Proposed Data Processing Agreement — not yet available for acceptance. This document sets out a framework for business customers that need Studimage to process personal information in images on their instructions. Customer details, safeguards and any required contractual transfer arrangements must be completed and agreed before this proposal becomes a binding DPA. Ordinary website use does not execute this draft.
1. Parties and roles
The proposed processor is Abellatif Oulla, an individual operating as Studimage, at the address below. The customer must be identified by its legal name, address and authorised representative in the agreed contract. For customer-controlled image content, the customer determines the purpose of processing and Studimage carries out the instructed background removal. Studimage separately handles its own account, billing and support administration as described in the Privacy Policy.
2. Processing schedule
- Subject matter: receiving images, transmitting them to an approved background-removal provider, generating PNG results and making results available for download.
- Purpose: delivering the customer’s requested image editing.
- Duration: the agreed service period plus the expressly agreed deletion or return period.
- People concerned: individuals depicted in, or identifiable from, the customer’s submitted images and metadata.
- Data: image content, metadata and related identifiers necessary for the processing request.
- Sensitive data: not intended for the standard service; any permitted special-category processing requires a separate risk assessment and written terms.
3. Documented instructions
Once executed, Studimage will process customer personal information only on lawful documented customer instructions, including the agreed processing schedule and instructions for transfers or deletion. Studimage will tell the customer if it considers an instruction unlawful and notify the customer of legally compelled processing where permitted. The customer remains responsible for its lawful basis, transparency and upload permissions.
4. Confidentiality and security schedule
Once executed, Studimage will limit authorised access to persons subject to confidentiality obligations and maintain appropriate technical and organisational safeguards documented in the agreed security schedule. The current theme has authenticated processing requests, request-verification tokens and upload validation, but stores generated PNG files at randomised public URLs. These links are not authenticated private storage. HTTPS, backup security, administrator controls, logging, incident response and any encryption-at-rest configuration require deployment verification. No SOC 2, ISO certification or encryption standard is asserted here.
5. Sub-processors
Before execution, the customer must receive the named vendor register, processing purposes, locations and relevant contracts. Under an executed DPA, Studimage will obtain the agreed authorisation for sub-processors, bind them to appropriate written processing obligations, remain responsible for their performance of the delegated obligations, and provide advance notice and an opportunity to object as specified in the signed schedule. The Sub-processors page identifies Namecheap VPS hosting in the USA, remove.bg (Canva Austria GmbH), Google/Gmail SMTP, Mailchimp and PayPal. Their classification depends on the processing role; PayPal’s independent payment processing is not automatically customer-controlled image processing.
6. Personal-data incidents
Once executed, Studimage will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data and provide available information about the incident, affected data, likely consequences, mitigation and a contact point. Any reporting channels and response commitments must be supported by an operational incident procedure. This draft does not substitute a fixed 72-hour processor deadline for applicable legal obligations.
7. Assistance and verification
Once executed, Studimage will assist the customer with individual rights requests, security obligations, impact assessments and regulator consultation where applicable, taking account of the processing and available information. Studimage will make available information and allow proportionate audits necessary to demonstrate compliance under agreed confidentiality and practical arrangements. No third-party audit report is represented as available.
8. International transfers
Identify each transfer, destination, role and legally required safeguard before processing begins. Where required, complete and execute the relevant transfer instruments and annexes and address Moroccan transfer requirements. Merely referring to European Standard Contractual Clauses or a UK addendum does not execute them or complete their schedules.
9. Return and deletion
Once executed, Studimage will return or delete customer personal information at the customer’s choice when processing ends, except where retention is legally required. The signed schedule must document how vendor copies, backups, retained legal records and deletion confirmation will be handled. Theme cleanup targets generated files older than 24 hours when WordPress scheduling runs; it is not a verified end-to-end deletion guarantee. Customers must download results promptly and arrange any additional requirements before upload.
10. Execution and priority
A completed DPA must identify its effective date, the parties’ acceptance, applicable law, liability provisions and its priority in a conflict with the service terms for personal-data processing. Any transfer annexes and security schedules must be attached or properly incorporated. No customer should rely on this incomplete framework to satisfy a required processing agreement.
Request a completed DPA
Email [email protected] with your organisation’s legal name, address, intended use, categories of images and applicable processing requirements. Please do not upload customer personal information while a required agreement remains outstanding.
Contact Studimage
Operator: Abellatif Oulla, trading as Studimage.
8 DERB BORJ MOUKA, SAFI, MOROCCO.
Email: [email protected]
Telephone: 0783067693 (Morocco).