be limited to the processing activities carried out by GotPhoto on behalf of the Photographer and to the information available to GotPhoto in this context.

10. Instructions

10.1 The Photographer may issue documented instructions regarding the processing of personal data within the scope of this agreement.

10.2 As a rule, instructions shall be issued in text form (e.g. by email to a contact address designated by GotPhoto). In urgent cases, instructions may be given, provided that they are confirmed by the Photographer in text form without undue delay.

10.3 GotPhoto shall inform the Photographer without undue delay if, in its opinion, an instruction infringes applicable law. In such cases GotPhoto is entitled to suspend the execution of the relevant instruction until it has been confirmed or amended by the Photographer.

10.4 GotPhoto shall document instructions received from the Photographer and their implementation.

11. Use of Anonymized Data

11.1 GotPhoto      may      anonymize personal data processed under this Agreement, provided that such anonymization is carried out in accordance with the requirements set out in this clause.

11.2 The Photographer acknowledges      that the anonymization of personal data  may serve      the Photographer’s      interest and GotPhoto’s legitimate business purposes in particular the improvement      and development of GotPhoto’s services     , including through the analysis of customer behaviour, product performance and service usage in aggregated and non-identifiable form.

11.3 GotPhoto shall ensure that any anonymization is performed in such a manner that the data can no longer be attributed to an identified or identifiable natural person, taking into account all means reasonably likely to be used by any party to re-identify the data.

11.4 The parties agree that data which has been anonymized in accordance with this clause no longer constitutes personal data within the meaning of applicable data protection laws.

11.5 The parties acknowledge and agree that      GotPhoto may      use      anonymized data for its own business purposes, including but not limited to:

• internal analytics and statistical analysis, 
• product development and improvement, 
• benchmarking and business intelligence, and 
• the creation of aggregated reports. 

11.6 GotPhoto shall not attempt to re-identify anonymized data and shall implement appropriate measures to prevent re-identification

11.7 The Photographer shall ensure that all processing of      personal data under this contract, including any anonymization of personal data, is based on a valid legal basis under applicable data protection laws and that data subjects are informed of such processing in a transparent manner, where required by law.      

12. Termination of the Agreement

12.1 Upon termination of the agreement GotPhoto shall, at the choice of the Photographer, delete or return all personal data processed on behalf of the Photographer and delete existing copies, unless applicable law requires retention of the personal data. Deletion shall be carried out in a manner that ensures that the personal data cannot be reconstructed or recovered using reasonable means. 

12.2 GotPhoto shall ensure that any sub-processors return or delete the personal data processed on behalf of the Photographer without undue delay after termination of their services, unless applicable law requires retention.

12.3 GotPhoto may retain documentation necessary to demonstrate compliance with this agreement and applicably data protection laws for the applicable statutory retention periods. Such documentation shall be subject to appropriate safeguards and shall not be used for any other purposes.

12.4 Notwithstanding the foregoing, personal data contained in backup systems shall be deleted in accordance with GotPhoto’s standard backup retention cycles, provided that such data remains protected and is not actively processed. 

13. Termination for Cause

13.1 The Photographer may terminate the Principal Contract and this agreement for cause  in the event of a material breach by GotPhoto of the terms of this agreement (“Termination for Cause”).

13.2 A breach shall be considered material, if GotPhoto fails to fulfil essential obligations stipulated in this agreement, in particular the implementation of the agreed technical and organisational measures.

13.3 Prior to Termination for Cause the Photographer shall provide GotPhoto with a reasonable period of time to remedy the breach. If the breach is not remedied within such period, the Photographer shall be entitled to terminate for cause.

13.4 Either party shall have the right to terminate this agreement for cause if the Photographer objects to the engagement or replacement of a sub-processor in accordance with Chapter 7 of this agreement and the parties are unable to reach agreement.

14. Liability

The liability of the parties vis-à-vis data subjects shall be governed by Article 82 GDPR. Any liability between the parties arising under or in connection with this agreement shall be subject to the limitations and exclusions of liability set out in the Principal Contract.

