Data Processing Agreement

Version 2026-10-16.1. Effective for a customer only on affirmative acceptance of the identified Service Terms and this DPA. Publication or an existing account does not record acceptance.

1. Parties, application and definitions

This DPA forms part of the Castframe Service Terms, version 2026-10-16.1, between the customer identified in the acceptance record (Customer) and Theo Pantazi, trading as Castframe, of Tagliaferro Business Center, High Street, Sliema, Malta SLM 1549 (Castframe). It takes effect upon Customer's affirmative acceptance of the identified Agreement and DPA. It applies to personal data Castframe processes on Customer's behalf in providing the creative service (Customer Personal Data).

Data Protection Laws means the GDPR and other applicable data-protection law. Controller, processor, personal data, processing, personal data breach and supervisory authority have their applicable GDPR meanings. A Subprocessor is a processor Castframe engages to carry out relevant processing of Customer Personal Data on the Customer's behalf.

Customer is the controller, or a processor authorized by its controller to appoint Castframe as a further processor. Where Customer is a processor, it must have the required instructions and authorization; references to assistance for Customer include assistance it needs for that controller. This DPA covers Customer Personal Data in customer content, including uploaded images, Campaign text and exports. Account administration, billing and trial data processed by Castframe as controller are covered by the Privacy Policy.

2. Processing and documented instructions

Castframe will process Customer Personal Data only on documented instructions from Customer, including instructions concerning international transfers, unless EU or Member State law requires otherwise. Where such law requires processing, Castframe will inform Customer of the legal requirement before processing unless the law prohibits this on important grounds of public interest.

The Agreement, this DPA, supported Customer settings and deliberate requests to save, render, export or generate content document the ordinary instructions within Schedule A. Additional instructions can be provided through privacy@castframe.app by an authorized Customer contact. Castframe will verify authority and clarify instructions that exceed the agreed service. Later lawful instructions remain possible through this process. Castframe will immediately inform Customer if, in its opinion, an instruction infringes applicable EU or Member State data-protection provisions, and will not carry out unlawful processing.

Customer is responsible for the lawful basis, transparency, rights and instructions for the personal information it supplies, including any third-party content. The service does not require special-category data or criminal-offence information for its ordinary creative functions; any proposed intentional processing of those categories requires a specific suitability/instructions assessment. This is not evidence that automatic content screening exists.

3. Confidentiality and security

Castframe will ensure that persons authorized to process Customer Personal Data are committed to confidentiality or subject to an appropriate statutory confidentiality obligation. Access must be limited to the authorized purposes and personnel who need it.

Taking account of the state of the art, implementation costs, the nature/scope/context/purposes and risks, Castframe will implement appropriate technical and organizational measures under Article 32, including as appropriate confidentiality, integrity, availability, resilience, restoration and regular assessment of controls. Schedule B describes the product measures and current recovery limits.

4. Subprocessors and change procedure

Subject to Schedule C, Customer provides general written authorization for the listed Subprocessors for their stated processing. A service may support both controller and processor purposes; authorization under this DPA concerns only the latter. No authorization is inferred for an unidentified entity or unsupported location/transfer assertion.

For an addition or replacement appointed directly by Castframe, Castframe will send the proposed entity, purpose, locations, safeguards and intended start date to Customer's designated service/privacy contact at least 30 calendar days before processing begins. Customer may object on reasonable data-protection grounds within 10 calendar days of notice. Castframe will assess and discuss an objection and seek an available compliant alternative. A page edit alone is not notice.

For a change within an existing provider's downstream chain, Castframe will forward relevant notice promptly, aiming within one working day of receipt, and explain the upstream timetable. Customer has the same 10-day opportunity unless it agrees another meaningful period. An upstream five-day objection deadline does not shorten Customer's rights or make an unresolved objection ineffective. Castframe will raise a substantiated concern upstream within the available supplier window where warranted. Where sufficient prior opportunity or resolution cannot be provided, it will prevent affected processing from beginning or continuing until resolved.

If no compliant alternative resolves a reasonable objection, Customer may terminate the affected service before the disputed processing begins, receive unused prepaid fees for the affected period under the Service Terms, and choose return or deletion. This creates no emergency bypass or waiver of mandatory rights.

Castframe will impose by binding contract the same relevant data-protection obligations on each Subprocessor, in particular sufficient guarantees for appropriate technical and organizational measures. Where a Subprocessor fails to fulfill its obligations, Castframe remains fully liable to Customer for the performance of those obligations as Article 28 requires. The applicable incorporated provider agreements and safeguards are described in Schedule C.

5. International transfers

Castframe will make relevant international transfers only in accordance with Customer's documented instructions and applicable transfer rules. Schedule C identifies the relevant recipients, locations and contractual safeguards. Where standard contractual clauses are needed, Castframe will identify the applicable parties, module and annexes and make relevant supporting assessment information available under this section.

