This addendum sets out how SJC Designs Online Ltd processes gallery personal data for Business account customers of PhotoUpload. It forms part of the Service contract where incorporated through the Terms of Service or separately agreed in writing.
1 Parties scope and incorporation
1.1 Parties. “Customer” means the business or sole trader identified in the Business account or order. “PhotoUpload”, “we” and “us” mean SJC Designs Online Ltd, company number 10809959, 102 Andover Road, Ludgershall, Andover, Wiltshire, SP11 9NA, United Kingdom. The Terms of Service, the order and this addendum form the Agreement.
1.2 Scope and roles. This addendum covers personal data we process on the Customer’s behalf for the services in Schedule 1 (“Customer Data”). The Customer is the controller and we are the processor. Where the Customer is itself a processor, it confirms its controller has authorised it to appoint us as a sub-processor and will pass on that controller’s instructions.
1.3 Definitions. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and any other data-protection law that applies, including the EU GDPR where relevant. Other data-protection terms have their legal meanings.
1.4 Acceptance and priority. This addendum applies when the Customer accepts the Terms that supply it, or when separately agreed in writing; no signature is needed. It lasts while we hold Customer Data as processor and takes priority over the Terms for conflicts about that processing. It is not in itself an international-transfer safeguard.
1.5 Our own processing. We act independently as controller for our own account, payment, fraud-prevention, security, error, content-report, moderation and legal-compliance records, as our Privacy Policy describes, using only the information needed and with a lawful basis. This does not permit any other use of Customer Data.
2 Instructions and customer responsibilities
2.1 Documented instructions. We will process Customer Data only on the Customer’s documented instructions, including for international transfers, unless the law requires otherwise, in which case we will tell the Customer first where allowed. Instructions are this Agreement, the Customer’s settings and actions in Studio and its galleries, and further written instructions we agree. They include keeping the Customer’s unpublished uploads hidden until published, applying PINs and access settings, sending client emails to the recipients the Customer enters and backing up to the cloud account it connects.
2.2 Unlawful instructions and other uses. We will tell the Customer promptly if we think an instruction breaks Data Protection Law, and may pause the affected processing until it is resolved. We will not use Customer Data for our own advertising or for AI-model training.
2.3 Customer responsibilities. The Customer decides its purposes, who gets access, gallery dates and what is shared. It must give the required privacy information, have a lawful basis (and any extra conditions for sensitive data), make sure its instructions and uploads are lawful, keep its sign-in details secure, manage its team, and tell us about relevant rights requests or security concerns. It is responsible for checking email recipients and for what it exposes through likes, insights, the live screen, exports and backups. These duties do not reduce our own obligations.
3 Confidentiality and security
3.1 Confidentiality and Article 32. We will limit access to Customer Data to people who need it for authorised processing and who are bound by confidentiality, and maintain technical and organisational measures appropriate to the risks, as Article 32 requires. Schedule 2 records these measures, which we will review as risks change.
3.2 Standard of measures. Our measures must address confidentiality, integrity, availability, resilience, restoring access after an incident and regular testing, and any change must keep protection appropriate. This addendum is not a security certification or a guarantee of uninterrupted service.
4 Assistance and personal data breaches
4.1 Assistance. Taking account of the processing and information available to us, we will help the Customer respond to data-subject requests, keep data secure, assess and report breaches, carry out data-protection impact assessments and consult the regulator where required. We will promptly pass on requests about Customer Data and follow the Customer’s lawful instructions, unless the law requires us to respond ourselves.
4.2 Breach notification. We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, without waiting for a full investigation. We will give the available details of what happened, the data and people affected, likely consequences, action taken and a contact point, adding information in stages where needed, and will investigate, contain and fix the incident in cooperation with the Customer.
4.3 Notifications and contacts. The Customer controls notifications to regulators and individuals, except where the law requires us to notify independently. We will use the account owner’s contact details and any agreed incident contact, which the Customer must keep up to date. Send processing enquiries to privacy@photoupload.app.
