FotoDrop Event Data Processing Addendum

Sites: fotodrop.eu and fotodrop.online
Prepared: 16 October 2026
Version: english-launch-2026-10-16-v7-withdrawal-review-source-prepared

This Addendum forms part of the FotoDrop Terms accepted for the site on which an album or event workspace is created. It governs hosted personal data processed on a host's behalf. It does not combine the two sites' accounts or storage, cover school products, or change the payment provider's independent responsibilities.

1. Parties, scope and roles

FotoDrop: Martin Žídek, IČO 73767018, Počernická 514/54, 108 00 Praha 10 – Malešice, Czech Republic, registered in the Czech Trade Register, registration authority Prague 10 Municipal District.

Host: the person or organisation identified in the album-creation or order record, acting through the authorised host contact. The relevant album/workspace and the accepted order identify the processing relationship without requiring a separate handwritten signature.

Where the Host is a controller, FotoDrop acts as processor. Where the Host is an authorised processor for another controller, FotoDrop acts as subprocessor and the Host must have authority for the instructions and appointments it makes. A private individual's household exemption, where applicable, does not exempt FotoDrop from its own duties; the instruction, confidentiality and limited-use provisions continue to govern the service.

FotoDrop separately acts as controller for its own account administration, transaction evidence, security, legal compliance, support and optional marketing/measurement purposes described in the applicable Privacy Notice. This Addendum does not turn those independent purposes into processing on the Host's instructions or authorise new purposes for album content.

For processing issues use [email protected] for an EU-site album or [email protected] for a global-site album. Product support uses the corresponding support@ address. These are also the Host's channels for instructions, objections and requests under this Addendum.

2. Processing description

The Host's accepted order, the Terms, this Addendum, supported configuration choices and authenticated service actions are documented instructions. Uploads by guests through an upload route opened by the Host are handled within those instructions. A payer who is not the Host does not acquire the right to instruct disclosure or deletion of all album content.

3. Instructions and purpose limitation

FotoDrop processes hosted personal data only on the Host's documented instructions, including instructions about transfers, unless EU or Member State law requires otherwise. Where legally permitted, FotoDrop informs the Host of that legal requirement before the processing. FotoDrop promptly tells the Host if it considers an instruction to infringe applicable data-protection law and may pause the affected processing while the issue is resolved.

FotoDrop does not sell hosted personal data, use it for advertising, build cross-customer behavioural profiles, carry out facial recognition or use uploaded media to train AI models. Technical operations such as resizing or producing requested exports do not grant independent exploitation rights.

A government or third-party request is not treated as a new Host instruction. FotoDrop assesses the request's legal basis, limits disclosure to what is lawfully required and informs the Host where permitted. A request for a recipient's private album cannot be fulfilled merely because the requester paid for an add-on.

4. Confidentiality and security

Anyone authorised by FotoDrop to access personal data is subject to confidentiality obligations and receives access only as necessary for their role. FotoDrop implements measures appropriate to the processing risk, taking account of the personal nature of event media and the possibility of children's images.

The service measures include HTTPS/TLS; protected host-session cookies; authenticated host management; separation of sites' data; access and request validation; rate limits and abuse controls; metadata minimisation for prepared photos; lifecycle deletion; restricted operator access; and processes to handle security incidents and data-subject requests. Security measures must be tested and reviewed and must not be materially weakened during the agreed processing.

Optional browser-side photo encryption is provided only within its described scope. Recovery information is retained by the service; this is not a guarantee of provider-inaccessible or zero-knowledge encryption. The Host must safeguard complete sharing links, host sign-in access, device/browser access and any keys. A public or forwarded QR code is not an authenticated recipient list.

FotoDrop protects residual recovery copies against ordinary use, applies the disclosed recovery/deletion schedule, and reapplies deletions after any restore. Where appropriate to the actual recovery design, availability, recovery and access-control procedures are tested. These commitments do not promise a particular commercial backup service or an independently certified security standard.

5. Subprocessors

The Host gives general written authorisation for the service providers identified below, solely for their stated functions and subject to this section. They are subprocessors only to the extent they handle data on the Host's behalf; independent controller activity remains separate.

The complete applicable legal-entity and onward-subprocessor information, including locations and functions, is made available to the Host through the provider disclosures and FotoDrop's processing information on request. FotoDrop remains responsible for identifying and keeping that information current; a brand name does not substitute for identifying the actual processing chain.

FotoDrop imposes written data-protection obligations on subprocessors that provide the protection required by Article 28 GDPR and remains responsible to the Host for performance of those obligations. FotoDrop will notify the Host in advance of an intended addition or replacement, ordinarily at least 30 days before the new subprocessor handles the Host's data, and provide a reasonable opportunity to object on data-protection grounds.

