Data Processing Agreement

1. Parties and roles

The customer is the data controller for personal data processed through the booths and the management platform. MADA Tech, the publisher of photoboothsoftware.eu, is the data processor and processes data solely on the customer's written instructions.

2. Subject matter and duration

The processing covers the provision of photo booth software: creating, storing, editing, printing, and sharing photos and videos, as well as managing sessions, events, and customer contacts. The agreement remains in effect for the duration of the subscription.

3. Types of data and data subjects

• Guests: images, session time, and optionally an email address or phone number when sharing photos or providing consent.
• Customer employees: name, email address, role, and login details.
• The customer's clients: contact and billing details for quotes and bookings.

4. Security measures

• Encrypted transport (TLS) and encrypted photo storage.
• Personal accounts, roles and permissions, plus logging of administrative actions.
• Secure sharing links with a limited validity period.
• Automatic retention periods for each event and manual deletion for each photo or session.
• Backups within the European Union and recovery procedures.

5. Subprocessors

The customer grants general authorisation to engage subprocessors for hosting, email delivery and payment processing, all with processing taking place within the European Union. If a subprocessor is replaced, the customer will be informed at least thirty days in advance and may object.

6. Transfers outside the EU

Personal data is not routinely transferred outside the European Economic Area. If this should nevertheless be necessary, it will only take place on the basis of an adequacy decision or standard contractual clauses.

7. Confidentiality

Everyone who has access to personal data on behalf of the processor is bound by confidentiality. Access is limited to what is necessary for support and maintenance.

8. Rights of data subjects

The processor assists the customer with requests for access, rectification, erasure and data portability. The customer can view, export and delete photos, sessions and guest data directly in the admin environment.

9. Data breaches

The processor will notify the customer of a suspected data breach within 24 hours of discovery, including the known facts, potential consequences and measures taken. As the data controller, the customer is responsible for notifying the Dutch Data Protection Authority and the data subjects concerned.

10. Audit

The customer may commission an annual audit to verify compliance with this agreement, provided at least two weeks' notice is given and the service is not disrupted. The customer will bear the audit costs unless material deficiencies are identified.

11. Retention and return

At the end of the subscription, the environment will remain available for export for thirty days. After this period, all personal data will be deleted, except for data subject to a statutory retention obligation.

12. Liability

This data processing agreement is subject to the liability provisions set out in the general terms and conditions .

Signature

This data processing agreement is deemed accepted when a subscription is taken out. A signed copy is available on request via info@madabooth.nl.