Data Processing Agreement

1. Parties and definitions

You (the photographer or videographer with a Pictual account) are the data controller for your own clients' personal data: you decide which photos you upload, who you send a gallery to, and for what purpose. Pictual is the processor: we process that data solely on your behalf and according to your instructions, as set out through your use of the platform itself (uploading, sending, settings such as password protection or downloads on/off).

This agreement supplements the Terms of Service and specifically governs the processing of personal data within the meaning of the GDPR (General Data Protection Regulation).

2. Subject matter and duration

Pictual processes personal data for the purpose of providing the platform: storing, displaying, and (on your instruction) sending client galleries, and facilitating the client selection feature.

This agreement applies for as long as you have a Pictual account and ends automatically (together with the deletion of your data, see section 10) once you delete your account.

3. Nature, purpose, and types of data

The processing concerns the following categories of personal data of your clients (the "data subjects"):

• Photos and video embeds you upload to a gallery (may contain identifiable people)
• Client email addresses, if you use them to send a gallery invitation
• Selection data (which photos a client chose) and any comments a client leaves on a photo

The purpose is solely to make the platform function as you use it — no profiling, no advertising purposes, no resale.

4. Pictual's obligations as processor

Pictual commits to:

• Processing personal data only on your instructions (through use of the platform) and not for its own purposes
• Implementing appropriate technical and organizational security measures (see section 6)
• Ensuring confidentiality — everyone with access to data (including Pictual itself) is bound by confidentiality
• Supporting you in meeting your own GDPR obligations toward your clients (see section 8)
• Notifying you of data breaches without undue delay (see section 7)

5. Sub-processors

Pictual uses the following sub-processors to deliver the platform:

• IDrive e2 (storage in an EU data center) — for storing and delivering your photos
• Etheron Hosting — for server and database hosting of pictual.nl/pictual.net
• Mollie — for processing payments on paid subscriptions

Data processing agreements are in place with both parties. If we add a new sub-processor that materially affects your data, we'll let you know by email or a dashboard notice.

6. Security measures

Pictual implements, among others, the following measures:

• Passwords are stored hashed (never readable, not even by us)
• Connections are encrypted via HTTPS/TLS
• Galleries can optionally be password-protected, set by you
• Access to production systems is limited to those who need it

7. Data breach notification

Should a data breach occur that affects your clients' personal data, we will notify you without undue delay (and no later than 48 hours after discovery), so that you — as the data controller — can assess whether and how to report it to the relevant supervisory authority and/or the data subjects.

8. Assistance with data subject rights

If one of your clients requests access to, correction of, or deletion of their data, Pictual will help you fulfil that request — for example by removing a photo or gallery at your request. Contact us at info@pictual.nl.

9. Confidentiality

Pictual and anyone acting on Pictual's behalf with access to personal data (for example, for support purposes) is bound by confidentiality, including after this agreement ends.

10. Return and deletion upon termination

If you delete your Pictual account, all your galleries, photos, and associated client data are permanently deleted (including from our storage partner), as described in the Privacy Policy. You can always download your photos yourself before deletion.

11. Liability and governing law

Liability for breach of this agreement is governed by the Terms of Service. This agreement is governed by Dutch law.