Data processing agreement

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in the GDPR. “GDPR” means Regulation (EU) 2016/679 and, where it applies, the UK GDPR and the Data Protection Act 2018. “Customer personal data” means the personal data we process on the customer's behalf under this DPA. Other capitalised terms have the meaning given in the terms and conditions.

2. Subject matter, nature, purpose and duration

We process customer personal data only to carry out the customer's orders: receiving and storing photos and reference images, staging them with generative image models, reviewing and approving the results, adding the label and provenance data, delivering, carrying out revisions, providing share and public links, and storing the files for the periods in Annex 1.

Annex 1 describes the processing in detail. This DPA runs for as long as we process customer personal data. If it conflicts with the terms and conditions, this DPA prevails for anything concerning personal data.

3. Processing on documented instructions

We process customer personal data only on the customer's documented instructions, including with regard to transfers to a country outside the EEA. The terms and conditions, this DPA (including the use of the sub-processors in Annex 3), every order, every revision request and the settings the customer chooses in the portal count as such instructions. We do not use customer personal data for our own purposes, as examples, in marketing or to train image models, with two exceptions that we carry out as controller and describe in our privacy notice: the review log (no images, only who approved which file and when, and hashes of the files, kept for 5 years) and, for properties in the United States, the copy of the original behind the public link (24 months), so that the edit can be checked.

We may process customer personal data otherwise only where EU or member state law requires it; we then inform the customer beforehand, unless that law prohibits it.

If we consider that an instruction infringes the GDPR or other data protection law, we inform the customer immediately and may suspend that instruction until the customer confirms or changes it.

4. Obligations of the customer

The customer is responsible for the lawfulness of the processing it instructs, for informing data subjects where required, and for having a lawful basis for the personal data in the material it supplies.

The customer supplies as little personal data as possible: before uploading it removes, where it reasonably can, identifiable people, names, documents, number plates and other personal details from the photos. Special categories of personal data and data about children do not belong in the photos.

5. Confidentiality

Everyone working for us who has access to customer personal data is bound by a duty of confidentiality. Access is granted only to staff who review photos or administer the service, and only to the extent needed for their role.

6. Security

We take appropriate technical and organisational measures to protect customer personal data against loss and unlawful processing, taking into account the state of the art, the costs, and the nature and risks of the processing. Annex 2 lists the measures. We may improve them, but will not reduce the overall level of protection.

7. Sub-processors

The customer gives general written authorisation for the sub-processors listed in Annex 3.

We announce any intended addition or replacement of a sub-processor at least 30 days in advance by email to the customer's account address and on this page. The customer may object on reasonable grounds relating to data protection within that period. If we cannot resolve the objection, the customer may end the contract before the change takes effect and we refund the value of its unused paid credits that are still valid.

We impose on every sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA. We remain responsible to the customer for the performance of our sub-processors.

8. International transfers

We store customer personal data in the EU. The customer instructs us to use the sub-processors in Annex 3, including those established in the United States. Where a sub-processor processes customer personal data outside the EEA, or gives access to it from there, we ensure an appropriate safeguard under Chapter V of the GDPR, as named for each sub-processor in Annex 3: an adequacy decision (such as the EU-US Data Privacy Framework for certified providers) or the European Commission's standard contractual clauses (module 3, processor to processor), with additional measures where needed. If the Data Privacy Framework ceases to apply, the standard contractual clauses apply in its place. For data subject to the UK GDPR, the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum applies.

If the customer is established outside the EEA, the parties agree that, to the extent required, the standard contractual clauses (module 4, processor to controller) apply to our return of customer personal data to the customer, and are incorporated into this DPA by reference.

9. Assistance to the customer

Taking into account the nature of the processing, we assist the customer with appropriate measures in responding to requests from data subjects, for example by deleting specific photos early or providing a copy. If we receive a request directly, we forward it to the customer without undue delay and do not respond ourselves unless the customer asks us to.

We also assist the customer, on request and to the extent of the information available to us, with its obligations under Articles 32 to 36 of the GDPR: security of processing, notifying personal data breaches to the supervisory authority and communicating them to data subjects, data protection impact assessments, and prior consultation of a supervisory authority. We may charge reasonable costs for assistance that goes beyond what the service normally includes, but never for assistance with a breach on our side.

10. Personal data breaches

We notify the customer without undue delay, and in any event within 48 hours after becoming aware, of a personal data breach affecting customer personal data.

The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. Where not all information is available at once, we provide it in phases.

We take measures to limit the consequences and to prevent a repetition, and we support the customer in reporting the breach to the supervisory authority and to data subjects. A notification is not an admission of fault or liability.

11. Retention, deletion and return

We delete customer personal data automatically at the end of the retention periods in Annex 1. At the customer's request we delete photos earlier, unless an order is still open.

