Data Processing Agreement

Last updated August 9, 2026

When a host uses Easy Pics to collect guest photos and videos, the host acts as the data controller for that guest data, and Easy Pics acts as processor. This DPA describes those obligations and forms part of our Terms of Service.

Scope

This DPA applies to personal data processed by Easy Pics on a host's behalf in connection with an event: guest display names and any photos or videos guests upload ("Guest Data"). It doesn't cover the host's own account data, which Easy Pics processes as controller under the Privacy Policy.

Processor obligations

  • Process Guest Data only to provide the service (accepting, storing, and displaying uploads to the host) and on the host's documented instructions.
  • Keep Guest Data confidential and limit access to personnel who need it to operate the service.
  • Apply appropriate technical and organizational measures, including encryption in transit and access controls on stored media.
  • Assist the host in responding to a data subject request from a guest (access, correction, or deletion) by enabling deletion of individual uploads from the dashboard and by forwarding requests sent to hello@easy.pics.
  • Notify the host without undue delay if we become aware of a breach affecting Guest Data.
  • Delete Guest Data at the end of the event's plan viewing window, or earlier at the host's request, and delete or return remaining Guest Data on termination of the host's account.

Sub-processors

Easy Pics uses the following sub-processors to store and secure Guest Data. We'll update this list if it changes and take reasonable steps to ensure sub-processors meet equivalent data protection obligations.

  • Cloudflare — object storage for uploaded photos and videos.

Host obligations

As controller, the host is responsible for having a lawful basis to collect Guest Data (for example, inviting guests to an event they're attending), for any notices given to guests, and for instructions given to Easy Pics regarding that data.

International processing

Guest Data may be processed and stored using infrastructure operated by our sub-processors. We rely on our sub-processors' own safeguards for any transfer of data across borders.

Liability

Liability under this DPA is subject to the limitation of liability in our Terms of Service.

Contact

Questions about this DPA, or to request a signed copy for your organization's records: hello@easy.pics.