15. Miscellaneous

15.1 Each party shall treat the confidential information of the other party, including in particular information relating to technical and organizational measures, as confidential. In case of doubt information shall be treated as confidential until the other party confirms otherwise in text form. The obligation of confidentiality shall survive the termination of this agreement. Each party may use and disclose information resulting from this agreement to the extent necessary to establish, exercise or defend claims pursuant to Article 82(3) GDPR.

15.2 Any amendments or additions to this agreement must be made in text form. Text form may be satisfied through electronic communication or the use of electronic signature services.

15.3 Any rights of retention pursuant to section 273 German Civil Code with respect to personal data are excluded.

15.4 If any provision of this agreement is held to be invalid or unenforceable by a court of law, this shall not affect the validity of the remaining provisions.

15.5 This agreement shall be governed by the laws of the Federal Republic of Germany. Any dispute arising out of or in connection with this agreement shall be subject to the jurisdiction of the competent courts in Berlin, Germany.

Note: This data protection agreement does not require signatures and shall come into effect upon the Photographer’s acceptance of GotPhoto’s general terms and conditions, which reference and incorporate this data protection agreement.

Annex 1 – Processing Details

1. Photographer as Controller

1.1 Nature and purpose of processing

The nature and purpose of the processing of personal data by GotPhoto are determined by the Principal Contract. GotPhoto processes personal data on behalf of the Photographer in order to provided the services agreed therein. The processing activities include, in particular:

• the collection of personal data (including via the online shop),
• the storage and organization of personal data,
• the adaptation and modification of personal data,
• the retrieval and provision of personal data,
• the transmission of personal data to service providers engaged by or on behalf of the Photographer (e.g. for production, shipping or payment processing),
• the deletion or restriction of processing of personal data,
• the processing of customer inquiries (e.g. via contact forms),
• the anonymization and aggregation of personal data for statistical, analytical and service optimization purposes, and
• the performance of web audience analysis.

These processing activities serve the following purposes:

• enabling and supporting the processing of orders (e.g. production and shipping of photo products),
• providing and operating the GotPhoto platform, including customer and order management (e.g. complaints handling and payment status),
• enabling online sales and delivery of photos,
• organizing and managing image data (e.g. automatic sorting of photos),
• facilitating communication with customers of the Photographer (e.g. transactional or service- related communications),
• improving and developing GotPhoto’s services based on aggregated and anonymiued data, and
• enabling payment processing, where required for the selected payment method.

1.2 Type of personal data

The following categories of personal data may be processed:

• image data (in particular photographs of individuals),
• identification data (e.g. first and last name),
• contact data (e.g. postal address, email address, phone number),
• order and transaction data (e.g. order details, payment status)
• payment-related data (e.g. payment method, transaction identifiers),
• usage and behavioural data relating to the use of the online shop, and
• metadata and organizational data (e.g. group assignments, sorting criteria or similar classification information).

This data is provided either by the Photographer within the GotPhoto system or by the Photographer’s customers when using the online shop, in particualar during the order process. 

1.3 Categories of data subjects

The categories of data subjects include:

• individuals photographed by the Photographer
• customers and potentials customers of the Photographer.

2. Photographer as Processor

To the extent that the Photographer processes personal data on behalf of a third-party controller, the Photographer shall act as a processor and GotPhoto as a sub-processor.

In such cases, the nature and purpose of the processing, the types of personal data and the categories of data subjects are as described in section 1 of this Annex. 

3. GotPhoto as Controller

To the extent GotPhoto anonymizes personal data processed under the Principal Contract for its own business purposes in accordance with section 11 of this agreement, GotPhoto acts as an independent controller with respect to the anonymization process only. 

Such processing is limited to the anonymization of personal data and the subsequent use of anonymized data for statistical analysis, service improvement, product development, benchmarking, business intelligence and related business purposes.

Last update: Aug 13, 2026