Data processing agreement (DPA)

This data processing agreement (DPA) specifies the data protection obligations of the parties in connection with the use of Bildplattform pursuant to Article 28 GDPR.

The controller is the customer. The processor is StartklarWeb, owner Hasan Mohsen, Brucknerstraße 12, 46325 Borken (Münsterland), Germany (the processor).

The DPA applies to all personal data that the processor processes on the customer's behalf in the course of providing Bildplattform, in particular the photos uploaded by the customer.

The subject matter of the processing is the provision of a hosted tool for AI-assisted image editing, in particular for real estate photos.

Nature and purpose of the processing: storage, provision, processing and transmission of the photos uploaded by the customer so that the customer can edit them via the AI provider they have chosen and instructed themselves.

The duration of the processing corresponds to the term of the usage relationship. After termination, the rules on deletion and return apply (clause 9).

In the context of the uploaded photos, the following types of personal data may be processed:

The data subjects are in particular the persons depicted in, or identifiable from, the photos uploaded by the customer (for example residents, passers-by, employees or other third parties).

The customer is responsible for the lawfulness of the processing and for safeguarding the rights of the data subjects. In particular, the customer ensures that they are entitled to transmit the data to the processor and to process the persons depicted.

The customer generally issues instructions through the functions of the application. Supplementary instructions are issued in text form to kontakt@bildplattform.de.

The processor processes the personal data exclusively within the scope of the customer's instructions and this agreement, unless required to process otherwise by law. In that case, the processor informs the customer of these legal requirements before processing, unless the law prohibits this on important grounds of public interest.

The processor informs the customer without undue delay if it considers that an instruction infringes data protection provisions.

The persons involved in the processing are bound to confidentiality.

The processor supports the customer, as far as possible, in fulfilling requests from data subjects (Articles 15 to 22 GDPR) and the obligations under Articles 32 to 36 GDPR.

The processor takes the measures required under Article 32 GDPR. These include in particular:

The customer consents to the use of the following subprocessors. The processor ensures through contractual arrangements that they maintain an adequate level of data protection.

The processor informs the customer of intended changes concerning the addition or replacement of subprocessors. The customer may object to a change for important data protection reasons.

The processor notifies the customer of any personal data breaches affecting the data processed on the customer's behalf without undue delay after becoming aware of them.

The notification contains the available information the customer needs to comply with its notification obligations under Articles 33 and 34 GDPR. The processor supports the customer appropriately in this.

After the end of the processing, at the latest on termination of the usage relationship, the processor deletes the personal data processed on the customer's behalf or, at the customer's choice, returns it, unless a statutory retention obligation applies.

The customer remains jointly responsible for securing their own copies of their original images and results in good time.

The processor makes available to the customer all information necessary to demonstrate compliance with the obligations under Article 28 GDPR.

The customer is entitled to satisfy itself of compliance with the technical and organisational measures, in particular by requesting information or by carrying out inspections. Inspections take place after reasonable notice, during normal business hours and without avoidable disruption to operations.

In relation to the terms and conditions (at /en/legal/terms) and the privacy policy (at /en/legal/privacy), the provisions of this DPA take precedence with regard to the processing on the customer's behalf.

Should individual provisions of this DPA be invalid, the validity of the remaining provisions remains unaffected. The law of the Federal Republic of Germany applies.