Data Processing Agreement

• Controller: the Photographer registered on the Platform — they decide the purposes and means of processing customer and child data.
• Processor: Imre Dobó, sole proprietor (Hajnal utca 14. 2/13., 4029 Debrecen, Hungary; tax number: 53669401-1-29; email: doboimre86@gmail.com) — operator of the Képesbolt platform.

The DPA enters into force together with the acceptance of the Terms of Service and remains in force for the duration of the service contract and until deletion of the data. Processing where the platform acts as controller is described in the Privacy Policy.

• Data subjects: visitors and customers of the Photographer's galleries (typically parents and family members) and the persons depicted — including children.
• Data categories: customer name, email, phone, billing and delivery details; order contents and comments; gallery access data (email gate, visit log: IP address, user agent); and photographs containing children's likeness.

(1) Scope. This Section applies only if the controller Photographer has enabled the feature in their account and in the given gallery. Enabling the feature and its settings (number of e-mails: one or at most two; timing: a set number of days after entry and/or a set number of days before the ordering deadline) constitute documented instructions under Section 4 [GDPR Art. 28(3)(a)].

(2) Subject matter and purpose. Sending, on the Photographer's behalf and instructions, at most two e-mails about the ordering deadline to visitors who entered via the gallery's e-mail gate but have not ordered; recording the acknowledgement of the notice shown at entry; keeping a record of unsubscribes and objections (suppression list) so that the data subject receives no further such e-mails.

(3) Nature. Automated scheduling and sending. The system stops sending if the visitor orders, unsubscribes or objects, if the gallery closes or expires, or if the Photographer disables the feature. No e-mail is sent after the deadline.

(4) Data subjects. Visitors who provided an e-mail address at the gallery's e-mail gate and have not ordered by the ordering deadline.

(5) Categories of data. E-mail address; gallery identifier, name and ordering deadline; time and language of entry; whether the data subject has ordered; version and timestamp of the notice shown at entry; time and status of sending; the fact and time of unsubscribe or objection.

(6) Retention. The Processor processes the reminder data until the last notification is sent, at the latest until the gallery closes. The record of acknowledgement is kept until the gallery is deleted, at the latest until deletion at the end of the contract under Section 10. The suppression list contains only the e-mail address and the time of objection, and only for as long as the Photographer's account exists, as this is necessary to honour the objection.

(7) Photographer's responsibility. The e-mails are sent in the Photographer's name, with the Photographer shown as sender. The Photographer as controller is responsible for the legal basis of sending, the content of the e-mails and informing data subjects. The notice text generated by the Platform is an aid that the Photographer may also publish in their own notice. The Processor does not assess the legal basis; the Photographer acknowledges this separately when enabling the feature.

The processor processes personal data only on the controller's documented instructions (Art. 28(3)(a)): the Terms, this DPA and the settings made by the Photographer in the admin interface. The processor informs the controller if an instruction appears to infringe the law, does not use the data for its own purposes and discloses it to no one except the sub-processors listed below, unless required by EU or Member State law.

Persons authorised to access the data are bound by contractual or statutory confidentiality (Art. 28(3)(b)); access is limited to what is strictly necessary.

• TLS/HTTPS on every interface and API connection;
• provider keys and tokens stored encrypted (AES-256-GCM);
• bcrypt-hashed passwords; gallery access cookies contain no passwords;
• tenant-level access separation — each Photographer's data is isolated;
• tokenised, time-limited downloads (unique links valid for 30 days);
• gallery protection tools: password, email gate, scheduled access, watermark, search engine exclusion;
• logging and daily automated database backups retained for 14 days, plus a backup before each version deployment.

The controller gives general authorisation for the sub-processors below (Art. 28(2)). The processor imposes equivalent data protection obligations on them and notifies the controller of intended changes in advance; the controller may object.

The processor notifies the controller of any personal data breach without undue delay — at the latest within 48 hours of becoming aware of it (Art. 33(2)) — describing its nature, the estimated scope of affected data and subjects, the likely consequences and the measures taken. Notifying the supervisory authority (72 hours) and the data subjects is the controller's obligation, in which the processor fully assists.

Taking into account the nature of the processing, the processor assists the controller in responding to data subject requests (Art. 28(3)(e)) and in complying with Articles 32-36 (security, breach handling, data protection impact assessments; Art. 28(3)(f)). Requests received directly from data subjects are forwarded to the controller without delay.

On termination, at the controller's choice, the processor returns the data (via the export available in the interface) and/or deletes it (Art. 28(3)(g)). After a 30-day grace period, processed personal data is deleted or anonymised from active systems and Drive storage managed by the processor. Deleted data rolls out of daily backups after their 14-day rolling retention period. The only exception is data that Union or Member State law requires the processor itself to retain. Invoices issued to Buyers are held in the Photographer's own invoicing account; retaining them is the Photographer's obligation.

The processor makes available all information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits conducted by the controller or an auditor mandated by the controller (Art. 28(3)(h)) — at most once a year, with at least 15 days' prior written notice, protecting trade secrets and other customers' data.

This DPA is effective from 26 August 2026 (v1.1; editorial amendment of 16 October 2026 clarifying the retention reference) and is amended together with the Terms of Service. In matters not regulated here, the GDPR, Hungarian Act CXII of 2011 and the Terms apply.