The Commission lists UK adequacy and adequacy for participating US EU–US Data Privacy Framework organizations. A US recipient is not automatically covered. Primary storage location does not exclude support or onward access elsewhere. Customer may request relevant safeguards and supporting assessment information through privacy@castframe.app, subject to necessary redactions that preserve the information obligation. Provider-held transport/at-rest encryption does not exclude provider access during readable processing.

6. Assistance, rights and legally required processing

Taking account of the nature of the processing, Castframe will assist Customer through appropriate technical and organizational measures, insofar as possible, with requests under GDPR Chapter III. For a request concerning Customer-controlled content, Castframe will notify Customer and coordinate assistance rather than deciding the controller's substantive response without instruction, unless law requires it. Requests concerning Castframe's own controller processing are handled directly under the Privacy Policy.

Taking account of the nature of processing and information available to it, Castframe will assist Customer in complying with Articles 32–36, including security, breach notification, data-protection impact assessments and prior consultation. Assistance will include relevant available information about the service and its safeguards. The privacy contact is privacy@castframe.app and general support is support@castframe.app; this is not a promise of a staffed 24-hour incident desk.

Castframe aims to acknowledge ordinary requests within two working days and establish an action plan within seven calendar days. Urgent needs and legal deadlines take precedence; these targets do not postpone action or reset a response clock. Ordinary available assistance is included. Exceptional bespoke expense requires prior agreement and cannot obstruct mandatory duties.

7. Personal data breaches

Castframe will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notice is not postponed until a breach is labeled “confirmed,” an investigation finishes or a fixed 72-hour window elapses.

To the extent available, the notice will describe the nature of the breach; categories and approximate numbers of affected data subjects and records; a contact for further information; likely consequences; and measures taken or proposed to address and mitigate it. Information may be provided in phases without undue further delay. Castframe will cooperate with Customer's assessment, mitigation and applicable notification duties and retain appropriate incident facts.

Customer remains responsible for its own supervisory-authority/data-subject notification obligations where it is controller. The controller's qualified Article 33 supervisory-authority deadline is distinct from Castframe's processor notice.

8. Information and audits

Castframe will make available all information necessary to demonstrate compliance with its Article 28 obligations and allow for and contribute to audits, including inspections, by Customer or an auditor mandated by Customer. The parties will arrange appropriate confidentiality, security and reasonable notice to protect other customers and systems, without using those arrangements to defeat statutory audit rights or urgent supervisory requirements. A general compliance certificate or unrestricted access to other customers' content is not promised.

Ordinarily the parties arrange scope and timing with 10 working days' notice, beginning with relevant records or remote review where sufficient. Urgent incidents, supervisory requirements or a justified need for earlier inspection take precedence. No hard annual limit or certificate-only substitute applies.

9. End of processing; return or deletion

At the end of the relevant processing services, Castframe will, at Customer's choice, return or delete Customer Personal Data, and delete existing copies unless EU or Member State law requires retention. The parties will document the selected scope, supported secure return format/method, completion steps and any specific legally required retention. Retained information must be limited to the applicable purpose and duration and protected from unrelated use.

Saved Customer content is retained for the instructed service while the account remains open, until selected deletion or the end of relevant processing. There is no automatic dormant-content purge. Castframe will act without undue delay and aim to finish ordinary active-system cleanup within 14 calendar days of a clear, sufficiently verified Customer instruction. Where Customer chooses return, Castframe will arrange readable structured data and original source files through a verified secure method before destructive deletion, with an agreed retrieval/deletion sequence. A Customer-instructed timetable does not waive applicable duties or create automatic waiting periods. This is an ordinary active-cleanup target, not an all-provider physical-erasure guarantee.

The end of relevant processing services is not simply cancellation of subscription renewal, the end of a trial or paid expiry. Those events currently preserve saved work for viewing. Customer can separately request closure or select creative material for deletion through the available paths and support.

Return must be arranged before destructive deletion where chosen. A PNG/HTML5 creative export is not necessarily a complete return of Customer Personal Data. Browser copies and downloaded files in Customer's possession are outside server cleanup; Castframe must accurately describe which service/provider copies and any backups remain, on what legal basis and for how long. Provider backup restrictions cannot be invented as a legal exception or a perpetual right to retain.

Castframe will report the scope actually completed and identify pending copies, recovery-copy handling and any specific legal hold. Recovery must not reintroduce deleted content into active processing.

10. Agreement integration

This DPA prevails over the Service Terms for its processing subject matter; mandatory law prevails over inconsistent terms. Data-protection obligations continue for retained Customer Personal Data until its lawful disposal. Changes require an appropriate documented agreement/notice process. Silence or account existence does not establish Customer acceptance.

