1. Scope and How This Addendum Is Agreed

This DPA is incorporated into the Terms of Service and takes effect automatically when you accept them, with no signature required. If you need a countersigned copy for your own records or for your clients, email hello@viewdora.com with “DPA” in the subject line and we will provide one.

It applies to the extent that the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended, or a comparable law applies to your processing of Client Data through the Services.

2. Definitions

“Controller,” “processor,” “data subject,” “personal data,” “processing,” and “personal data breach” have the meanings given in the GDPR. “Business,” “service provider,” “contractor,” “consumer,” “sell,” and “share” have the meanings given in the CCPA. “Client Data” means personal data about your clients and the people depicted in your photographs that we process on your behalf through the Services, as detailed in Annex A. Terms defined in the Terms of Service have the same meaning here.

3. Roles and Details of the Processing

You are the controller of Client Data and we are your processor. You determine the purposes and means of processing Client Data; we process it only to provide the Services and only as this DPA and your instructions permit. The subject matter, duration, nature, purpose, data types, and categories of data subject are set out in Annex A.

We are an independent controller, not your processor, for account administration, billing, authentication and security, fraud prevention, service and error monitoring, product analytics, support, legal compliance, and our own marketing to you. Nothing in this DPA makes us your processor for those purposes, and nothing in it makes you responsible for them.

4. Our Obligations as Processor

• Documented instructions. We process Client Data only on your documented instructions, which consist of this DPA, the Terms of Service, and the configuration and actions you take in the Services, unless a law we are subject to requires otherwise — in which case we will tell you before processing, unless that law prohibits it. We will tell you if, in our opinion, an instruction infringes applicable data-protection law.
• No independent use, with one disclosed exception (see below). We do not sell Client Data, do not share it for cross-context behavioural advertising, and do not use it to train artificial-intelligence or machine-learning models. We do not combine it with personal data from other sources except as permitted for a service provider under applicable law. We do not use your photographs or gallery content for our own marketing.
• Confidentiality. Personnel authorised to process Client Data are bound by confidentiality obligations and are granted access only where they need it.
• Security. We implement the technical and organisational measures described in Annex B, appropriate to the risk.
• Assistance with data-subject requests. The Services let you access, correct, export, and delete Client Data yourself. If a data subject contacts us directly about your Client Data, we will not respond substantively other than to direct them to you, and we will tell you promptly. Where you cannot fulfil a request through the Services, we will provide reasonable assistance.
• Breach notification. We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Client Data, with the information reasonably available to us, and we will provide further detail as the investigation progresses. We will cooperate with you and take reasonable steps to contain and remediate the breach.
• Assistance with assessments. We will provide reasonable assistance with your data protection impact assessments and prior consultations with a supervisory authority, so far as they relate to our processing and the information is available to us.

5. Your Obligations as Controller

• You are responsible for the lawfulness of the Client Data you upload and of your instructions, including having a valid legal basis and giving your clients their own privacy notice.
• You are responsible for obtaining the permissions and giving the notices that the people depicted in your photographs are entitled to, including where those people are children.
• You must not upload the categories of data prohibited by Section 6 of the Terms of Service — in particular HIPAA-regulated health information, payment card or bank credentials, or biometric identifiers and templates — and you must not upload government identification numbers or authentication secrets, which this DPA prohibits independently. The Services are not designed for any of them and this DPA does not cover them.
• You are responsible for responding to your clients’ privacy requests, and for configuring gallery access, sharing, downloads, and retention appropriately.
• You must keep your account credentials and your team’s access secure.

6. Subprocessors

You give us general authorisation to engage subprocessors to process Client Data. Our current subprocessors are listed at viewdora.com/policies/subprocessors.

• We impose data-protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain liable to you for their performance.
• We will give at least 30 days’ advance notice before a new subprocessor starts processing Client Data, to everyone who has asked to be notified. To subscribe, email hello@viewdora.com with “Subprocessor Notifications” in the subject line.
• You may object on reasonable data-protection grounds within that 30-day period by writing to us with your reasons. We will work with you in good faith to find an alternative or a mitigation. If we cannot within a reasonable time, you may terminate the affected Services and we will refund the unused portion of any prepaid fees.
• We may replace a subprocessor immediately where a delay would create a security or availability risk, and will notify you as soon as possible afterwards.

7. International Transfers

Client Data is hosted in the United States. Where you are established in the EEA, the UK, or Switzerland, or the data you upload is subject to those laws, transfers out of that territory rely on the transfer mechanism made available by the relevant recipient — typically the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK is involved, and the Swiss adaptations where Switzerland is involved — supplemented by the measures in Annex B.

