Data processing agreement

Parties and capacity

Controller

The professional user or entity identified in the account and profile, which determines the purposes and essential means of authorizations and represents that it has authority to accept this agreement.

Processor

José Irún Sánchez, Spanish tax ID 37292698S, C/ Gavà 21–23, 4th floor, door 2, 08014 Barcelona, Spain; info@imageconsent.eu, owner of ImageConsent.

Subject matter

Technical processing of data entered by the controller to create, sign, retain, deliver, export, verify, withdraw and erase image and voice authorization records.

Separate roles

This agreement does not cover processing for which ImageConsent determines its own purposes—account, security, purchase, support and legal duties—where it acts as controller under the Privacy Policy.

1. Scope, duration and precedence

Processing begins on acceptance and continues while the controller has an account or data remains pending return, deletion or restriction. Nature, purpose, data and individuals are detailed in Annex I.

This agreement prevails over conflicting commercial instructions on data protection. The GDPR, Terms, this agreement and instructions recorded in the product form the contractual set. Nothing authorizes ImageConsent to determine a new purpose for controller data.

2. Documented instructions

The processor processes data only on documented instructions: selected configuration, authenticated actions, valid support requests and this agreement. This includes third-country transfers only where documented and compliant with GDPR Chapter V.

If Union or Member State law requires other processing, the processor will inform the controller beforehand unless prohibited for important public-interest reasons. If an instruction appears to infringe the GDPR or other law, the processor will immediately inform the controller and may pause only the affected operation pending clarification.

3. Confidentiality

Access is restricted to people who need it to operate, secure or support the service and who are subject to contractual or statutory confidentiality. The duty survives their involvement. Least privilege and access review apply when roles change.

4. Security of processing

The processor will implement and maintain technical and organizational measures appropriate to risk under GDPR Article 32, including Annex II. It will assess confidentiality, integrity, availability, resilience, restoration and regular testing without presenting measures as an absolute guarantee.

The controller must protect credentials and devices, restrict workspace members, configure each file correctly and avoid unnecessary data. Processor measures do not replace controller duties.

5. Subprocessors

The controller grants general authorization for the categories and services in Annex III. The processor will keep an updated list and give reasonable advance notice of material additions or replacements, targeting 15 days where practicable.

The controller may object within the stated period on reasonable data-protection grounds. The parties will seek a reasonable alternative; if none is available, either may end the affected function without additional penalty, without prejudice to accrued rights.

Before access, the processor will bind a subprocessor in writing to equivalent obligations, verify the relevant transfer mechanism and remain fully liable to the controller for subprocessor performance. Naming a brand in the annex does not represent that documentary verification is already complete.

6. International transfers

No restricted transfer will occur without a valid GDPR Chapter V mechanism. In the absence of adequacy, the applicable clauses in Decision (EU) 2021/914 or another valid instrument will be used, with country assessment and supplementary measures where required.

A selected commercial region alone does not prove absence of transfers. The provider register must identify contracting entity, importer, access countries, modules, measures and review date. Missing evidence will not be described publicly as covered or as entirely EU-based processing.

7. Individual rights

Taking account of processing nature, the processor assists through search, export, rectification, withdrawal and deletion features and reasonable support for GDPR Articles 12–22 requests.

A request received directly concerning controller data will be forwarded without undue delay, and the processor will not answer for the controller unless instructed or legally required. Proportionate identity verification may be used to prevent improper disclosure.

8. Compliance assistance

The processor provides reasonably available information for GDPR Articles 32–36: security, breach notification, communications, DPIAs and prior consultation. Assistance reflects processing nature and information available to ImageConsent.

Assistance does not transfer the controller’s decisions on legal basis, risk, notification, consultation or image use. Exceptional work may be agreed separately where it exceeds ordinary support, without limiting legally required assistance.

9. Personal-data breaches

The processor notifies the controller without undue delay after becoming aware of a breach affecting controller data; its internal target is an initial alert within 24 hours after confirmation, without turning that target into a guarantee while facts remain under investigation.

As available, notice includes nature, systems/data, approximate categories and numbers, contact, likely consequences, measures, timeline and gaps. Information may be supplied in phases and an incident record will be kept.

The controller decides and makes any required authority notification within 72 hours and high-risk communication to individuals unless a specific lawful task has been expressly assigned to ImageConsent.

10. Return and deletion

During service, the controller can export data and delete authorizations. On termination it may choose reasonably available return and deletion; absent another instruction before account deletion, the deletion action is treated as an instruction to erase active copies controlled by ImageConsent.

Data required by law remains restricted and separated. Recovery copies are erased on rotation under each provider’s verified contractual period. The processor will confirm the reasonably available outcome on request without claiming instantaneous physical deletion from media it does not control.

11. Information, audits and inspections

The processor makes available information necessary to demonstrate Article 28 and permits reasonable audits by the controller or an independent auditor under confidentiality. They normally begin with documents, questionnaire and remote meeting, with 30 days’ notice and once per year.

