Data Processing Addendum

About this addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Carl.tonMedia, a business registered in Ghana (registration number BN543280623) (“we”, “us”) and the studio that holds an account (“you”).

It applies to the personal data we handle for you when you use Carl.tonMedia Galleries, such as the names, emails, favorites and comments of your clients, and the people who appear in your photos and films. If it conflicts with the Terms on how personal data is handled, this DPA prevails.

Key meanings

• Data protection law means Ghana’s Data Protection Act, 2012 (Act 843), and any other privacy law that applies to the data.
• Personal data, controller, processor and processing have the meanings given in that law.
• Studio data means personal data that you or your clients put into the service, or that is collected through your galleries.
• Sub-processor means another company we use that handles studio data for us.
• Incident means a breach of security that leads to studio data being lost, altered, disclosed or accessed without authority.

Who does what

For studio data, you are the controller and we are the processor. You decide why and how the data is used. We handle it only to provide the service to you.

We will handle studio data only on your documented instructions, which are these terms, your use of the service and your settings in it, unless a law requires otherwise. If a law requires us to do something different, we will tell you first when we are allowed to.

For the details of people who hold an account with us, we act as a controller. That is covered by our Privacy Policy.

Your responsibilities

• You must have a lawful basis for collecting and sharing studio data, including the consent of the people in your photos and films where it is needed.
• You must give your clients any notices the law requires about how you use their information.
• Your instructions to us must comply with data protection law.
• On request, you should be able to show that required consents were given.

Confidentiality

Anyone working for us who can reach studio data must be bound by a duty of confidentiality, and has access only as far as their work requires.

Security measures

We keep technical and organizational measures suited to the risk, including:

• Encryption of data in transit and at rest.
• Private-by-default galleries with long random link codes and optional passwords.
• Database rules that stop one account from reading another’s data.
• Passwords held only in scrambled form.
• Access to systems limited to those who need it, with the ability to remove it quickly.
• Regular backups and a process for restoring them.

If something goes wrong

If we confirm an incident affecting studio data, we will tell you without undue delay, and in any case within 72 hours of confirming it, using the email on your account.

Our notice will say, as far as we then know, what happened, what data and which people may be affected, what we are doing about it, and who to contact. We will investigate, work to contain it, and keep you updated. We will also help you meet any duty you have to inform the Data Protection Commission or the people affected.

Sub-processors

You agree that we may use sub-processors. We will have a written contract with each that requires protection of the data at least as strong as in this DPA, and we remain responsible for them. Current sub-processors:

We will tell you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us in that period and we will talk it through. If we cannot find a solution, you may close your account.

Transfers abroad

Studio data may be handled outside Ghana by our sub-processors. We will only allow this where the data is protected in line with data protection law, for example through contracts, or because the destination offers adequate protection.

Requests from people

If someone contacts us to use their rights over studio data, such as to see, correct or delete it, we will pass the request to you promptly and not respond ourselves unless you ask us to or the law requires it.

We will give you reasonable help to answer such requests, and to carry out any privacy impact assessments or consultations with the regulator that relate to the service. We may charge for help that goes beyond what is reasonable.

Proving compliance

On reasonable request, we will give you the information needed to show that we meet this DPA.

If that is not enough, you may ask for an audit, no more than once a year unless there has been an incident. We will agree the scope, timing and length with you in advance, so that it does not disrupt the service or expose other customers’ data. You bear the cost of the audit.

Return and deletion

You can download your files, and delete galleries or your whole account, at any time. When your account ends, we will delete studio data within 30 days, except where a law requires us to keep it. Backup copies expire within a further 90 days and are not used for anything else in the meantime.

If you ask in writing, we will confirm the deletion.

General

This DPA lasts for as long as we handle studio data for you. It is governed by the laws of Ghana. We may update it as the law or the service changes, and will tell you of changes that matter, as set out in the Terms.

Questions about this DPA can go to support@carltonmedia.net.