Data processing agreement

1.1The parties

1.2What this agreement covers

This agreement governs Twirl's processing of personal data on the Organizer's behalf in connection with an event. That is principally guest data: names, RSVP responses, uploaded photographs, videos and voice memos, and the personal data of people depicted in that content.

It does not cover personal data for which Twirl is itself the controller, which is the Organizer's own account, billing and support data. That processing is governed by the Privacy Policy, not by this agreement.

1.3How it takes effect

This agreement forms part of the Terms of Service and takes effect when the Organizer accepts them. No separate signature is required. An Organizer who needs a signed counterpart, for example a wedding planner acting for a business client, can request one from hello@twirl.photos.

1.4Order of precedence

If this agreement conflicts with the Terms of Service on a matter of personal data processing, this agreement governs. If it conflicts with the Standard Contractual Clauses where those apply, the Standard Contractual Clauses govern.

Personal data, processing, controller, processor, subprocessor, data subject, personal data breach and supervisory authority have the meanings given in Article 4 of the GDPR.

GDPR means Regulation (EU) 2016/679, and where the Organizer or the data subjects are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 as applicable.

Applicable Data Protection Law means the GDPR and any national implementing law that applies, including the Dutch Uitvoeringswet AVG.

Services means the Twirl platform as described in the Terms of Service.

Subprocessor means a third party engaged by Twirl to process personal data on the Organizer's behalf.

• The Organizer is the controller. They determine the purposes and means of processing guest data: who is invited, what questions are asked, what content is kept, when the event ends.
• Twirl is the processor. It processes that data only to provide the Services and only on the Organizer's instructions.
• The Organizer warrants that it has a lawful basis for the processing it instructs, that it has provided any notices and obtained any consents required, and that its instructions do not require Twirl to breach Applicable Data Protection Law.
• The Organizer acknowledges that RSVP answers concerning meals and dietary requirements may constitute special category data under Article 9 of the GDPR, and is responsible for having a valid Article 9 condition where that is the case. Twirl's recommendation, recorded here so that it is on the record, is that dietary questions are never made mandatory.
• The Organizer acknowledges that content uploaded to an event will contain personal data of people who are not the uploader, including children, and is responsible for the lawfulness of that processing.

Required by Article 28(3). The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are set out in Annex 1.

Article 28(3)(a).

• Twirl processes personal data only on the Organizer's documented instructions, including on transfers to third countries, unless required to do otherwise by Union or member state law. Where such a legal requirement applies, Twirl will inform the Organizer before processing unless the law prohibits that notification on important grounds of public interest.
• The Terms of Service, this agreement, the configuration the Organizer sets in the dashboard, and the ordinary use of the Services constitute the Organizer's documented instructions. Additional instructions must be agreed in writing and may attract a reasonable charge if they require work outside the Services.
• Twirl will inform the Organizer if, in its opinion, an instruction infringes Applicable Data Protection Law. Twirl may suspend the affected processing until the instruction is withdrawn or amended.
• Twirl does not use personal data processed under this agreement for its own purposes. Specifically, it does not sell it, does not use it for marketing, and does not use it to develop or train machine learning or artificial intelligence models. Standing exception, disclosed for transparency. Twirl may act without waiting for the Organizer's instruction where content is manifestly unlawful, where it appears to have been uploaded without the consent of a person depicted, or where a takedown is legally required. Twirl will inform the Organizer when it does this. The Organizer accepts this as a term of the Services, and it is recorded here so that it is not later characterised as processing outside instructions.

Article 28(3)(b). Twirl ensures that anyone authorised to process personal data under this agreement is bound by an obligation of confidentiality, whether contractual or statutory, and that access is limited to those who need it to provide the Services or to meet a legal obligation. Access to production data is limited to the founders and is used for operational and support purposes only.

Article 28(2) and 28(4).

7.1General authorisation

The Organizer gives Twirl general written authorisation to engage subprocessors. The subprocessors engaged at the date of this agreement are listed in Annex 3 and maintained at where your photos live, which is the authoritative and current version.