Where the Standard Contractual Clauses apply between us, Module Two (controller to processor) applies, you are the data exporter and we are the data importer, Annex A and Annex B of this DPA populate the corresponding annexes, the governing law and forum are those of the Member State the clauses require, and the optional docking clause applies. We will execute the clauses with you on request at hello@viewdora.com.

We are documenting the transfer mechanism for each subprocessor individually, and we will give you the current position for any of them on request.

8. U.S. State Privacy Laws

Where the CCPA or a comparable U.S. state law applies, you are the business and we are your service provider for the processing we perform on your behalf. Client Data is disclosed to us for the limited and specified business purpose of providing the Services. These certifications do not extend to the client-marketing use disclosed in Section 4, where we act as an independent controller rather than your service provider; ask us to switch that off and the certifications below apply to all Client Data without exception. As to processing we perform as your service provider, we certify that we:

• will not sell or share Client Data;
• will not retain, use, or disclose it for any purpose other than performing the Services, or as otherwise permitted by the CCPA;
• will not retain, use, or disclose it outside the direct business relationship between us;
• will not combine it with personal information received from another source, except as the CCPA permits a service provider to do;
• will comply with the obligations the CCPA places on service providers, and will provide the same level of protection it requires; and
• will notify you if we determine that we can no longer meet those obligations, and will stop processing or remediate if you tell us to.

You may take reasonable and appropriate steps to confirm that we use Client Data consistently with your obligations, using the information described in Section 10.

9. Deletion and Return

You can delete Client Data at any time through the Services. While your account is active, you can download Client Data through the Services. Before permanent deletion, you may email hello@viewdora.com and we will assist in returning available Client Data, as Section 16.3 of the Terms of Service describes. After permanent deletion, we delete Client Data from active systems within 30 days and from encrypted backups within a further 90 days as they are overwritten.

We may retain Client Data where a law requires it, or where it is subject to a legal hold, an open fraud or security investigation, or a preservation obligation — and in that case we keep it only for as long as required and continue to protect it under this DPA.

10. Audits and Information

We will make available the information reasonably necessary to demonstrate our compliance with this DPA, including this document, Annex B, the subprocessor list, and written responses to reasonable security questionnaires.

Where applicable law gives you an audit right that this information does not satisfy, you may request an audit no more than once in any 12-month period, on at least 30 days’ written notice, at your own cost, during business hours, subject to confidentiality, and conducted so as not to disrupt the Services or the privacy of other customers. A regulator with jurisdiction may audit us where the law requires.

11. Liability, Term, and Precedence

Each party’s liability under this DPA is subject to the limitations and exclusions in Section 14 of the Terms of Service, except where applicable data-protection law does not allow that.

This DPA takes effect when you accept the Terms of Service and continues while we process Client Data for you. Sections 4, 8, 9, 10, and 11 survive termination.

In the event of a conflict about the processing of Client Data, this DPA prevails over the Terms of Service and the Privacy Policy. Where the Standard Contractual Clauses apply, they prevail over this DPA to the extent of any conflict.

12. Annex A — Details of Processing

13. Annex B — Security Measures

We maintain the following measures, and may update them provided the level of protection is not reduced:

• Encryption. Stored files and database contents encrypted at rest; TLS for data in transit between users, our servers, and our providers.
• Access control. Passwordless authentication using magic links and one-time codes, with no reusable password stored; role-based permissions; least-privilege access for personnel; access reviewed on role change and revoked on departure.
• Network and infrastructure. Managed hosting on AWS, network isolation, a web application firewall in front of the API, and separation of production from other environments.
• Application security. Gallery access controlled by per-gallery permissions and invitation tokens; signed, time-limited URLs for file access; input validation and change review before deployment.
• Logging and monitoring. Application and access logging, audit entries for significant account and gallery actions, and alerting on unusual activity.
• Resilience. Encrypted backups with documented restoration procedures.
• Personnel. Confidentiality obligations, and access granted only to those who need it.
• Vendor management. Written data-protection agreements with providers that process personal data for us, and periodic review.
• Incident response. A documented process for identifying, investigating, containing, and notifying personal data breaches, aligned to Section 4.
• Deletion. Deletion within the periods stated in Section 9, propagated to processors where they hold a copy and deletion is technically possible.

Screenshot blocking and watermarking are product features that help you control how your work is viewed. They are not information-security controls and are not part of these measures.

Since October 1, 2026, session replay in Studio masks all on-screen text and images as well as form inputs. Recordings made before that date may contain Client Data shown on screen and are deleted when their 30-day retention ends.

Effective Date: October 1, 2026 · Version: 1.0 · Questions or a countersigned copy: hello@viewdora.com · Forged Concepts LLC, 4680-18 I Monticello Ave, PMB 121, Williamsburg, VA 23188, United States.