FAQ·Contact Us·Terms of Service·Privacy Policy·Acceptable Use Policy·Copyright & DMCA Policy·Data, Storage & Backup Policy·Data Processing Agreement·Sub-processors·Open-Source Licenses

Data Processing Agreement

Effective Date: October 7, 2026 · Last updated: October 7, 2026

This Data Processing Agreement ("DPA") is part of the Image Depot Terms of Service (see Section 7A) between Image Depot LLC ("Image Depot", "we") and the Studio that holds the account ("you"). It applies whenever you put personal information about other people -- your Clients, the people in your photographs, athletes, parents, buyers -- into the Service. For that information you are the controller (you decide why it is collected and how it is used) and Image Depot is your processor. Where Image Depot collects information for its own purposes, the Privacy Policy applies instead and Image Depot is responsible for it.

1. What we process, and why

We process the personal information you put into the Service -- names, email addresses, shipping addresses, phone numbers, team and roster details, photographs and videos of people, purchase records and the messages your Clients send through the Service -- for one purpose: to provide the Service to you as described in the Terms, including delivering galleries, selling and fulfilling orders, sending the emails you ask us to send, and the optional features you turn on.

2. Your instructions

We process that information only on your documented instructions. Your instructions are the Terms, this DPA, the settings you choose in the Service (for example which galleries are public, which features are on, which print lab fulfils orders) and the actions you take in it. We will tell you if we believe an instruction breaks the law that applies to us. If the law requires us to process information in some other way, we will tell you first unless the law forbids it.

3. Confidentiality

The people who work on the Service and can reach your Clients' information are bound to keep it confidential. Access to production data is limited to the owners of Image Depot and is logged.

4. Security

We keep the technical and organisational measures described in the Data, Storage & Backup Policy (Section 13) and the Privacy Policy (Section 8): encryption in transit and at rest, access controls and two-step sign-in for staff, per-studio data separation, rate limiting and abuse blocking, nightly backups with an off-site copy, and a tamper-evident audit ledger of what happens to an account. We may improve these measures; we will not reduce the overall level of protection during the term.

5. Sub-processors

You authorise us to use the sub-processors listed on our sub-processor page. Each one is bound by terms that protect your Clients' information at least as well as this DPA. Before a new sub-processor receives your Clients' information we update that page and email account owners at least 30 days in advance. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may end your account under the Terms and export your Content first. We remain responsible to you for our sub-processors' work.

6. Where information is processed

Image Depot is operated from the United States, and your Clients' information is stored and processed there and by the sub-processors in the locations the sub-processor page gives. If you are in Canada, Australia or New Zealand, you are responsible for being allowed to transfer that information to us, and we rely on the transfer basis set out in the Privacy Policy (Section 15) and on this DPA. You may not instruct us to store information in a particular country; we do not offer regional hosting.

7. Helping you with requests and complaints

Your Clients and the people in your photographs may ask you for access to, correction of, or deletion of their information, or complain about how it is used. The Service lets you do most of that yourself (edit or delete a Client's record, delete photos, close a gallery, export records). Where you need more, email support@imagedepot.net with "Processor request" in the subject and we will help within the timelines in the Privacy Policy (Section 13). If one of those people contacts us directly about information you collected, we will tell you and refer them to you unless the law requires us to answer ourselves.

8. Security incidents

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to your Clients' information, we will tell the account owner without undue delay and within 72 hours of confirming it, with what we know at the time: what happened, which information and which people are affected as far as we can tell, what we are doing about it and what we suggest you do. We will keep you updated as we learn more and will help you with any notice you have to give. We follow the incident response steps in our internal runbook and we keep a record of every incident.

9. Deleting and returning information

You can export your Content and records at any time (Terms, Section 18). When you delete a Client's information, a gallery or your account, we delete it on the schedule in the Privacy Policy's retention table (Section 9): deleted photos and videos leave the recoverable trash after 30 days, nightly backups are kept 30 days and the off-site copy up to 120 days, and the few records the law or our accounting requires us to keep are listed there. Our audit ledger keeps the record that the deletion happened, with hashed rather than raw identifiers.

10. Showing you we comply

On request, no more than once a year unless there has been an incident, we will give you the information reasonably needed to show that we meet this DPA: this document, the current sub-processor list, our security and retention descriptions, our incident record for your account and the audit ledger entries for your account (Dashboard › File history on each photo, and the Audit export on each gallery, which you can run yourself as a CSV or a printable report). We do not host on-site audits; we are a small company and the documents above are what we can offer.

11. Term, changes and precedence

This DPA lasts as long as your account does and for as long after as we hold your Clients' information. We may update it the way the Terms allow (Terms, Section 36); the "Last updated" date above changes when we do, and material changes are emailed to account owners. If this DPA and the Terms conflict about personal information, this DPA wins. Everything else in the Terms, including the limits on our liability, applies to this DPA.

12. Contact

Image Depot LLC, 18918 Atasca Oaks Drive, Humble, Texas 77346 · support@imagedepot.net

This DPA is written for Studios in United States, Canada, Australia and New Zealand. It was not written for the UK or the European Union, where the Service is not offered.