Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Controller") and Keenpix ("Processor") and applies where Keenpix processes personal data on your behalf in providing the service. Where terms conflict, this DPA controls for data-protection matters.

1. Roles and scope

You are the controller of the personal data you route through Keenpix (including data embedded in or associated with the images and requests of your end users). Keenpix is the processor and processes such data only on your documented instructions, which include your configuration of the service and these terms.

2. Nature and purpose of processing

Keenpix fetches, transforms, caches, and delivers images from origins you control, and records per-request operational metadata to power your analytics, logs, and bandwidth billing. The categories of data subjects and personal data are those you choose to route through the service.

3. Confidentiality

Keenpix ensures that personnel authorized to process personal data are bound by confidentiality obligations.

4. Security

Keenpix implements appropriate technical and organizational measures, including encryption in transit, tenant isolation, hashed credentials, and least-privilege access, to protect personal data against unauthorized access, loss, or disclosure.

5. Sub-processors

You authorize Keenpix to engage the sub-processors listed in our Privacy Policy (hosting/database, Cloudflare R2, ClickHouse, Polar, Postmark). Keenpix imposes data-protection obligations on each sub-processor no less protective than this DPA and remains responsible for their performance. We will give reasonable notice of new sub-processors so you may object on reasonable grounds.

6. International transfers

Where personal data is transferred across borders, Keenpix relies on lawful transfer mechanisms (such as Standard Contractual Clauses) with its sub-processors as applicable.

7. Data subject requests and assistance

Taking into account the nature of the processing, Keenpix will provide reasonable assistance to help you respond to data-subject requests and to meet your obligations regarding security, breach notification, and impact assessments.

8. Breach notification

Keenpix will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with information reasonably available to help you meet your notification obligations.

9. Deletion and return

On termination, Keenpix will delete or return personal data processed on your behalf within a reasonable period, except where retention is required by law. You may also delete projects and data from the app at any time.

10. Audits

Keenpix will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits on reasonable prior notice, subject to confidentiality.

Contact

To raise a data-protection matter or request a signed copy of this DPA, email [email protected].