4.4 Complaints. We will promptly pass on complaints about Customer Data and provide what the Customer reasonably needs to acknowledge them within 30 days, investigate, keep the individual informed and give the outcome without undue delay. We handle complaints about our own processing ourselves, and individuals keep the right to complain to the ICO or another competent regulator.
5 Sub-processors
5.1 Authorisation and notice. The Customer gives general written authorisation for the sub-processors in Schedule 3. Before adding or replacing one, we will tell the account owner in writing who it is, what it will do, where and with what safeguards, and give a reasonable opportunity to object before the change takes effect.
5.2 Objections. We will consider a reasoned objection and look for a reasonable solution, such as another provider or stopping the affected processing. If none is possible, the Customer may end the affected service before the change, with a refund of any unused prepaid fees for it.
5.3 Our responsibility. We will check each sub-processor’s safeguards, bind it to equivalent data-protection obligations in a written contract and remain responsible to the Customer for its performance. General authorisation does not by itself permit a restricted international transfer.
6 International transfers
6.1 Transfer safeguards. We will make a restricted transfer of Customer Data only on authorised instructions and with a lawful mechanism, such as adequacy regulations or approved contractual clauses with the UK Addendum, plus the required transfer assessment and any supplementary measures. Remote access from abroad counts as well as storage location.
6.2 Information. Schedule 3 lists our providers. On request we will provide information about the safeguards relevant to Customer Data, protecting confidential information where necessary. EU rules apply separately where relevant; a UK mechanism does not automatically cover an EU transfer.
7 Evidence audits and inspections
7.1 Information and audits. We will provide the information reasonably needed to show we meet our processor obligations, and allow and contribute to audits and inspections by the Customer or an independent auditor it appoints, on reasonable terms for scope, timing, confidentiality and security that protect other customers without preventing an effective audit.
7.2 Limits. Existing reports do not replace an audit where further checking is reasonably needed, and notice arrangements must not delay urgent investigations or regulators. Charges for exceptional assistance must be agreed in advance and must not obstruct cooperation the law requires.
8 Duration return deletion and payment restrictions
8.1 Return or deletion. Processing continues for the Service and any Recently deleted period until return or deletion is complete. At the end of processing the Customer may choose return or deletion, and we will then delete remaining copies unless the law requires us to keep them, explaining why where allowed. A verified earlier deletion instruction takes priority over the normal timetable.
8.2 Closing and Recently deleted. Suspension for non-payment blocks access without deleting anything. When a subscription ends, its galleries move to Recently deleted for 30 days. During that period we process Customer Data only to keep, return, restore, secure or delete it.
8.3 Payment restrictions. The Terms require overdue amounts to be paid and a new subscription started before galleries are restored. These conditions do not apply to our processor assistance or the Customer’s choice of return or deletion. If normal downloads are blocked, the Customer may send a verified return or deletion instruction to privacy@photoupload.app. Debts remain a separate matter. Return is possible only while the data still exists.
8.4 Backups. Disaster-recovery backups of the live service’s database are restricted to authorised recovery use and expire automatically: daily copies after 6 days and weekly copies after one month. Residual copies after a deletion are kept out of ordinary use and expire within that cycle unless the law requires otherwise. We will reapply recorded deletions after any restore and confirm completed deletions on reasonable request. Backups give the Customer no extra restore right.
8.5 Preservation. Retention the law requires is limited to the affected data and necessary period, with restricted access and no gallery availability. Moderation or security evidence we keep as controller is covered by our Privacy Policy and does not allow indefinite retention of the Customer’s galleries. We will explain why deletion is withheld where the law allows.
9 Liability and changes
9.1 Liability. The business liability terms in the Terms apply between the parties only as far as the law allows. They do not reduce either party’s direct legal duties, individuals’ rights to compensation or regulators’ powers.
9.2 Changes and law. Material changes must follow the change process in the Terms and must not reduce mandatory protection. Governing law and disputes follow the Terms, subject to Data Protection Law.
Schedule 1 Processing details
Subject matter and purpose: running the Customer’s Guest Upload Galleries and Client Galleries (delivery and proofing) through Studio, including guest uploads, sharing, proofing, downloads, the live screen, slideshows, client emails, insights, cloud backup and exports.
