Data Processing Addendum (DPA)

This DPA supplements the PhotoSelect Terms of Service and applies when a customer uses PhotoSelect to process personal data related to event albums, guests, and recipients.

For customer-managed event and guest data, customer is the primary fiduciary/controller and PhotoSelect acts as processor under customer instructions.

For account administration, billing, fraud prevention, and platform security, PhotoSelect may act as an independent fiduciary/controller as required by law.

PhotoSelect processes personal data only to provide contracted services, maintain security and reliability, and comply with applicable legal obligations.

PhotoSelect maintains technical and organizational measures including access controls, short-lived signed URLs for protected delivery paths, encryption in transit, rate limiting, and audit-oriented logging.

Customer authorizes PhotoSelect to engage subprocessors required for service delivery. Current subprocessors are listed at /subprocessors.

PhotoSelect provides reasonable assistance for verified data subject rights requests, incident handling, and compliance inquiries related to customer data processed in the service.

Upon account closure or valid customer instruction, PhotoSelect will delete or return customer personal data where feasible, subject to legal retention and security obligations.

For DPA and privacy operations: privacy@photoselect.space and legal@photoselect.space.