Where a justified objection cannot be resolved through an alternative or appropriate safeguards, the Host may end the affected service and retrieve its content without an early-termination penalty. Any prepaid unsupplied portion is refunded. FotoDrop will not treat a change to a web list alone as sufficient notice where direct notice is required. If an urgent security event makes the ordinary notice period impracticable, FotoDrop gives as much notice as possible, explains the necessity, and preserves the Host's objection and termination rights before any otherwise unauthorised processing.

Stripe/Link's independent payment, tax, fraud and transaction-support services are not appointed as album-content subprocessors by this table. FotoDrop does not send album media for ordinary payment processing.

6. International transfers

The Host instructs use of the agreed site's disclosed infrastructure and necessary service providers, but does not authorise an unlawful international transfer. For restricted transfers, FotoDrop ensures an applicable adequacy decision or appropriate safeguards, normally the relevant European Commission Standard Contractual Clauses, a transfer assessment and supplementary measures where needed. UK or Swiss requirements are addressed where applicable.

The EU site's named album-storage commitment remains in force. It must not be interpreted as an all-processing-in-the-EU undertaking. The global site's separate deployment is not a country-specific residency undertaking. A new transfer that would contradict an agreed contractual restriction requires an appropriate lawful change, not merely a new label in a privacy notice.

The Host may request information about the applicable transfer arrangement and copies of the relevant safeguards, with necessary protection of confidential information. This Addendum is an Article 28 processing agreement; it does not purport to be an unmodified set of the Commission's international-transfer Standard Contractual Clauses.

7. Assistance and security incidents

Taking account of the processing and information available, FotoDrop assists the Host with data-subject requests, security obligations, impact assessments, prior consultation, and compliance with Articles 32–36 GDPR. Requests received directly about Host-controlled content are passed to the Host without undue delay, unless the law requires a direct response. FotoDrop does not reject its own controller obligations by forwarding the request.

FotoDrop notifies the Host without undue delay after becoming aware of a personal-data breach affecting the Host's data. The operational target is an initial notice within 24 hours of awareness, using the Host's service-contact email, with further information supplied as it becomes available. Notification is not delayed until an investigation is complete or until all facts are known.

The notice describes, to the extent available, the nature of the breach, affected data and subjects, likely consequences, protective or remedial steps, and a contact for follow-up. FotoDrop cooperates on containment and legally required notifications. The Host remains responsible for its own controller reporting duties; FotoDrop remains responsible for its separate legal duties.

Routine assistance and legally required breach cooperation are included in the service. Any proposed fee for genuinely additional work must be reasonable, agreed in advance and cannot obstruct a data subject's rights or cure FotoDrop's own breach at the Host's expense.

8. Return, deletion and the end of the service

The Host can use supported export functions during active hosting and request assistance with lawful return or erasure. On termination, the Host may choose return of eligible personal data or deletion, with deletion of remaining copies unless applicable law requires preservation. Return uses a commonly used, machine-readable form where applicable. FotoDrop does not make export conditional on buying another plan merely to exercise a statutory right.

Ordinary hosting expiry, the 30-day expiry grace period, seven-day requested-deletion trash, active-system cleanup and residual-copy limits follow the site's Privacy Notice. A supported request for earlier erasure, a legal retrieval request, or a specific lawful hold is handled on its own legal basis rather than mechanically ignoring it until the end of an ordinary window.

When a legal hold is necessary, FotoDrop restricts the retained data to the hold's purpose and scope, reviews the need at least every 90 days, and erases the data when the obligation ends. Independently required payment and accounting records are separated from media and keys. Copies already obtained independently by the Host or other recipients are not under FotoDrop's deletion control.

9. Information, inspection and audits

FotoDrop makes available information reasonably needed to demonstrate compliance with this Addendum and permits and contributes to audits and inspections by the Host or a suitably qualified auditor appointed by it. Documentary evidence or a remote review may be used first where sufficient. Reasonable confidentiality and security arrangements protect other customers and sensitive infrastructure details; they must not make the audit right ineffective.

Ordinary audits use reasonable notice and minimise disruption. A material incident, credible compliance concern or competent authority's requirement may justify shorter notice or additional inspection. No blanket once-a-year limit, mandatory certification substitute or disproportionate fee prevents an audit legally required under Article 28.

10. Priority and continuing obligations

For processing on the Host's behalf, this Addendum prevails over conflicting general Terms. Mandatory law and applicable Standard Contractual Clauses prevail where they require stronger protection. Liability is governed by applicable law and the Terms; no clause excludes a data subject's statutory rights or remedies. Confidentiality, lawful limited retention and cooperation continue for as long as FotoDrop retains relevant personal data.