Operations: receiving and scanning uploads, removing location and device details, storage, making previews, download copies and watermarked proofs, display in galleries and on paired screens, picks, likes and insights, client emails, backup and exports, Recently deleted, restoring and deletion.
Data: photos, videos and audio; filenames and embedded metadata, including capture dates and, until removed, location and device details; names and contact details of uploaders, clients and email recipients; captions, categories, picks, notes, likes, publication status, which uploads came from the Customer or its team, access settings and activity records. Images may incidentally reveal special-category information; ordinary images are not automatically biometric data.
People: the Customer’s clients, event hosts, guests, uploaders, email recipients, team members and people pictured, including children where the Customer lawfully includes them. The Customer must tell us before instructing processing that needs extra safeguards.
Duration: the subscription and the gallery dates the Customer sets, then Recently deleted, return and deletion under section 8; storage is continuous while files are kept.
Schedule 2 Security and deletion measures
Access and authority
Studio sign-in uses a password or Google sign-in, with optional two-step sign-in that the owner can require for team members. Billing, business settings, cloud backup, the team and deleting or restoring galleries are owner-only. Galleries use private links and optional PINs; live screens use private controller links the Customer can turn off and replace. Our administrative access is limited to authorised staff bound by confidentiality.
Network and credentials
The Service uses HTTPS. Session cookies are HttpOnly, SameSite and Secure on HTTPS. Private media is served only after access checks. Uploads are released only after malware scanning and metadata removal, and files that fail may be rejected or removed. Recorded IP addresses and cloud connection tokens are encrypted by the application; this does not mean every field or file is encrypted at rest. Access to secrets is restricted.
Activity, evidence and retention
The application records upload and download requests, content reports and moderation actions. Evidence packages are password-encrypted ZIP files with a SHA-256 inventory and expire 24 hours after they are generated. IP addresses and network details in upload, download and report records are removed after 90 days unless an active preservation hold covers the account; holds are reviewed and released when no longer justified. These records are our controller processing under clause 1.5.
Gallery deletion and return
Galleries close, stay closed for the period the Customer chooses (up to 60 days), then spend 30 days in Recently deleted before permanent deletion. The first time a visitor uses Message the host while a gallery is in Recently deleted, it is kept for 30 more days; this happens once. Deleting a single file, or the Customer deleting unpicked proofing photos, is permanent straight away. Closing is not deletion. Deletion covers originals, copies, proofs and unpublished uploads. Return or deletion instructions can be sent to privacy@photoupload.app whether or not the subscription is paid up.
Availability, incidents and evaluation
We maintain proportionate measures for availability, resilience and timely recovery after an incident, log errors for investigation, and regularly evaluate our security and recovery procedures. Backups follow clause 8.4 and do not allow restoring a gallery after permanent deletion.
Schedule 3 Sub-processors and other recipients
The Customer authorises sub-processors in the categories below, subject to sections 5 and 6. Each processes only the Customer Data needed for its function under binding data-protection terms. The current list of named sub-processors, with their locations and safeguards, is available to Customers on request from privacy@photoupload.app, and section 5.1 applies before we add or replace one.
Hosting and storage
Runs the application, databases, sessions, gallery files and copies, malware scanning and operational records. Our services are configured to run in the European Economic Area; the provider may give support from outside it, including the United States.
Network and security
Routes traffic for our domains and the Customer’s custom domain and protects the Service, processing connection information and the requests and Content passing through its network.
Delivers service emails, including client emails and reminders sent in the Customer’s name, and processes their content, recipients and delivery records. Our email-hosting provider holds support correspondence, which may include Customer Data the Customer sends us.
Other recipients
Our payment provider processes payments, subscriptions and invoices under its own terms and does not receive gallery Content. Cloud backup sends files to the Google Drive or OneDrive account the Customer connects, and guests or clients who save files send them to their own Google Drive or OneDrive. Those destinations’ terms apply to the copies, and disconnecting or deleting a gallery does not recall them.