Data processing agreement

This data processing agreement (“DPA”) forms part of the terms of service between Bloomworks and each studio that uses Dellro. It applies to the personal information in the content and client details a studio uploads. By accepting the terms, the studio agrees to this DPA. Where this DPA and the terms differ on data protection, this DPA applies.

1. Parties and roles

The studio is the responsible party under the Protection of Personal Information Act, 2013 (POPIA) and the controller under the EU and UK General Data Protection Regulation (GDPR). Bloomworks is the operator under POPIA and the processor under the GDPR (“we”, “us”).

Operator

Bloomworks

Email

hello@bloomworks.tech

Our use of a studio’s own account data, where we are the responsible party, is covered by our privacy policy, not by this DPA.

2. Subject matter, duration, nature and purpose

• Subject matter: hosting and delivering wedding and event films and photographs that the studio shares with its clients.
• Nature: storing, copying, fingerprinting, encoding, streaming and making available for download the studio’s content; sending gallery emails and sign-in codes; recording viewing activity; and keeping protected copies.
• Purpose: to provide Dellro to the studio, as described in the terms, and for no other purpose.
• Duration: for as long as we hold the studio’s content, including the retention and lock periods in section 9.

3. Data subjects and categories of data

Data subjects:

• couples and other clients of the studio;
• wedding and event guests;
• anyone who appears in, or is heard in, the content;
• the studio’s team members, where they appear in gallery records.

Categories of personal information:

• images and video, including sound, which may show people’s faces and, for some events, information about religious or cultural belief;
• names and email addresses;
• gallery passwords and personal access codes;
• favourites and viewing activity (views, plays and downloads);
• network (IP) addresses and basic device information, used for security.

The studio decides what it uploads and must not upload more personal information than it needs to deliver its work.

4. Instructions

We process personal information only on the studio’s documented instructions. The terms, this DPA and the studio’s use of the settings in Dellro are those instructions. If the law requires us to process the information in another way, we will tell the studio first unless the law forbids it. If we believe an instruction breaks data protection law, we will say so.

5. Confidentiality

Only people who need access to provide or support the service can reach the studio’s content, and they are bound by confidentiality. We do not sell the content or use it to advertise.

6. Security measures

We maintain the technical and organisational measures in Annex 1 and may improve them over time, as long as protection is not reduced.

7. Sub-processors

The studio gives general authorisation for us to use the sub-processors in Annex 2. We bind each one to data protection terms that protect the information to at least the standard in this DPA, and we remain responsible for their work. We will give at least 30 days’ notice by email before adding or replacing a sub-processor. The studio may object on reasonable data protection grounds within that period. We will then try to find a solution; if we cannot, the studio may end the affected service, and the terms on cancellation apply.

8. Helping the studio

• Data subject requests: if a couple or guest contacts us directly, we will pass the request to the studio without delay and not answer it ourselves unless the studio asks. We will help the studio respond, mostly through the tools in Dellro, such as removing a guest, revoking access or deleting a gallery.
• Breaches: we will notify the studio without undue delay, and in any case within 72 hours of becoming aware of a security compromise affecting its personal information. We will share what we know, what we are doing about it and what the studio may need to tell its clients or a regulator.
• We will give reasonable help with the studio’s own security, impact assessment and regulator obligations, using the information we hold.

9. Deletion and return

A studio can download its content and delete galleries at any time, and can ask by email for an export and for its account to be closed. When a gallery is deleted, its viewing copies are removed. Locked copies are kept under Object Lock until their lock period ends and cannot be deleted earlier by anyone, including us; they then expire. Backups expire on their schedule. If a membership ends without a deletion request, galleries stay online for at least 12 months and never less than three years from creation, with emails 60 and 14 days before removal, as set out in the terms.

10. Audits

On request, we will provide the information reasonably needed to show that we meet this DPA, such as a description of our security measures and our current sub-processors. Write to hello@bloomworks.tech.

11. International transfers

Our sub-processors store or process information in the United States. For transfers outside South Africa, we rely on section 72 of POPIA, and for studios in the EU or UK, on the GDPR’s transfer rules, through contractual protections: each sub-processor’s data protection terms, which bind it to protect the information to an adequate standard.

12. Liability and governing law

Liability under this DPA is subject to the limits in the terms of service. This DPA is governed by the same law, and disputes go to the same courts, as the terms.

Annex 1: Security measures

• Passwords stored only as scrypt hashes; sessions in signed, httpOnly cookies; sign-in rate limits.
• A strict content security policy on all pages.
• Original files reached only through short-lived signed links; galleries never indexed by search engines.
• Gallery access controls chosen by the studio: private draft, open link, password, personal access codes, or emailed sign-in codes.
• Every file fingerprinted (SHA-256) before upload and kept in three copies, one under Object Lock; copies re-checked weekly and rebuilt if damaged.
• Nightly database backups, encrypted with a key held offline.
• A hardened video processing server: key-only access, no root logins and minimal secrets.
• Team roles (owner, manager, viewer) so studios can limit what each person can do.

Annex 2: Sub-processors

Payments are handled by PayFast (South Africa) for the studio’s own billing; it does not receive gallery content. Anthropic helps write our public blog and never receives customer data.