Data Processing Agreement

1. Parties

This Data Processing Agreement (the "DPA") is entered into between the professional who holds a Momentzy partner account (the "Controller") and Momentzy, headquartered in Lisbon, Portugal (the "Processor"). It is part of the Terms of Use and applies from the moment the Controller accepts it on Momentzy.

For the personal data described below, the Controller decides why and how the data is processed and Momentzy processes it on the Controller's behalf, as provided for in article 28 of Regulation (EU) 2016/679 (GDPR).

2. Subject matter and duration

The subject matter is the processing of the personal data that the Controller collects or receives through Momentzy while using the platform for its clients, in the cases listed in the next section.

The DPA lasts as long as the Controller's partner account exists and, after that, for as long as Momentzy still holds data covered by it (see the section on deletion or return).

3. Nature and purpose of the processing

Momentzy processes the data only to provide the following services to the Controller:

• hosting the Controller's galleries and the photographs and videos in them;
• keeping the list of visitors of a gallery (name and email of the people who ticked the optional box at the gallery door) and making it available to the Controller, including as a CSV export;
• handling the print orders that guests place in the Controller's galleries, so that the Controller can fulfil them;
• face search in a gallery or event, only where the Controller has switched this feature on.

Outside this scope Momentzy acts as a data controller in its own right, for example for the anonymous entry counter, for security and for billing, as described in the Privacy Policy.

4. Categories of data and data subjects

The data processed under this DPA is:

• name and email address of gallery visitors who gave them;
• dates and number of visits to a gallery;
• photographs and videos uploaded to the Controller's galleries and events;
• contact details and delivery address in print orders;
• face embeddings (numerical representations of faces), only if the Controller has enabled face search.

The data subjects are the guests and visitors of the Controller's galleries, the participants in its events, the Controller's clients and the people who appear in the photographs.

Face embeddings are biometric data (art. 9 GDPR). The Controller must have a valid legal basis, normally the explicit consent of the people concerned, before it switches face search on. Momentzy does not process special categories of data for any other purpose.

5. Obligations of the Controller

The Controller confirms that it has a legal basis for the processing, that it informs the data subjects as the law requires, and that its instructions to Momentzy comply with the GDPR. The Controller is responsible for what it does with the data it exports from Momentzy, including the visitor list.

6. Obligations of Momentzy

Momentzy undertakes to:

• process the data only on the Controller's documented instructions, which are this DPA and the Controller's use of the platform's features, and to tell the Controller if it considers that an instruction infringes data protection law;
• ensure that the people authorised to process the data are bound by confidentiality;
• apply appropriate technical and organisational security measures (art. 32 GDPR), including encryption in transit, access control, separation of accounts, backups and monitoring;
• help the Controller answer data subject requests (access, rectification, erasure, withdrawal of consent), including through the withdrawal and deletion forms made available to visitors;
• notify the Controller without undue delay after becoming aware of a personal data breach that affects the Controller's data, with the information it has available, and help it with the notification to the authority and to the data subjects;
• help the Controller with data protection impact assessments and prior consultations where they relate to this processing.

7. Sub-processors

The Controller gives Momentzy a general authorisation to use sub-processors.

The sub-processors in use on the date of this version are:

• Cloudflare, Inc.: object storage (R2) for photographs and videos, and network and content delivery;
• Brevo (Sendinblue SA): sending transactional emails;
• Stripe, Inc.: payment processing for print orders and subscriptions;
• the servers where the application, the database and the face search service run, operated by Momentzy.

Momentzy informs the Controller of any intended addition or replacement of a sub-processor, by email or on this page, before it takes effect, and the Controller may object on reasonable data protection grounds. If the objection cannot be resolved, the Controller may terminate the account.

Momentzy imposes on each sub-processor obligations equivalent to those of this DPA and remains responsible to the Controller for their performance.

8. International transfers

Momentzy stores the data in the European Union or the European Economic Area wherever possible. Where a sub-processor transfers data outside the EEA, it does so only under an adequacy decision or the standard contractual clauses approved by the European Commission, together with the supplementary measures that are needed.

9. Deletion or return of data

The Controller can export the visitor list and the photographs at any time while the account is active. When the account ends, or the Controller asks, Momentzy deletes the data covered by this DPA, within the retention periods described in the Privacy Policy, unless the law requires it to keep some of it (for example invoicing records).

Deleting a gallery deletes its visitor list. A visitor who withdraws consent is removed from the list.

10. Audits

Momentzy makes available to the Controller, on written request, the information needed to show that it complies with this DPA. The Controller may carry out an audit, once a year or after a data breach, with reasonable prior notice, without disrupting the service and subject to confidentiality.

11. Liability

Liability between the parties is governed by the Terms of Use, including its limits. Nothing in this DPA limits the rights of data subjects against either party under article 82 of the GDPR.

12. Governing law and precedence

This DPA is governed by Portuguese law. In what concerns the processing of personal data, it prevails over the Terms of Use if they conflict.

Questions about this DPA can be sent to the contact below.

Privacy contact: support@momentzy.com

13. Acceptance and versions

The Controller accepts this DPA by ticking the box when it creates a partner account, or by pressing the accept button in its dashboard. Momentzy records the date, the version and the user who accepted it. When the text changes, the version changes and the Controller is asked to accept again. Until then, the features that depend on it, such as the visitor list, stay closed.