Data processing agreement

1. In short

• We never use your photos for anything else without your written permission: no training, no advertising, no showcase.
• Your account data is stored in Germany. Your photos are stored at Cloudflare R2, where Cloudflare chooses the location. AI features use EU endpoints wherever they exist.
• When you delete your account, it goes offline at once and we erase your photos and data after 14 days. Until then you can restore it.
• New processing, such as face grouping, is always off until you switch it on.
• If something goes wrong with your data, we tell you within 24 hours of finding out.

2. Who is who

You decide what happens with the photos and client details you put in ProFotograaf. That makes you the controller. ProFotograaf (KvK 84222689, the Netherlands) processes them for you and is the processor.

This agreement covers the personal data you store in Profotograaf:

• photos of you, your clients and the people in them;
• client details: name, e-mail, phone, notes, bookings, quotes, invoices, messages and questionnaires;
• contracts: the signer's name, IP address and browser;
• activity in your galleries: favourites, proofing choices, views and downloads, recorded under a pseudonymous key;
• website visitors: contact form messages and comments.

Your own account details as a customer of Profotograaf are covered by our privacy policy, where we are the controller.

3. What we do with your photos

We process your data only to provide the service you signed up for, and only on your instructions. Your instructions are the settings you choose and the actions you take in Profotograaf.

We do:

• store your photos, galleries and client details;
• make image sizes and previews, and serve them to the people you share them with;
• send the e-mails you trigger, such as a gallery link to a client;
• keep backups so we can recover from a failure.

We never, without your written permission:

• use your photos to train or improve AI models;
• use your photos in our own advertising, showcase or social media;
• sell, rent or share your photos or client data with anyone;
• look at your photos, except when you ask us for support or the law requires it.

If the law requires us to hand over data, we tell you first, unless the law forbids that.

4. Where your data lives

Your account data is stored in Germany. Your photo files are stored at Cloudflare R2, where Cloudflare chooses the location and we have not set an EU-only jurisdiction. We use the subprocessors below, and their EU endpoints wherever they offer one.

We tell you at least 30 days before we add or replace a subprocessor. If you object and we cannot resolve it, you may end your account and we refund the unused part of your subscription.

Where data leaves the EU, we rely on the EU-US Data Privacy Framework or the EU standard contractual clauses.

5. Security and incidents

We protect your data with these measures:

• All traffic is encrypted with TLS.
• Sign-in supports passkeys. Gallery and client portal links use unguessable tokens, and portal tokens are stored hashed.
• Secrets are encrypted and only reach the parts of the system that need them. Our servers run with minimal rights.
• Only the operator of Profotograaf has access to the production systems.
• Photo files and database backups are encrypted at rest (AES-256) by our storage provider, Cloudflare R2. Instagram access tokens are encrypted in our database.
• We make a database backup every night and test a restore every week. Backups are kept for 14 days.
• Errors and unusual activity are logged and monitored.
• Visitor identifiers expire. The key behind gallery views, portfolio views and downloads is a hash keyed with a server secret that changes every calendar month, and it is removed from the record twelve months after the view or download. The counts stay. The address and browser stored with a contact form message are removed after twelve months, and the hash of a commenter's address after 24 hours.
• Contract signing records (the signer's name, IP address and browser) are proof of the signature. They are kept with the signed contract until you delete the contract or your account.

If something goes wrong. When we find a breach that affects your data, we tell you within 24 hours. We say what happened, which data is involved, what we are doing about it and what you may need to do. You then decide whether to report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and your clients, and we help you with that.

Reporting a vulnerability. Found a security problem? E-mail [email protected]. Our security policy and our security.txt (/.well-known/security.txt) describe how we handle reports.

6. Leaving Profotograaf

When you delete your account, it goes offline at once and we erase your photos and data after a grace period of 14 days. Until that date you can restore the account yourself.

• Before you delete. You can download all your photos at any time. Before deletion you can download all your invoices. Keeping them for the legal retention period is your responsibility.
• Deleting. In your settings, choose Account, then Delete account, and confirm. We cancel your subscription and take your website, galleries, client portal and embeds offline right away.
• During the 14 days. We keep storing your data on your behalf and do not use it for anything else. Your account only allows restoring, exporting your data and signing out. We e-mail you when you ask for the deletion, 7 days later and 1 day before the erasure, each time with the date and a link to restore.
• Restoring. Restore the account at any time before the date and your website, galleries and client portal come back. The account returns on the Free plan, because the subscription was cancelled when you asked for the deletion.
• After 14 days. We erase your photos, galleries, client data and account. From the moment the erasure starts it can no longer be undone.
• Backups. Copies in our backups are overwritten within 14 days, so they can persist for that period. We never use a backup to restore an account you deleted.

Cancelling a subscription is different from deleting your account: you move to the Free plan at the end of your paid period and keep your work. The steps for erasure are described on our data deletion page.

7. Face grouping (planned)

We plan to add face grouping in 2027. It groups photos of the same person in a gallery, so you can find everyone's photos quickly. It is off until you switch it on.

• Your choice. It is off by default. You switch it on per account or per gallery, and you can switch it off at any time.
• EU only. Detection and grouping run on servers in the EU. No face data leaves the EU.
• No profiles. We store only the grouping data needed to keep photos of one person together within your account. We never link a person across accounts, never put a name to a face unless you add it, and never use the data for anything else.
• Deleted with the switch. When you switch it off, we delete the grouping data within 30 days. Your photos stay as they are.
• Removal per person. You can remove a person from the grouping, for example when a client asks you to.

Grouping faces to recognise a person counts as processing of biometric data under the GDPR (Article 9). We will run a data protection impact assessment before release. As the controller, you need a legal basis to use it for the people in your photos, usually their explicit consent. We give you text you can use in your booking terms.

We will tell you at least 30 days before face grouping becomes available, with the final details.

8. Your rights and our help

• Requests from your clients. When a client asks to see, correct or delete their data, you can do most of it yourself in Profotograaf. For anything you cannot, we help within 5 working days.
• Instructions. If we think an instruction from you breaks the GDPR, we tell you before acting on it.
• Proof. On request we show how we meet this agreement. You can ask for an audit once a year, at your own cost, with 30 days' notice. We may answer with a recent independent report.
• Confidentiality. Everyone at Profotograaf who can reach your data is bound to confidentiality.
• Help with your duties. We help you with impact assessments and questions from a supervisory authority, as far as they concern our processing.

9. Changes, term and contact

• Questions. E-mail [email protected] about data processing or privacy. We answer within 5 working days.
• Changes. We announce changes to this agreement at least 30 days in advance by e-mail. If you do not agree, you can end your account before the change applies.
• Term. This agreement runs as long as we process data for you. It ends when your data is deleted.
• Order of documents. This agreement is part of the terms of service. For data processing, it takes precedence over them.
• Law. Dutch law applies.