Data Processing Addendum

For the personal data of the Studio’s couples, guests, event attendees, clients, CRM contacts, contracts and invoices, the Studio is the Data Fiduciary (the “controller”) and Snabb is its Data Processor (s.2(i), s.2(k), s.8(2)). The Studio decides the events, galleries, guest access, face-search settings, reminders, CRM use and retention choices the product offers.

Snabb is a Data Fiduciary in its own right for studio staff accounts, sign-in and security records, subscription billing, support correspondence and platform operator logs. This addendum does not cover that data; the privacy notice does.

Snabb hosts, stores, transmits and displays the Studio’s photographs and related records; finds the faces in event photos so guests can find themselves; runs consent, guardian-consent and rights-request workflows; sends messages the Studio enables; and produces the invoices and contracts the Studio issues. Processing lasts for the term of the agreement and then for the return and deletion period in clause 13.

• Couples and clients: name, contact details, gallery PIN, selections, comments, feedback, per-photo decisions on the Studio’s public portfolio, contract and invoice details (including GSTIN and billing address).
• Guests and attendees: event photographs; face signatures computed from the Studio’s photos (never from selfies); matches; favourites, downloads and shares; optional name, phone and email; age answer.
• Children and their parents or guardians: a child’s matches without any stored selfie or signature; the guardian’s name, relationship and, for code verification, email.
• Technical: IP address and browser on consent, ledger and audit records.

Selfies used for face search are processed in memory for the length of the request and never stored. Face signatures are treated as sensitive, biometric-adjacent data.

Snabb processes the Studio’s personal data only on the Studio’s documented instructions: this addendum, the main agreement, and the settings and actions the Studio takes in its dashboard. Snabb will not use the data for advertising, to train or improve models, for analytics unrelated to the service, or for any purpose of its own. IfSnabb believes an instruction breaks the Act, it will tell the Studio and may pause that processing.

Snabb limits access to people who need it to run or support the service, binds them to confidentiality, and records platform operator access in an audit log. Support access to a studio’s data happens only to answer that studio’s request or to deal with a security incident.

Snabb maintains reasonable security safeguards (s.8(5); Rules r.6), including:

• photos in private storage, served only through short-lived signed links;
• tenant isolation on every record, checked automatically before release;
• role-based access with a separate permission for money records;
• encryption in transit; one-time codes and access tokens stored only as hashes;
• an append-only consent ledger that the database refuses to alter, except the scheduled reduction of IP addresses and browsers after one year;
• audit logs for sensitive actions, kept at least one year (Rules r.6);
• age and guardian checks before any face search, and replay checks on selfie capture. Snabb does not provide active liveness detection and does not claim to.

The Studio authorises Snabb to use the subprocessors below. Snabb binds each to data-protection terms no less protective than this addendum and remains responsible for them. Snabb will give the Studio [30] days’ notice of a new subprocessor, during which the Studio may object; if the objection cannot be resolved, the Studio may end the affected service.

The Studio’s data is stored in a Postgres database hosted by Neon in Singapore and may be processed in the other subprocessor locations above. The Act permits transfer outside India except to a country or territory the Central Government restricts by notification (s.16; Rules r.15). If such a restriction affects a location in use,Snabb will tell the Studio and move or stop the processing. [Counsel: confirm the current restricted list and any sector rules that apply to studios.]

The product gives the Studio the means to answer requests for access, correction, erasure, nomination, withdrawal of consent and grievances (ss.11–14): a rights inbox with due dates, a one-person data export, an erasure cascade, correction and nomination records, and a guest-facing withdrawal button. Requests that reach Snabb about the Studio’s data are passed to the Studio without delay, and Snabb does not answer them on the Studio’s behalf unless the Studio asks it to.

Snabb will tell the Studio without undue delay after it becomes aware of a breach affecting the Studio’s data, and for a high or critical incident will give an update within 24 hours. Snabb will provide what the Studio needs to notify the Data Protection Board and affected data principals (s.8(6); Rules r.7): the nature, extent, timing and location; likely consequences; mitigation; findings about the cause; remedial steps; and the notices sent. The Board’s detailed report is due within 72 hours of awareness.

The Studio, as Data Fiduciary, notifies the Board and its data principals; Snabb may do so on the Studio’s documented instruction. Snabb has no automated connection to the Board; reports are prepared as an export and submitted through the Board’s own channels by a person.

Snabb applies the retention schedule below for the Studio, which the Studio can view in its dashboard. Invoices are kept 8 years from the end of the financial year to meet tax law, with optional fields redacted on erasure. [Counsel: confirm the GST and income-tax periods for the Studio’s circumstances.]

