Data Processing Agreement

Last updated: 19 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service for the hosted Falcon service ("Service"). It applies to personal data processed for the Customer, excluding on-premises installations.

1. Parties

Processor: Captomatic SIA, registration No. 40203140085, Mūkusalas iela 29b, Rīga, Latvia ("Captomatic", "we"). Contact: [email protected]

Customer: the person or entity owning a site. Anyone accepting this DPA for an entity must have authority to do so.

2. Roles and scope

The Customer is controller of personal data processed through its sites ("Customer Data"); Captomatic is processor. If the Customer acts for another controller, Captomatic is its subprocessor and the Customer must have authority to give the instructions and authorisations in this DPA.

Customer Data covers:

• photos, videos and audio captured by the Customer's devices;
• optional face detection metadata: face and facial-feature positions, detection confidence and identifiers within a video. The Service does not use it to identify people;
• uploaded site assets;
• device status, logs and live snapshots used to monitor the Customer's devices;
• visitor activity and purchase records, including media identifiers, event times, IP addresses, purchase details and payment identifiers.

Captomatic processes account and service billing data as controller under the Privacy Policy.

3. Details of processing

• Subject matter. Capture, storage, processing and delivery of media for the Customer's sites.
• Duration. For as long as the Customer has a site in the Service, plus the deletion period in section 10.
• Nature and purpose. Receiving and storing media, editing and encoding it as configured by the Customer, selecting capture moments, previewing and delivering media, managing paid or free access, and providing site activity and sales statistics.
• Data subjects. People captured by the Customer's devices, visitors who view, claim or buy a media set, and the Customer's staff who operate the devices.
• Data categories. The Customer Data listed in section 2. The Customer must not use the Service to process special categories of data under Article 9 GDPR other than what is incidentally visible in captured media.

4. Customer obligations

The Customer gives lawful instructions, establishes the lawful basis, provides notices and obtains required consent. It controls capture settings, including audio and face detection, and media retention. It protects account credentials and access links, deletes unneeded content and answers data subject requests, using available Service functions first.

5. Captomatic obligations

Captomatic:

• processes Customer Data only as documented in this DPA, in the Terms of Service and in the settings the Customer makes in the Service, unless EU or Latvian law requires otherwise. In that case Captomatic informs the Customer before processing, unless the law prohibits it;
• immediately informs the Customer if, in its opinion, an instruction infringes data protection law, and may suspend that instruction pending its clarification or correction;
• gives access to Customer Data only to personnel bound by confidentiality who need it to operate or support the Service;
• implements the technical and organisational measures in the Annex;
• assists the Customer through appropriate technical and organisational measures, insofar as possible, in responding to data subjects, taking into account the nature of the processing; and assists with obligations under Articles 32–36 GDPR, taking into account the nature of the processing and the information available to Captomatic;
• returns or deletes Customer Data as described in section 10;
• makes available the information necessary to demonstrate compliance with Article 28 GDPR, and allows audits as described in section 11.

The Customer first uses available functions and documentation. Where law permits, Captomatic may charge reasonable costs for additional assistance, notified in advance, except to remedy its own breach. Fees must not prevent GDPR compliance or delay legally required assistance. Work beyond this DPA and applicable law requires a separate agreement.

6. Subprocessors

The Customer gives general written authorisation for the listed Subprocessors and changes under this section. Captomatic selects providers offering sufficient data protection guarantees, imposes equivalent relevant obligations by written contract and remains responsible under Article 28(4) GDPR.

Captomatic updates that page and emails site owners before a proposed addition or replacement. The notice specifies the intended start date and an objection deadline allowing reasonable time to assess the change before processing starts. The Customer may object on data protection grounds by writing to the contact address in section 1 within that period.

If an objection cannot be resolved, either party may terminate the affected Service before the change applies, with return or deletion under section 10. Captomatic need not provide an alternative provider or customised service. No termination penalty applies; accrued charges remain payable. Without an objection by the deadline, Captomatic may proceed.

