Data Processing Agreement

1. About this agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Caloreel Ltd, a company registered in England and Wales ("Caloreel", the "Processor"), and the customer that holds a Caloreel account ("Customer", the "Controller"). It applies automatically while we process Client Data for you. There's nothing separate to sign.

It is intended to meet the requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR"). Terms such as "controller", "processor", "personal data", "personal data breach" and "data subject" have the meanings given in the UK GDPR. "Client Data" has the meaning given in the Terms.

If this DPA conflicts with the Terms on anything to do with the processing of Client Data, this DPA wins.

2. Roles and instructions

1. The Customer is the controller of Client Data and Caloreel is its processor.
2. We will process Client Data only on the Customer's documented instructions, unless UK law requires otherwise (in which case we'll tell the Customer first, unless the law prevents it). The Customer's instructions are: the Terms and this DPA; the Customer's use and configuration of the Services; and any other reasonable written instructions the Customer gives us that are consistent with them.
3. We'll tell the Customer promptly if we believe an instruction breaks UK data protection law.
4. The Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis, giving privacy information to its clients, and obtaining any consents it needs (for example for marketing emails or photographs of children).

3. Details of the processing

The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex 1.

4. Confidentiality

We ensure that everyone we authorise to process Client Data is bound by a duty of confidentiality, whether by contract or by law, and has access only to the extent needed for their role.

5. Security

1. We implement appropriate technical and organisational measures to protect Client Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as required by Article 32 UK GDPR. The current measures are described in Annex 2.
2. We may update these measures over time, provided the overall level of security is not reduced.
3. The Customer is responsible for using the Services securely, including managing team access, using gallery passwords or email allow-lists where appropriate, and keeping its own sign-in accounts secure.

6. Sub-processors

1. The Customer gives general authorisation for us to engage sub-processors. Our current sub-processors are listed in Annex 3.
2. We'll give the Customer at least 30 days' notice, by email to the account owner and by updating Annex 3, before adding or replacing a sub-processor.
3. The Customer may object on reasonable data protection grounds by emailing support@caloreel.com within that notice period. We'll work with the Customer in good faith to resolve the objection. If we can't, the Customer may cancel the affected Services before the change takes effect and we'll refund any prepaid fees for the unused period.
4. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible to the Customer for each sub-processor's performance of those obligations.

7. International transfers

1. Client Data files (photos, video and documents) are stored in Cloudflare R2 in an EU-jurisdiction bucket.
2. We'll only transfer Client Data outside the UK, or allow a sub-processor to do so, where the transfer is protected by a safeguard recognised under UK data protection law. That means UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US organisations), the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses.
3. The Customer authorises the transfers to the sub-processors in Annex 3 on that basis.

8. Helping with data subject requests

1. The Services include tools that let the Customer find, export, correct and delete Client Data. Taking into account the nature of the processing, we'll provide further reasonable help so the Customer can respond to requests from data subjects exercising their rights under Chapter III UK GDPR.
2. If we receive a request directly from one of the Customer's clients, we'll forward it to the Customer without undue delay and won't respond ourselves, other than to tell the person we've passed it on.

9. Helping with compliance

Taking into account the nature of the processing and the information available to us, we'll provide reasonable help to the Customer with its obligations under Articles 32 to 36 UK GDPR, including security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner's Office.

10. Personal data breaches

1. We'll notify the Customer without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Client Data.
2. Our notice will describe, as far as we know at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact for more information. Where we don't have all the information at once, we'll provide it in phases as we learn more.
3. We'll take reasonable steps to contain and investigate the breach and reduce its effects, and we'll co-operate with the Customer so it can meet its own obligations, including any notification to the ICO or to data subjects.
4. Notifying a breach is not an admission of fault or liability.

11. Deletion and return

1. During the subscription, the Customer can export its Client Data at any time.
2. When the subscription ends, the Customer has a 30-day export window, as described in the Terms. After that, we delete Client Data from our live systems, and backup copies are deleted as those backups expire, within a further 30 days.
3. We may keep Client Data only where UK law requires us to, and then we'll protect it and use it only for that purpose.

12. Audits and information

1. We'll make available the information reasonably necessary to demonstrate compliance with this DPA and Article 28 UK GDPR. On request (no more than once a year, unless there's been a breach or a regulator requires it), we'll answer a reasonable security questionnaire and share relevant documentation.
2. If that information isn't enough to show compliance, or a regulator requires it, the Customer (or an independent auditor bound by confidentiality) may carry out an audit, including an inspection. The Customer must give at least 30 days' written notice and agree the scope with us in advance. Audits must take place during business hours, avoid disrupting our service, respect the confidentiality of other customers' data, and are at the Customer's cost.

13. Liability

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in the Terms of Service, except where the law does not allow it to be limited.

14. Duration and changes

1. This DPA lasts for as long as we process Client Data for the Customer, including during the export window and deletion process.
2. We may update this DPA to reflect changes in law, regulatory guidance or our sub-processors (under section 6). We'll notify customers of material changes in line with the Terms. Changes won't reduce the protection of Client Data.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

Encryption

• All connections to Caloreel use HTTPS (TLS) encryption in transit.
• Stored data, including files and database records, is encrypted at rest.
• Particularly sensitive values, including synced email content, connected-account tokens, lab credentials, gallery passwords and download PINs, have an additional layer of application-level encryption (AES-256-GCM).

Access control

• Every record belongs to a single studio, and access is checked against that studio on every request.
• Role-based permissions within each studio (owner, admin, staff limited to assigned jobs, read-only accountant).
• Passwordless sign-in through single-use email links that expire after 15 minutes, or Google sign-in. Sign-in tokens are stored hashed.
• Client access uses signed, expiring and revocable links, with optional gallery passwords, email allow-lists and download PINs.
• Rate limiting on authentication endpoints.

Our staff

• Multi-factor authentication for staff access to production systems and provider consoles.
• Least-privilege access, reviewed when roles change and removed when someone leaves.
• Support access to a customer's account is time-limited and recorded in an audit log.
• Confidentiality obligations for everyone with access to Client Data.

Logging and monitoring

• Audit logs of important account actions and administrative access.
• Monitoring of errors and unusual activity, with an incident response process.

Resilience and backups

• Regular backups of databases, with restore procedures.
• Hosting on infrastructure designed for high availability.

Data location and minimisation

• Files are stored in Cloudflare R2 in an EU-jurisdiction bucket.
• Sub-processors receive only the data they need (for example, labs receive the image, product and delivery details for an order).

Development and suppliers

• Code review before changes reach production, and prompt patching of dependencies with known vulnerabilities.
• Due diligence on sub-processors and written data protection terms with each of them.

Annex 3: Sub-processors

To object to a new sub-processor, or to ask for more detail about any of them, email support@caloreel.com with "DPA" in the subject line.