Legal
Data Processing Agreement
Last updated: 17 September 2026Effective from: 17 September 2026Version 2026-09-17
This Data Processing Agreement (“DPA”) is an addendum to the Terms of Service and applies where the Photographer (Controller) uploads or otherwise supplies personal data of clients or other individuals in RemiXiss, and the Service Provider (Processor) processes that data on the Controller’s behalf.
Processor: Oliwier Zaremba – RMXVisual Górnośląska 21A 62-800 Kalisz Poland kontakt@rmxvisual.pl
This DPA does not claim ISO 27001, SOC 2, PCI DSS or other certifications for RMXVisual. Stripe and other subprocessors may have their own certifications; those are not certifications of the Service Provider.
1. Subject matter, duration, nature and purpose
Subject matter: hosting and delivery of photographer-controlled galleries and related media.
Duration: for as long as the Photographer uses RemiXiss to process the relevant data, and until deletion or return after termination as described below.
Nature: storage, retrieval, transmission, display, thumbnail/preview generation, access-control, and gallery statistics processing.
Purpose: to provide RemiXiss so the Controller can deliver photographs and galleries to authorised clients.
2. Types of personal data and data subjects
Types of data: photographs and media that may depict individuals; gallery names and metadata; client login identifiers; gallery access credential hashes; visitor identifiers used for gallery statistics; other content the Controller chooses to upload.
Data subjects: the Controller’s clients, persons depicted in photographs, and gallery viewers, as determined by the Controller.
3. Documented instructions
The Processor processes Controller personal data only on documented instructions from the Controller, including the Terms, this DPA, and actions the Controller takes in the RemiXiss interface (upload, publish, protect, delete, download), unless required to do otherwise by EU or Member State law.
4. Confidentiality
Persons authorised to process the data are committed to confidentiality.
5. Technical and organisational security
Security measures currently implemented include HTTPS, hashed photographer passwords via the Better Auth architecture, HTTP-only session cookies, hashed gallery client passwords, server-side authorisation isolating galleries to their owner, private object storage with signed object URLs, and a restricted operator panel.
These descriptions are accurate at a business level and do not disclose implementation-sensitive internals. No security certification is claimed.
6. Subprocessors
The Controller authorises the subprocessors listed at https://rmxvisual.pl/subprocessors. The Processor will keep that list current. Adding or replacing infrastructure providers is done by updating that configuration. The Controller should review the list periodically.
7. Data subject requests
Taking into account the nature of processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as possible, in responding to data-subject requests that concern Controller data in RemiXiss.
8. Personal-data breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller personal data, to the extent required by applicable law and this DPA. No arbitrary internal hour-count is promised.
9. DPIA and cooperation
The Processor will provide reasonable cooperation to the Controller for data-protection impact assessments and prior consultation where this is required and relates to RemiXiss processing, taking into account the nature of processing and information available to the Processor.
10. Deletion or return after termination
After the end of gallery or account processing, the Processor will delete Controller media and gallery records as implemented in the product and any account-closure process, unless Union or Member State law requires storage. Photographers can delete galleries in the application. Complete account-level self-service deletion is not yet available; closure can be requested by email.
11. Audit and information obligations
The Processor will make available information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits reasonably requested by the Controller, on reasonable notice, during normal business hours, without disrupting the Service, and subject to confidentiality. The Processor is not required to disclose secrets, other customers’ data, or security-sensitive internals.
12. International transfers
Where a subprocessor processes data outside the EEA, transfers occur under that subprocessor’s published transfer mechanism. The Processor does not invent SCCs or adequacy decisions in this DPA. Uncertain transfer details are described as unverified on the Subprocessors page rather than guessed.
13. Processor obligations
The Processor shall comply with Article 28 GDPR obligations applicable to processors, including using only authorised subprocessors, implementing appropriate security, and assisting the Controller as set out above.