Data Processing Agreement (DPA)

Last updated: Dec 31, 2025

This Data Processing Agreement ("Agreement") forms part of the Terms of Service and applies to the processing of personal data carried out by BuildAGallery on behalf of its users.

1. Parties

Data Processor:

Ivan Gavrilov
Independent sole trader
Viktorine Strasse 4, 4780 Sankt Vith, Belgium
Email: [email protected]

Data Controller:

The user of the BuildAGallery platform ("User", "Controller").

2. Subject Matter

This Agreement governs the processing of personal data by the Processor on behalf of the Controller in connection with the provision of the BuildAGallery service.

3. Duration

This Agreement remains in effect for the duration of the Controller's use of the Service.

4. Nature and Purpose of Processing

The Processor processes personal data solely for the purpose of:

• storing and delivering user-uploaded galleries
• providing optional AI-based features (e.g. audio transcription, title and summary generation)
• maintaining platform security and functionality

5. Categories of Data Subjects

Personal data may relate to:

• the Controller (account holder)
• individuals appearing in uploaded content (e.g. clients, event participants)

6. Types of Personal Data

Depending on the Controller's use of the Service, processed data may include:

• names and email addresses (account data)
• photos, videos, and audio files
• AI-generated text (transcriptions, titles, summaries)
• technical data (IP addresses, logs)

7. Obligations of the Controller

The Controller:

• determines the purposes and means of processing
• confirms that they have all necessary rights, permissions, and legal bases to upload and process personal data
• is responsible for informing data subjects and handling consent where required

8. Obligations of the Processor

The Processor shall:

• process personal data only on documented instructions from the Controller
• ensure confidentiality of personal data
• implement appropriate technical and organizational security measures
• assist the Controller with GDPR obligations where reasonably possible
• not engage another processor without appropriate safeguards

9. Sub-Processors

The Controller authorizes the use of the following sub-processors:

• DigitalOcean – infrastructure and file storage (EU, Frankfurt region)
• OpenAI – audio transcription and text generation (AI features)
• Paddle – payment processing (acts as merchant of record)
• Plausible Analytics – usage analytics (self-hosted)

Sub-processors are bound by data protection obligations consistent with this Agreement.

10. International Transfers

Where sub-processors are located outside the European Economic Area, appropriate safeguards are applied in accordance with GDPR (e.g. standard contractual clauses).

11. Security Measures

The Processor implements reasonable technical and organizational measures, including:

• access controls
• encrypted data transmission where applicable
• regular system updates
• weekly backups

12. Data Subject Rights

Taking into account the nature of the processing, the Processor shall assist the Controller in responding to requests from data subjects (e.g. access, deletion), where reasonably possible.

13. Data Breach Notification

The Processor shall notify the Controller without undue delay upon becoming aware of a personal data breach affecting the Controller's data.

14. Deletion or Return of Data

Upon termination of the Service, the Controller may delete their data through the platform. Remaining data will be deleted in accordance with the Processor's retention policies, unless legally required otherwise.

15. Liability

Liability arising from this Agreement is subject to the limitations set out in the Terms of Service.

16. Governing Law

This Agreement is governed by the laws of Belgium.

17. Contact

For questions regarding this Agreement, contact:

Email: [email protected]