FAQ·Contact Us·Terms of Service·Privacy Policy·Acceptable Use Policy·Copyright & DMCA Policy·Data, Storage & Backup Policy·Data Processing Agreement·School Data Terms·Sub-processors·Open-Source Licenses

Data Processing Agreement

Effective Date: October 7, 2026 · Last updated: October 7, 2026

This Data Processing Agreement ("DPA") is part of the Image Depot Terms of Service (see Section 7A) between Image Depot LLC ("Image Depot", "we") and the Studio that holds the account ("you"). It applies whenever you put personal information about other people -- your Clients, the people in your photographs, athletes, parents, buyers -- into the Service. For that information you are the controller (you decide why it is collected and how it is used) and Image Depot is your processor. Where Image Depot collects information for its own purposes, the Privacy Policy applies instead and Image Depot is responsible for it.

1. What we process, and why

We process the personal information you put into the Service -- names, email addresses, shipping addresses, phone numbers, team and roster details, photographs and videos of people, purchase records and the messages your Clients send through the Service -- for one purpose: to provide the Service to you as described in the Terms, including delivering galleries, selling and fulfilling orders, sending the emails you ask us to send, and the optional features you turn on.

2. Your instructions

We process that information only on your documented instructions. Your instructions are the Terms, this DPA, the settings you choose in the Service (for example which galleries are public, which features are on, which print lab fulfils orders) and the actions you take in it. We will tell you if we believe an instruction breaks the law that applies to us. If the law requires us to process information in some other way, we will tell you first unless the law forbids it.

3. Confidentiality

The people who work on the Service and can reach your Clients' information are bound to keep it confidential. Access to production data is limited to named Image Depot staff who need it for their work. Staff accounts are given one of a small set of defined roles, such as billing, support or read-only, and each role can open only what that role's work needs; full access is limited to the owners. Staff sign-ins to a Studio's account, and the changes staff make in the admin console, are recorded in an audit log under the staff member's name.

4. Security

We keep the technical and organisational measures described in the Data, Storage & Backup Policy (Section 13) and the Privacy Policy (Section 8): encryption in transit and at rest, access controls, logging of activity, per-studio data separation, abuse prevention, and regular backups with an off-site copy. Detailed security documentation is available on request: support@imagedepot.net. We may improve these measures; we will not reduce the overall level of protection during the term.

5. Sub-processors

You authorise us to use the sub-processors listed on our sub-processor page. Each one is bound by terms that protect your Clients' information at least as well as this DPA. Before a new sub-processor receives your Clients' information we update that page and email account owners at least 30 days in advance. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may end your account under the Terms and export your Content first. We remain responsible to you for our sub-processors' work.

6. Where information is processed

Image Depot is operated from the United States, and your Clients' information is stored and processed there and by the sub-processors in the locations the sub-processor page gives. If you are in Canada, Australia or New Zealand, you are responsible for being allowed to transfer that information to us, and we rely on the transfer basis set out in the Privacy Policy (Section 15) and on this DPA. You may not instruct us to store information in a particular country; we do not offer regional hosting.

7. Helping you with requests and complaints

Your Clients and the people in your photographs may ask you for access to, correction of, or deletion of their information, or complain about how it is used. The Service lets you do most of that yourself (edit or delete a Client's record, delete photos, close a gallery, export records). Where you need more, email support@imagedepot.net with "Processor request" in the subject and we will help within the timelines in the Privacy Policy (Section 13). If one of those people contacts us directly about information you collected, we will tell you and refer them to you unless the law requires us to answer ourselves.

8. Security incidents

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to your Clients' information, we will tell the account owner without undue delay and, where we can, within 72 hours of confirming it, and in every case early enough for you to meet your own legal deadline, with what we know at the time: what happened, which information and which people are affected as far as we can tell, what we are doing about it and what we suggest you do. We will keep you updated as we learn more and will help you with any notice you have to give. We follow the incident response steps in our internal runbook and we keep a record of every incident.

The timing the law sets is separate from our promise to you. Under Texas law (Business & Commerce Code, Section 521.053), the people affected must be told without unreasonable delay and no later than 60 days after the breach is determined, and the Texas Attorney General must be told as soon as practicable and no later than 30 days after it is determined when 250 or more Texas residents are affected. You decide who is told about your Clients' information; we give you the facts you need in time. Where we must notify people about information we hold for our own purposes, we do it within those deadlines.

9. Deleting and returning information

You can export your Content and records at any time (Terms, Section 18). When you delete a Client's information, a gallery or your account, we delete it on the schedule in the Privacy Policy's retention table (Section 9): deleted photos and videos leave the recoverable trash after 30 days, nightly backups are kept 30 days and the off-site copy up to 120 days, and the few records the law or our accounting requires us to keep are listed there. Our audit ledger keeps the record that the deletion happened, with protected rather than raw identifiers.

10. Showing you we comply

On request, no more than once a year unless there has been an incident, we will give you the information reasonably needed to show that we meet this DPA: this document, the current sub-processor list, our security and retention descriptions, our incident record for your account and the audit ledger entries for your account (Dashboard › File history on each photo, and the Audit export on each gallery, which you can run yourself as a CSV or a printable report). We do not host on-site audits; we are a small company and the documents above are what we can offer.

11. Term, changes and precedence

This DPA lasts as long as your account does and for as long after as we hold your Clients' information. We may update it the way the Terms allow (Terms, Section 36); the "Last updated" date above changes when we do, and material changes are emailed to account owners. If this DPA and the Terms conflict about personal information, this DPA wins. Everything else in the Terms, including the limits on our liability, applies to this DPA.

12. Contact

Image Depot LLC, 18918 Atasca Oaks Drive, Humble, Texas 77346 · support@imagedepot.net

This DPA is written for Studios in United States, Canada, Australia and New Zealand. It was not written for the UK or the European Union, where the Service is not offered.