Those limits do not apply after a material breach, on substantiated non-compliance concerns or at an authority’s request. Audits avoid other-customer data, security compromise and disproportionate interruption. Each party bears ordinary costs; processor material non-compliance will be remedied by the processor.

12. Controller duties

The controller warrants lawful instructions, appropriate notices and legal basis, and assessment of necessity, proportionality, minors, time limits and recipients. It maintains its record, handles rights and retains only what is needed.

It will not instruct upload of material the platform is not designed to process—such as identity-document photos or unnecessary special-category data—and will promptly report errors, unauthorized access, withdrawals and member changes.

13. Liability and termination for breach

Each party is liable under GDPR Article 82 and other mandatory rules for harm attributable to its decisions or duties. No clause limits individual rights or supervisory powers.

An unremedied material breach after reasonable notice permits suspension of the affected processing or termination. Where security urgency requires earlier action, notice follows as soon as safely and lawfully possible.

14. Contacts and changes

Privacy notices, exceptional instructions and breach communications go to info@imageconsent.eu and the controller’s verified email, which the controller must keep current.

A material amendment changes the version and requires renewed acceptance. A subprocessor-list update follows Clause 5 and is not represented as a signed contract until evidence is retained.

Annex I · Processing description

Individuals

Photographed or recorded adults; minors; parents, guardians or representatives; project contacts; and authorized professional-workspace users.

Personal data

Name, contact, ID type/number if supplied, representation, session/project, purposes, territorial/time scope, signature, method, language, version, dates, events, withdrawal, delivery status and integrity fingerprint.

Special categories

Not intended. The platform does not request health, biometric unique identification, political/religious beliefs, membership, sex-life or ethnic-origin data. A drawn signature is not used as a biometric template.

Operations

Collection, format validation, encryption/protection, organization, consultation, signing/email transmission, continuity copy, document generation, export, update, withdrawal, restriction and deletion.

Purpose

Provide authorization documentation and audit-trail tooling according to controller configuration and actions.

Frequency

Continuous while the account is used and on demand for each operation.

Duration

While the account or record exists and for the limited technical return, deletion, restriction or backup-rotation period described here.

Location

Infrastructure and providers in Annex III. Exact location and third-country access must appear in the provider register; exclusive EEA residency is not presumed.

Annex II · Technical and organizational measures

Measures apply according to actual risk and configuration. Their inclusion requires maintenance or replacement with equivalent or stronger controls; it is not a certification.

• Governance: data/provider inventory, change control, access review, processing record, risk analysis, incident plan and verification of public claims.
• Access: authentication, limited sessions, one-time codes, account/workspace segregation, server authorization, least privilege and revocation.
• Cryptography: HTTPS; application encryption for identity fields, profiles and signatures; secrets outside code; HMAC; integrity fingerprints.
• Minimization: no ID-document images; optional fields; partly masked numbers; minimum email content; no session photographs in the record by default.
• Application security: input validation, size/attempt limits, origin protection, restrictive headers, temporary links, expiry, atomic states and event history.
• Telemetry: action, outcome, date, reference, limited user agent and IP-derived fingerprint; 180-day retention; detachment on deletion; no advertising.
• Continuity: independent encrypted copy, retries, integrity checks, restoration procedure and documented tests; no recovery target claimed as guaranteed without a drill.
• Incidents: reporting channel, classification, containment, evidence, risk assessment, notification, communication and post-incident review.
• People/support: confidentiality, need-to-know access, verification before disclosure and no training, marketing or incompatible reuse of controller data.
• End of service: export, authenticated deletion, active-copy removal, legal restriction and tracking provider backup cycles.

Annex III · Subprocessors and external services

The table separates technical use from contractual evidence. Acceptance authorizes the categories but does not turn a pending status into an existing DPA, SCC or certification. Evidence must be closed before the production gate is passed.

Apple and Google process distribution, payment and store relationships under their terms and normally as independent controllers; they will only be listed as subprocessors if analysis of a specific function establishes processing on ImageConsent’s behalf. Authorities and recipients chosen by the professional are not subprocessors merely for that reason.

Annex IV · Initial operating instructions

• Create and retain only files initiated and configured by the controller.
• Enable in-person or remote signing; email codes are not represented as full identity proof.
• Generate requested views, exports, PDFs and emails; do not publish images or decide exploitation recipients.
• Record changes, delivery, withdrawal and deletion needed for the audit trail.
• Apply authenticated export and deletion requests and assist with rights and incidents.
• Do not sell, profile, advertise, train models on or reuse authorization data for incompatible purposes.

Official sources

• GDPR Articles 28, 29 and 32–36
• Decision (EU) 2021/915: controller-processor clauses
• Decision (EU) 2021/914: transfer clauses
• EDPB Guidelines 07/2020 on controller and processor