Data processing agreement
Personal data processing agreement (Art. 28 GDPR) between the User of the Flyp platform, i.e. the photography studio, as the controller and the operator of Flyp as the processor. It forms an integral part of the terms of service. You conclude it by accepting it when you sign up or on the acceptance screen in the panel; we record the version and date of acceptance in your account.
§1. Parties and definitions
• Controller: the User, i.e. the person or company running a studio in Flyp, who decides on the purposes and means of processing their clients’ data.
• Processor: Usługi Programistyczne Marcin Rzepecki, ul. Bakalarska 15B/6, 02-212 Warszawa, Tax ID (NIP) 5223218129, e-mail kontakt@flyp.pl, the operator of the Flyp platform.
• GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council.
• Data: personal data that the Controller enters into Flyp or collects with it (booking forms, galleries, contracts, payments).
• Sub-processor: an entity to which the Processor further entrusts the processing of Data, listed in §15.
§2. Subject matter and duration
The Processor processes Data on behalf of the Controller to the extent needed to provide the Flyp service: running and providing the application, storing photos, documents and client data, sending e-mails on behalf of the studio, handling payments and integrations enabled by the Controller, and making backups.
The agreement applies for as long as Flyp is used and, after that, until the Data is deleted in accordance with §11.
§3. Nature and purpose of processing
Processing is automated and takes place in the Flyp IT system. It covers collection (through the studio’s forms), recording, storage, organisation, consultation, making available to clients (galleries, links, messages), transmission to Sub-processors and erasure.
The sole purpose is to provide the Flyp service to the Controller. The Processor does not use the Data for its own purposes, including marketing or training models.
§4. Types of data and categories of data subjects
Types of Data:
• identification and contact data: name, e-mail address, phone, address, client company details;
• booking and session data: date, location, session type, notes, questionnaire answers;
• image recorded in photos, including children;
• content of contracts and electronic signatures with technical signature data (IP address, browser, time);
• consents and their history (marketing, publication of image);
• payment and order data: amounts, status, delivery address, without card numbers;
• technical data of visitors to the studio’s galleries and pages: IP address and, with consent, analytics identifiers.
Categories of data subjects: the Controller’s clients and contact persons of business clients, session participants (including minors), visitors to galleries and booking pages, voucher recipients, persons signing contracts and members of the studio’s team.
Flyp is not intended for processing special categories of data (Art. 9 GDPR). If the Controller enters such data (e.g. in notes), it does so at its own responsibility and only where it has a legal basis.
§5. Controller’s instructions
The Processor processes Data only on documented instructions from the Controller, including with regard to transfers to a third country. Instructions are: this agreement, the terms of service, the Controller’s settings and actions in the panel, and instructions sent by e-mail from the studio owner’s address.
Where processing is required by EU or Polish law, the Processor informs the Controller of that requirement before processing, unless the law prohibits it. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection rules.
§6. Confidentiality and security
The Processor grants access to Data only to authorised persons bound by confidentiality, and only to the extent needed to provide the service or support at the Controller’s request.
The Processor applies the measures under Art. 32 GDPR, in particular:
• encrypted connections (TLS) and encryption of photo and document files by the application before they are written to storage;
• access control with roles and permissions in the studio and two-factor authentication available for accounts;
• a gallery access log and a log of platform administrator actions;
• daily database backups;
• error monitoring with content masking and ongoing security updates.
§7. Sub-processors
The Controller gives general authorisation for the Processor to engage Sub-processors. The current list is in §15.
The Processor informs the studio owner by e-mail and with a notice in the panel at least 14 days before it intends to add or replace a Sub-processor. Within that period the Controller may object by writing to kontakt@flyp.pl. If the objection cannot be accommodated, the Controller may terminate the Flyp agreement with effect before the change, at no extra cost, with a pro rata refund of the fee for the unused period.
The Processor imposes on Sub-processors the same data protection obligations as in this agreement (Art. 28(4) GDPR) and remains liable to the Controller for their performance.
Services in which the studio has its own account with the provider (payment operators, InPost ShipX, MailerLite, Mailchimp, iFirma, Fakturownia) operate under the studio’s agreement with that provider; Flyp passes Data to them on the Controller’s instructions. The studio configures advertising pixels itself and is jointly responsible for them with their provider.
§8. Transfers outside the EEA
Data is processed in the European Economic Area unless §15 states otherwise. Transfers outside the EEA take place only on the basis of Chapter V GDPR: a European Commission adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses. §15 gives the basis for each Sub-processor.
§9. Assistance with data subject rights
The Processor assists the Controller in responding to requests from data subjects (Chapter III GDPR), primarily through tools in the panel: viewing and editing client data, exporting client data, anonymisation and deletion. A request sent directly to the Processor is forwarded to the Controller without undue delay and is not answered on the merits without the Controller’s instruction.
§10. Personal data breaches and assistance to the Controller
The Processor notifies the Controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, at the studio owner’s e-mail address. The notification contains the information under Art. 33(3) GDPR available at the time, and the Processor provides further information as it becomes known.
Taking into account the nature of processing and the information available, the Processor assists the Controller in meeting its obligations under Art. 32 to 36 GDPR: security of processing, notifying breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation.
§11. End of processing: return and deletion of data
After Flyp is no longer used (the studio is closed), the Controller has 30 days to cancel the closure and download client data and files. After that period the Processor deletes the studio’s Data, photos and documents, unless the law requires them to be kept longer (e.g. accounting documents for the period required by tax law).
Database backups are kept on the server for 7 days and copies of them on the Processor’s device in Poland for 90 days; deleted Data disappears from backups when they are overwritten.
While the agreement is in force, the following retention periods apply to technical data: content of sent e-mails 90 days, sending log 365 days, gallery access log 180 days, individual gallery statistics events 90 days, panel notifications 180 days.
§12. Information and audits
The Processor makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR and allows for audits, including inspections, conducted by the Controller or an auditor mandated by it who is bound by confidentiality.
An audit takes place once a year, with 30 days’ notice, primarily remotely (questions, documentation, explanations), at the Controller’s expense. An additional audit is possible after a personal data breach or at the request of a supervisory authority. An audit must not compromise the confidentiality of other studios’ data or the security of the platform.
§13. Controller’s obligations and rights
The Controller is responsible for the legal basis for processing the Data, for providing data subjects with the information under Art. 13 and 14 GDPR (Flyp provides a template studio privacy policy, which is not legal advice) and for the content of the data entered. The Controller may at any time give instructions through the panel or by e-mail, request information about processing and exercise the right to audit.
§14. Liability, changes and final provisions
The parties are liable for damage in accordance with Art. 82 GDPR.
The Processor may change the agreement or the list of Sub-processors for valid reasons (change in law, new feature, change of provider). It gives notice by e-mail and in the panel at least 14 days before the change takes effect. From that day the panel asks for acceptance of the new version; until then the Controller may object or terminate the agreement under §7. The Processor records the version and date of acceptance in the account.
Matters not regulated here are governed by Polish law and the GDPR. The Polish version of the agreement is binding.
§15. List of sub-processors