Data processing agreement

Version: 14 October 2026.

This agreement applies when the images you upload contain personal data and data protection law applies to it: the EU General Data Protection Regulation (GDPR), the Icelandic Act 90/2018, or the UK GDPR. It is part of the terms, so you accept it when you accept them. You are the controller of that data, or a processor acting for your own client, and we are your processor.

1. The standard clauses

The parties agree to the standard contractual clauses between controllers and processors set out in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 (Official Journal L 199, 7.6.2021, p. 18), called “the Clauses” here. The Clauses are incorporated into this agreement unchanged. The sections and annexes below make the choices and supply the details that the Clauses leave to the parties, and add terms the Clauses allow. If anything on this page or in the terms contradicts the Clauses, the Clauses prevail.

Where the UK GDPR applies, references in the Clauses to Regulation (EU) 2016/679 are read as references to the UK GDPR.

2. Choices under the Clauses

• Option 1 throughout: wherever the Clauses offer a choice between Regulation (EU) 2016/679 (the GDPR) and Regulation (EU) 2018/1725, which applies to EU institutions, we choose the GDPR. The choice appears in Clauses 1(a), 8(c) and 9.
• Clause 5 (docking clause) is not used.
• Clause 7.7(a) (sub-processors): option 2, general written authorisation. The agreed list is Annex IV. We will tell you at least 30 days before we add or replace a sub-processor, by email to the address on your account and by updating this page. You may object within that time on reasonable data protection grounds. If we cannot resolve your objection, you may end your subscription before the change takes effect.
• Clause 9 (personal data breach): we notify you at the email address on your account.
• Clause 10(d) (deletion or return after termination): you choose deletion. At the end of the contract we delete your content as section 10 of the terms describes, and confirm to you by email that we have done so. Until then you can retrieve your originals yourself.

3. Your instructions

Your documented instructions to us are the terms, the settings you choose in the dashboard, and the requests that you and your systems make to the service with your keys. They include the instruction to serve your images to anyone who requests them by URL. We will tell you if we believe an instruction breaks data protection law.

4. What you are responsible for

• Having a legal basis for the images you upload, and telling the people shown in them and your own visitors what the law requires you to tell them.
• Deciding whether public delivery suits the data. Delivered images are reachable by anyone who has the URL, and the service applies no extra safeguard to sensitive data. Do not upload special categories of personal data, or anything that needs access control.
• Embedded metadata. Originals are served exactly as you uploaded them, including any metadata inside the file, such as the place a photograph was taken. Remove what should not be public before you upload.
• Keeping your password and project keys secure.

5. Information and audits

We give you the information you need to show that the Clauses are complied with. We answer written questions first. If that is not enough, you may audit us, or have an independent auditor bound by confidentiality do so, on 30 days' notice, during business hours, at your own cost, and not more than once a year unless there are indications of non-compliance, or a personal data breach or an authority requires more.

6. Assistance

We help you answer requests from data subjects and meet your duties on security, breach notification and impact assessments, as the Clauses require. A request from a data subject that reaches us about your content is passed to you; we do not answer it ourselves.

7. Liability

The limits of liability in the terms apply to claims between you and us under this agreement, to the extent the law allows. Nothing in this agreement limits the rights of data subjects or the powers of a data protection authority.

8. Term and law

This agreement applies for as long as we process personal data on your behalf. The governing law and venue are those of the terms.

Annex I: the parties

Controller: the customer that holds the account, reachable at the email address on the account.

Processor: Baldur Páll Hólmgeirsson, Engjavegur 16, 400 Ísafjörður, Iceland, kennitala 030279-5309. Contact for data protection: privacy@dynjandi.dev.

Annex II: description of the processing

• Data subjects: people who appear in, or can be identified from, the images you upload; and the people who request your images from the delivery service.
• Personal data: the content of the images; metadata embedded in the image files; original file names, where supplied. For people requesting images: the IP address and request metadata that Cloudflare processes in delivering an image, and the URL, method and headers of a request that ends in an error report. The usage record the service itself keeps for each request holds no IP address.
• Sensitive data: none is intended. Images can reveal special categories of data; the service applies no additional safeguard, and section 4 applies.
• Nature of the processing: storing originals; rendering resized, cropped and re-encoded variants, which can include locating faces in an image to position a crop; suggesting a focal point for an image on request, from the faces in it or, if there are none, its most prominent area; caching; serving images over public URLs; deleting on your instruction.
• Purpose: providing the service to you.
• Duration: the term of the contract and up to 60 days after it ends.

Annex III: technical and organisational measures

• Encryption: stored images are encrypted at rest by Cloudflare R2 with AES-256, and connections to R2 use TLS.
• Access to the dashboard: sign-in with an email address and a password. Passwords are stored only as hashes, and the password an account is created with must be at least 12 characters, whichever way it is created. Sign-in, sign-up and verification mail are rate limited. The session cookie is HTTP-only and sent only over HTTPS.
• Separation of customers: every dashboard read and edit is limited to the workspaces the signed-in user belongs to, taken from the session and never from the request. Originals and variants are stored under their workspace and project.
• Uploads: an upload must carry the project's public key.
• Secrets: project secret keys are stored only as hashes.
• Error monitoring: the server-side reporters are configured not to collect request or response bodies or user information, they leave out cookies and the headers that carry an IP address, and Sentry is set not to store IP addresses.
• Deletion: deleting a file removes its record, its ownership entry, the original and the stored variants, and asks Cloudflare to purge cached variants. A purge that does not complete is repeated from the dashboard until it does. Copies already held by browsers and other caches can last up to a year.
• Connections: plain HTTP requests to the dashboard and the image service are redirected to HTTPS.
• Our own accounts: two-factor sign-in is on for the Cloudflare, GitHub, Polar and Sentry accounts that run the service. Only the operator has access to the Cloudflare account, which holds the database and the stored images.
• Backups: the database can be restored to any point in the last 30 days. Stored images are kept on several disks across several data centres, but are not backed up separately, so an image that is deleted cannot be restored.
• Incidents: when we learn of a security incident, we first contain it, for example by rotating credentials, ending sessions or switching off a workspace, and then work out which data and which customers it affects. We tell affected customers without undue delay, at the email address on their account, what happened, what it means for their data and what we are doing about it, and we keep a written record of every incident.
• Changes to the service: automated lint, type, build and test checks must pass before our deployment pipeline deploys a change, and changes are deployed only through that pipeline.

Annex IV: sub-processors

• Cloudflare, Inc. (United States): hosting of the whole service, including compute, the database, image storage, the transform containers, the cache and the delivery network. Its data processing addendum is part of its self-serve subscription agreement; transfers rely on the EU-US Data Privacy Framework and the standard contractual clauses.
• Functional Software, Inc., trading as Sentry (United States; our reports are stored in its EU region, in Frankfurt): error monitoring. An error report can contain a file identifier and the URL, method and headers of the failed request; cookies, and the headers that carry the requester's IP address, are left out. Transfers rely on the EU-US Data Privacy Framework, with the standard contractual clauses as a fallback.
• Uploadcare Inc. (United States): only for a project with origin pull enabled, where an image that is not stored with us is fetched from ucarecdn.com by its file identifier. The request carries nothing about the person viewing the image or about your account. Uploadcare takes part in the EU-US Data Privacy Framework.

Polar, Cloudflare Turnstile and Cloudflare Email Service handle your account and billing data, for which we are the controller. They are described in the privacy policy and are not sub-processors for your content.