When this DPA ends, the customer chooses whether we delete or return the customer personal data. Return takes place by the customer downloading the results and originals from its account or, on request, through a download link we provide. We then delete all customer personal data, including existing copies, within 30 days, unless EU or member state law requires us to keep it. Backups are overwritten in the normal backup cycle of our database provider, and copies held by sub-processors are deleted within their own periods stated in Annex 3.

The review log is kept for 5 years. It contains no images and no personal data from the photos, only who approved which file and when, and hashes of the files. We keep it on our own account, as controller, to demonstrate what we approved and delivered.

12. Information and audits

On request, we provide the customer with all information necessary to demonstrate compliance with Article 28 of the GDPR, such as a description of our measures and the certifications or audit reports of our sub-processors.

If that information is not sufficient, the customer may, at its own expense and no more than once a year (or after a personal data breach), have an audit carried out by an independent auditor bound by confidentiality, with at least 30 days' notice, during working hours and without disrupting our operations or the confidentiality of other customers' data. We cooperate with an audit by a supervisory authority at any time.

13. Liability

Each party is liable under Article 82 of the GDPR towards data subjects. Between the parties, the limitations of liability in the terms and conditions apply to this DPA, except to the extent the law does not allow them.

14. United Kingdom and United States

For customer personal data subject to the UK GDPR, references in this DPA to the GDPR include the UK GDPR, and references to a supervisory authority include the Information Commissioner's Office.

For customer personal information subject to the California Consumer Privacy Act or a similar US state law, we act as a service provider or processor. We do not sell or share that information, do not retain, use or disclose it outside the direct business relationship with the customer or for any purpose other than performing the service, and do not combine it with personal information we receive from others, except as that law permits. We notify the customer if we can no longer meet these obligations.

15. Final provisions

This DPA is governed by Dutch law, and disputes are subject to the court named in the terms and conditions. We may change this DPA in the way described in the terms and conditions for changes; a change required by law may apply sooner. Questions about this DPA can be sent to hello@virtualhomestage.com.

16. Annex 1: Description of the processing

17. Annex 2: Technical and organisational measures

• Photos are kept in private storage that is not publicly accessible; files are opened only through signed links that expire after a short time. US public links redirect to a short-lived signed link to a copy without EXIF and GPS data.
• All connections are encrypted with TLS, with HSTS on the production site. Our database and storage providers encrypt data at rest.
• Database row-level security: customers can only read their own rows; all changes go through our server.
• Working copies and delivered results contain no camera or location metadata.
• Role-based access for staff (reviewer, photo editor, administrator), with sign-in by personal link or code, mandatory two-step verification for administrators, sessions that expire after 12 hours, an IP allowlist for the administration area, and immediate loss of rights when a staff member is deactivated.
• An alert to the staff member when a sign-in comes from a new country.
• Rate limits on sign-in, the contact form and uploads; identifiers are hashed before storage.
• A strict content security policy and security headers on all pages.
• An append-only review log, enforced in the database, which refuses delivery of a photo without a recorded approval for that file.
• An append-only, hash-chained audit log of every administrative action with consequences, such as refunds, credit grants and deletions.
• Automatic retention jobs that delete files and data at the end of the periods in Annex 1.
• A data export and a deletion procedure for customer accounts, with pseudonymisation of records that must be kept.
• Sub-processors selected for their security and bound by data processing agreements; processing in EU regions where available.
• Confidentiality obligations for all staff, and instructions on handling customer photos.

18. Annex 3: Sub-processors

• Supabase Inc. (United States): database, photo storage and sign-in; data stored in the EU (Ireland); support access from outside the EEA under standard contractual clauses.
• Vercel Inc. (United States): hosting of the website and server; server functions in Frankfurt (Germany), pages delivered through a worldwide network; EU-US Data Privacy Framework and standard contractual clauses.
• Resend (Plus Five Five, Inc., United States): sending delivery and order emails, which contain links to the files but not the files themselves; sent from the EU region; EU-US Data Privacy Framework and standard contractual clauses.
• Migadu-Mail GmbH (Switzerland): hosting of our support mailbox, which holds the emails and attachments customers send us, for example about an order; stored in data centres in France; Switzerland has an adequacy decision of the European Commission.
• Google (Gemini API, paid service): generative image models that stage the photos, from a working copy without EXIF and GPS data; Google does not use the content to train its models and keeps prompts and results for 55 days solely to detect abuse; may be processed outside the EEA; EU-US Data Privacy Framework and standard contractual clauses.
• Features and Labels, Inc. (fal.ai, United States): access to an additional generative image model for some photos, from a working copy without EXIF and GPS data; where we use fal.ai, storage of inputs is switched off, and the content may not be used for training; processed in the United States and other countries; standard contractual clauses.

Stripe processes payment data for which we are the controller, not customer personal data from photos, and is therefore not listed here.