• Guests: Emptied immediately on withdrawal or erasure; deleted with the event at its purge date
• Consent records: Kept as proof of consent; IP cut to its network and browser hashed after 1 year
• Consent ledger: Append-only; IP and browser minimised after 1 year; detached from the person on erasure
• Guardian consent: Contact deleted when the consent expires (24 h) or the child’s data is erased; name removed after the event purge
• Photo matches: Deleted immediately on withdrawal; deleted with the event
• Guest actions: Deleted on withdrawal; a child’s downloads and shares are never recorded and a child is never counted in analytics
• Face vectors: Deleted remote-first at the event purge date. A guest’s own matched faces stop resolving at once on withdrawal or erasure and are deleted at the provider by a retried job (re-queued hourly). The studio can delete an event’s whole face index and keep the photos
• Face suppressions: Pending until the provider confirms the delete, then kept so a re-index of the same photo cannot bring the face back; deleted with the event
• Event people: Face-derived clusters deleted with the event or at the face-index purge; never shown to guests; not grouped or shown while the couple has withdrawn face features. People the studio or couple named keep their name (no faces, counts or cover) until the gallery itself is deleted
• Registrations: Erased once told or at the purge date; never used for reminders to children. A guest’s erasure or export covers only sign-ups under an email proven to be theirs; the studio confirms any other
• Guest links: Revoked on withdrawal; deleted with the guest
• Messages sent: Address emptied on withdrawal; children never receive reminders
• Feedback: Guest feedback deleted on withdrawal and at purge
• Video wishes: Video deleted first, then the row, at the purge date or on request
• Couple galleries: Open for the studio’s validity period (12 months by default), which the couple can pay to extend; if not extended, the photographs, films, video wishes, download archives and face data are deleted after a grace period (90 days by default), with reminders first. The gallery record (names and dates), the names of people the studio or couple named, the album/category structure and the gallery design stay for reuse until the studio deletes the gallery
• Public portfolio: Hidden at once when the couple or a guest in the photo withdraws, a guest is erased, a child is marked without a guardian’s consent or the gallery is archived; the public copy is deleted at once on the couple’s withdrawal, otherwise at the gallery’s next re-check
• Analytics: No identifiers; no behavioural rows for children; 25 months
• CRM clients: Erased or corrected on request when no legal need remains
• Enquiries: 12 months; spam 30 days
• Proposals and contracts: Acceptance record kept for the period counsel sets (default 8 years)
• Invoices and payments: Kept 8 years from the end of the financial year (31 March); on erasure the email, phone and notes are removed
• WhatsApp contacts: Number scrubbed on erasure and the row deleted a day later; any other contact deleted 30 days after its last message; webhook receipts deleted after 30 days; message text in finished inbound jobs scrubbed after a day
• Studio staff: Snabb is the fiduciary; deactivated or deleted on request subject to audit needs
• Studio notifications: Opt-in per device; push address erased at once when the device is removed or signed out, or its person leaves the studio or resets their password, and after 90 days unseen; removed devices deleted after 30 days; delivery log 30 days; minute counters 1 day
• Audit log: No content; IP cut to its network after 1 year
• Rights requests: Pseudonymised 3 years after closure; event notes redacted after 3 years
• One-time codes: Deleted 24 hours after creation
• Replay signals: Removed after 1 hour (at the event's next search, and by the daily purge at the latest); never kept for children
• Breach incidents: Kept 6 years, then deleted whole

Snabb keeps records of its processing for the Studio and will answer the Studio’s reasonable written questions about compliance with this addendum. [Audit rights, frequency, notice period, cost and any third-party audit reports to be agreed.]

During the agreement the Studio can export and delete its data at any time. When the agreement ends, the Studio has [30] days to export; Snabb then deletes the Studio’s personal data, including backups within [35] days, except records the law requires Snabb to keep, which are held only for that purpose and then deleted.

[Liability caps and exclusions, indemnities, governing law (India), courts or arbitration seat, and how this addendum interacts with the main agreement — to be drafted by counsel.]

Snabb’s privacy contact: dhachina, dhachina46@gmail.com. As Data Fiduciary, the Studio is responsible for publishing its own grievance contact to its couples and guests (s.8(9)); the contact details in its branding settings appear on its event pages. The product does not yet hold a separate grievance officer for each studio, so guest and gallery pages show Snabb’s contact, and Snabb passes requests about the Studio’s data to the Studio (clause 9). [Counsel: confirm this arrangement.]