Schedule A — processing details

Schedule B — security and recovery measures

Authenticated, email-confirmed users and owned Campaign/source paths are checked by server operations. Database role restrictions and row-level policies limit direct client reads/writes. Private source buckets and private R2 objects separate originals from temporary delivery. Server credentials are not supplied to the renderer or customer browser.

HTML5 renders use a validated owned snapshot, bounded work and a fresh browser context with network requests/service workers blocked. Completed export delivery lasts twenty-four hours; signed links last at most five minutes and never exceed the remaining delivery period. Scheduled cleanup and a two-day R2 lifecycle fallback remove temporary objects. Logical expiry and physical erasure are distinct.

Account closure restricts new content writes and export admission/finalization across both billing modes, including stale-session paths. The operator inventories source objects, export jobs, keys and upload/export leases, waits for reserved work to settle, removes bytes through supported provider APIs and re-lists before eligible metadata/Auth removal. Interrupted cleanup retains retry locators. Financial/trial controller records and unrelated/shared sources are separately protected. Previously issued links, provider caches, logs, recovery copies and customer downloads require their separate handling; no instantaneous all-copy erasure claim is made.

HTTPS protects service/provider transport. Provider-managed at-rest protection does not exclude provider/authorized-operator access during readable processing. Return bundles use authenticated encryption with separately communicated keys and verified owner/scope/file integrity. Device/browser memory, localStorage and customer downloads have their stated limits.

Theo Pantazi is responsible for necessary privileged access, confidentiality, quarterly/change-triggered access review, incident handling and Customer notices. Sole-owner administrative access and MFA/2-Step Verification for Supabase, Vercel, Cloudflare and Workspace are owner-confirmed. Additional personnel require confidentiality and least privilege before access. No complete administrative audit trail, staffed round-the-clock security desk or certification is promised.

Weekly owner-device backups to a dedicated unshared Workspace Drive folder cover the database and current referenced uploaded original images, logos and fonts. Generated images/exports, R2, thumbnails, temporary files and caches are excluded. The last five completed weekly sets are retained, with older sets deleted without Drive trash and local working copies removed after verified upload. Timely rotation is about thirty-five days; Workspace administrator recovery may add up to twenty-five days. Missed runs/rotation failure, Google internal deletion and lawful holds have separate effects. No specific Drive region, fixed all-copy deletion bound, PITR entitlement or recovery-time commitment is promised.

The first archive, independent integrity check, isolated database/original-byte restoration and immediate scheduled-task execution were verified on 16 October 2026. This was a scoped recovery exercise, not a full service cutover. The scheduled owner-device task requires a signed-in session; a locked session is supported. Deletion restrictions and minimal manifests must be reapplied before restored data becomes accessible. Customer should keep its own original assets and desired exports; this does not limit Castframe's return/deletion duties.

Schedule C — appointed Customer-content subprocessors

• Supabase Pte. Ltd., Singapore: saved Campaign/database records and private source files, primary project London, UK, with relevant global support/operational/CDN handling. Standard terms incorporate the Supabase DPA and applicable processor-to-subprocessor SCC Module Three, with UK provisions where relevant. Supabase DPA.
• Vercel Inc., United States: content APIs, hosting and HTML5 rendering. Functions configured for London, with global delivery/support/operations possible. Vercel Pro terms incorporate the DPA, applicable SCC Module Three and UK addendum. Vercel DPA.
• Cloudflare, Inc., United States: temporary completed HTML5 packages and delivery through R2, configured Western Europe, with relevant global support/onward processing. Self-Serve terms incorporate the DPA and Developer Platform/R2 terms, including applicable processor-to-subprocessor transfer clauses and UK provisions. Cloudflare DPA.
• Google Cloud EMEA Limited, Ireland (Google Workspace; standard contracting entity for Malta under Google's contracting-entity schedule): Customer-content assistance correspondence and protected weekly database/selected-original recovery copies in Gmail/Drive. No specific Drive region is confirmed; processing may occur at Google/subprocessor facilities under the accepted agreement. The Cloud Data Processing Addendum was accepted on 15 October 2026; its applicable SCC/UK and provider-deletion provisions govern. Google contracting entities, Google CDPA.

Account, billing, trial, analytics and consent administration have separate controller purposes and are not included in this Customer-content appointment list. OpenAI is a Customer-contracted, Customer-directed service: Customer directs Castframe's selected request transmission under its own key; Castframe's own instructed handling remains covered by this DPA. The key is currently stored as text in browser-wide localStorage and transits Castframe's API; no account isolation, zero-retention or EU-only promise is made.

Customer may request relevant safeguards, supplier identity details and supporting transfer information through privacy@castframe.app. Authorizations and any unresolved objection follow section 4; a public page alone does not record Customer acceptance or authorize an unidentified new recipient. | Customer rights/obligations | Determine lawful purposes and basis, provide lawful instructions, manage subject notices/requests and choose return/deletion; Castframe's assistance does not replace the controller's responsibility |