This agreement is part of the Terms of Service and meets Article 28 of the GDPR. It applies when you put personal data of other people into your Bookeh workspace.
1. Roles
You (the workspace owner) are the controller. [company or full name] ([legal form], SIREN [SIREN], [address]) is the processor.
2. Subject, nature and purpose
Providing the Bookeh service: storing and organising your clients and orders, showing galleries to people you send a link to, sending emails you send, syncing your calendar. Operations: collection through the service’s forms, recording, organisation, storage, retrieval, use, disclosure at your command, restriction and erasure.
3. Data and data subjects
Your clients, contractors and gallery visitors: names, phone numbers, email addresses, social profile links, source of enquiry, order and payment details, notes, photos and videos from shoots, gallery selections and comments.
4. Duration
While your workspace exists. You may delete individual records at any time.
5. Our obligations
- Process the data only on your documented instructions — your settings and actions in the service — unless EU or Member State law requires otherwise, in which case we inform you first where allowed.
- Ensure that everyone with access is bound by confidentiality.
- Apply the security measures of Article 32: workspace isolation in the database, encryption in transit, hashed passwords, role-based access, logging of administrator actions, rate limiting. See Security.
- Notify you without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need for Articles 33 and 34.
- Help you respond to data subject requests and, where relevant, with impact assessments.
- Make available the information needed to demonstrate compliance and allow reasonable audits, on written request and with reasonable notice.
6. Sub-processors
You give general authorisation for the sub-processors below. We inform you by email at least 30 days before adding or replacing one; you may object, and if we cannot accommodate the objection, you may close your account and receive a pro-rata refund. Each sub-processor is bound by the same data protection obligations.
| Sub-processor | Purpose | Location |
|---|---|---|
| OVH SAS | Hosting of databases and files | France |
| [email service] | Delivery of service emails | EU |
7. Transfers
Your workspace data stays in the EU. Emails to your clients go through the mailbox you connected and are governed by your contract with your email provider.
8. End of processing
When you delete your workspace, the data is erased from live systems immediately and from backups when their retention period ends. Before that you can export your data from the service.
9. Your obligations
You ensure you have a lawful basis to process your clients’ data, inform them as required by Articles 13–14, and control who has access to your workspace and gallery links.