Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between your studio ("you", the controller) and Island Films X Photos LTD (trading as Island Films) ("we", the processor). It applies whenever we process personal data on your behalf through FrameFlow, as required by Article 28 of the GDPR. If this DPA and the Terms conflict on data protection, this DPA wins.

1. What we process

• Subject matter and purpose: hosting and operating FrameFlow so you can manage enquiries, bookings, contracts, invoices, questionnaires, files and communication with your clients.
• Data subjects: your clients and couples, their guests or contacts you record, your vendors and suppliers, and your team members.
• Types of data: names, contact details, wedding and event details, contract and signature records (including IP address), invoice and payment status, messages, notes and files you upload.
• Duration: for as long as your workspace exists, plus the deletion periods in section 8.

FrameFlow isn't designed for special-category data (health, religion and the like). Please don't store it beyond what a wedding genuinely needs, such as a dietary note.

2. Your instructions

We process this data only on your documented instructions, which are the Terms, this DPA and how you use FrameFlow's features. If we're ever legally required to do otherwise we'll tell you first, unless the law forbids it. If we believe an instruction breaks data protection law, we'll tell you.

3. Your responsibilities

You're responsible for having a lawful basis to collect your clients' data and to email them through FrameFlow, and for giving them your own privacy notice. You decide what goes into your workspace.

4. Confidentiality and security

Everyone at FrameFlow with access to your data is bound by confidentiality. We maintain appropriate technical and organisational measures, including encryption in transit and at rest, application-level encryption of integration tokens, database-level isolation between workspaces, least-privilege access, audit logging of administrative access, and regular backups.

5. Subprocessors

You give us general authorisation to use the subprocessors listed in our Privacy Policy. We impose data protection terms on each that are at least as protective as this DPA and remain responsible for them. We'll email you at least 14 days before adding or replacing a subprocessor; if you object on reasonable data protection grounds and we can't address it, you may cancel and receive a pro-rata refund of any prepaid fees.

6. International transfers

Your workspace database is hosted in the EU. Where a subprocessor processes data outside the EEA, we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. Helping you

• Data subject requests: FrameFlow lets you find, correct, export and delete client records yourself. If a couple contacts us directly we'll pass the request to you rather than answer it ourselves.
• Breaches: we'll notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
• Assessments: we'll give reasonable help with data protection impact assessments and consultations with a supervisory authority.

8. Deletion and return

You can export your workspace at any time from Settings. Deleting it yourself from Settings removes your data immediately. When we close a workspace at your request, we delete your data within 60 days, and it rolls out of backups within 90 days, unless the law requires us to keep it.

9. Audits

We'll make available the information reasonably needed to show we comply with this DPA, and answer your written questions about our security. Where that isn't enough, you may audit us (or appoint an independent auditor) once a year, on 30 days' notice, at your own cost, and subject to confidentiality.

10. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where the GDPR doesn't allow that.

Contact

Need a countersigned copy for your records, or have a question? Email hello@stratex.studio.