Data Processing Agreement

• You (the Photographer) are the Data Controller for the personal data of your End Clients (individuals depicted in the photographs you upload), determining the purposes and means of processing that data.
• Atlas is the Data Processor, processing that data solely on your documented instructions, as necessary to provide the Service (storage, organization, duplicate detection, gallery delivery, print lab integration).

This DPA applies for as long as Atlas processes personal data on your behalf under the Terms of Service — i.e., for the duration of your subscription plus the 30-day post-cancellation retention period described in our Privacy Policy.

Atlas processes personal data to: ingest photographs from connected cameras via FTP; store and organize images and galleries; run duplicate detection; deliver files to connected print lab equipment; and provide gallery access to End Clients where you enable that feature.

• Your End Clients (individuals depicted in event/session photography — e.g., wedding guests, baptism attendees, corporate event participants)
• Where applicable, minors depicted in family/event photography

• Photographic images
• Embedded EXIF metadata (timestamps, camera model, and GPS coordinates if enabled on the capture device)
• Names or tags you or your End Clients add to galleries or images
• Any additional personal data you choose to associate with a gallery or image (e.g., notes)

Atlas agrees to:

1. Process personal data only on your documented instructions, as set out in the Terms of Service and this DPA, unless required otherwise by law (in which case we will inform you, unless prohibited from doing so).
2. Ensure personnel authorized to process the data are bound by confidentiality obligations.
3. Implement appropriate technical and organizational security measures, including encryption in transit, access controls, and infrastructure hardening.
4. Not engage a new subprocessor without giving you reasonable notice, allowing you to object on reasonable grounds (see Section 7).
5. Assist you, insofar as reasonably possible, in responding to data subject requests (access, deletion, portability, etc.) concerning data you control.
6. Notify you without undue delay after becoming aware of a personal data breach affecting your End Clients' data, providing available details to help you meet your own notification obligations.
7. At the end of the Service relationship, delete personal data in accordance with the retention periods described in our Privacy Policy (30 days post-cancellation), unless applicable law requires longer retention.
8. Make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits, subject to reasonable notice, confidentiality, and no more than once per 12-month period absent a security incident.

You authorize Atlas to engage the following subprocessors, which may change from time to time (see our Privacy Policy for the current list):

We will notify you of any new subprocessor that will process End Client personal data before it goes live, giving you a reasonable window to object. If we introduce AI-based features using third-party AI providers to process End Client images, those providers will be added here and disclosed before the feature is enabled on your account.

Where a subprocessor is located outside your jurisdiction (e.g., outside the EEA), Atlas relies on appropriate safeguards, such as the EU Standard Contractual Clauses (SCCs) or equivalent mechanisms, to ensure an adequate level of protection for transferred personal data.

Liability under this DPA is subject to the limitation of liability provisions in our Terms of Service.

For DPA-related requests (including audit requests or subprocessor objections): legal@atlas.saramandic.com