7. International transfers

The Customer instructs processing in the locations on the Subprocessors page and through integrations it connects, including outside the European Economic Area. Transfers for which Captomatic is responsible comply with Chapter V GDPR through an applicable adequacy decision or appropriate safeguards, with supplementary measures where required. Provider transfer terms are linked on that page.

8. Personal data breaches

Captomatic notifies the Customer without undue delay after becoming aware of a breach affecting Customer Data, using site owner contact details. It provides available information about the breach, affected data and people, likely consequences, response measures and a contact, with updates as information becomes available. The Customer handles notifications to authorities and data subjects; Captomatic does so on its behalf only by written agreement or where legally required.

9. Data subject requests

Captomatic forwards requests concerning Customer Data to the Customer without undue delay. It may direct the requester to the Customer, but otherwise responds only on the Customer's instructions or as required by law. Assistance follows section 5.

10. Return and deletion

Media and associated metadata are scheduled for deletion when retention expires or the Customer deletes them. Visitor access is revoked; physical removal follows through background cleanup. Purchase records remain until the delivery configuration is deleted and no longer serves purchases. Site statistics remain during the site's use; the Customer may instruct earlier deletion of personal data.

When processing ends, the Customer chooses return followed by deletion, or deletion alone. It should download available data and request any further return assistance before termination. Assistance follows section 5. Unless return is requested, the Customer instructs deletion. Captomatic deletes remaining Customer Data and copies without undue delay after processing ends, including personal data in site activity records. For a Data Act exit, the transition, retrieval and charge provisions in section 6 of the Terms of Service apply to Customer Data as well.

For Customer-connected storage, the Service deletes tracked files using supplied credentials. The Customer must keep these valid until cleanup completes and remove any remaining objects, versions or copies. Site deletion does not clear the entire connected storage.

Customer Data is retained after deletion only as required by EU or Latvian law.

11. Audits

Captomatic provides information necessary to demonstrate compliance with Article 28 GDPR on request, using existing documentation where sufficient. Where further verification is necessary, Captomatic allows and contributes to audits, including inspections, by the Customer or an independent auditor it appoints, subject to confidentiality and reasonable security safeguards protecting other customers' data.

Routine audits are limited to once in any 12 months, on at least 30 days' notice, during business hours and with disruption minimised. These limits do not apply where an audit is required by a supervisory authority, applicable law, or reasonable indications of non-compliance. The Customer bears its own audit costs, and Captomatic may charge reasonable costs of supporting the audit under section 5. Cost or procedural requirements must not prevent an effective audit.

12. Liability and term

Liability between the parties under this DPA is subject to the exclusions and aggregate limits in the Terms of Service, to the extent permitted by law. Claims under this DPA count towards the same aggregate limit as other claims under the Terms of Service. This does not limit data subjects' rights or liability that cannot lawfully be limited.

This DPA applies for as long as Captomatic processes Customer Data for the Customer. If it conflicts with the Terms of Service, this DPA prevails for the processing of personal data.

13. Governing law

This DPA is governed by Latvian law.

Annex: technical and organisational measures

Captomatic maintains the following measures, appropriate to the risks under Article 32 GDPR, and may update their implementation while meeting that standard.

• Hosting. Infrastructure is provided by the hosting and storage providers on the Subprocessors page, with physical access controls managed by those providers.
• Encryption in transit. Public Service endpoints and connections to the hosted storage, payment and email APIs use TLS. The Customer controls the endpoints of storage it connects.
• Encryption at rest. Hosted object storage encrypts stored media. Credentials for Customer-connected storage are encrypted in the database. Account password verifiers and Service authentication tokens are stored as hashes.
• Access and isolation. Tokens and site permissions restrict access to Customer Data. Production access is limited to authorised personnel bound by confidentiality and removed when no longer needed.
• Retention. Background jobs remove expired and deleted media under section 10.
• Resilience and monitoring. Failed workloads restart automatically; availability and errors are monitored.
• Abuse protection. The API applies rate limits. Visitor delivery tokens are scoped to a purchase and its media set.