7.2Terms imposed on subprocessors

Twirl imposes on each subprocessor, by written contract, data protection obligations no less protective than those in this agreement, and in particular the obligations required by Article 28(3). Twirl remains fully liable to the Organizer for the performance of each subprocessor's obligations.

7.3Notice of changes

Twirl will give at least 30 days' notice before adding or replacing a subprocessor. Notice is given by email to the Organizer's registered address and by updating where your photos live. Organizers can subscribe to change notifications from that page.

7.4Objection

• The Organizer may object to a new subprocessor on reasonable data protection grounds, in writing to privacy@twirl.photos, within 30 days of the notice.
• Twirl will work in good faith to address the objection, which may mean explaining safeguards, applying additional measures, or where practicable offering an alternative configuration.
• If no resolution is reached within 30 days of the objection, the Organizer may terminate the affected event or the account, and Twirl will refund the unused portion of any window already paid for on a pro rata basis.
• Twirl acknowledges that at its scale it cannot always offer an alternative provider, and that termination with a pro rata refund will sometimes be the only available remedy. Saying so plainly here is preferable to promising flexibility that does not exist.
• Where a change is urgent and necessary for security, Twirl may implement it before the notice period expires, and will inform the Organizer as soon as possible. The objection right still applies afterwards.

Article 28(3)(a) and Chapter V.

• Media storage and the database are both located in Frankfurt, Germany. Neither involves a transfer outside the European Economic Area and neither requires a transfer mechanism. The current locations are stated in Annex 3.
• Twirl commits not to move media storage outside the European Economic Area. Any change of storage provider will remain within the EEA and will be notified under section 7.3.
• Where a subprocessor with a parent company outside the EEA may access data, Twirl relies on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, and on the provider's certification under the EU-US Data Privacy Framework where held.
• For Organizers or data subjects in the United Kingdom, the UK International Data Transfer Addendum applies to those Standard Contractual Clauses.
• Twirl will assist the Organizer in carrying out a transfer impact assessment where one is required, and will provide the information reasonably needed to complete it.
• Copies of the relevant transfer mechanisms are available on request to privacy@twirl.photos. Commercial terms may be redacted.

Article 28(3)(c) and Article 32. Twirl implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing. Those measures are described in Annex 2.

Twirl may update the measures over time provided the level of protection is not reduced.

Article 28(3)(f) and Article 33(2).

• Twirl will notify the Organizer without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting personal data processed under this agreement.
• The notification will describe, so far as known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for further information. Where the full picture is not yet available, Twirl will provide information in phases rather than waiting.
• Twirl will assist the Organizer in meeting its own obligations under Articles 33 and 34, including any notification to a supervisory authority or to affected data subjects.
• Twirl will not notify a supervisory authority or data subjects on the Organizer's behalf unless the Organizer instructs it to, or unless Twirl is independently required to do so as a controller in its own right.
• Twirl maintains an internal record of breaches, including those not requiring notification.

11.1Data subject rights

Article 28(3)(e). Twirl will assist the Organizer, by appropriate technical and organisational measures and insofar as possible, in responding to requests to exercise data subject rights. In practice:

• The dashboard allows the Organizer to search, view, correct, export and delete guest data directly, which resolves most requests without involving Twirl at all.
• Where a data subject contacts Twirl instead of the Organizer, Twirl will not respond substantively on the Organizer's behalf. It will pass the request to the Organizer without undue delay and support them in answering it, subject to the standing exception in section 5.
• Twirl does not charge for this assistance at ordinary volumes.

11.2Data protection impact assessments

Article 28(3)(f). Twirl will provide reasonable assistance with data protection impact assessments and prior consultations under Articles 35 and 36, taking into account the nature of the processing and the information available to it.

11.3Audits

Article 28(3)(h). Twirl will make available to the Organizer all information necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits.

• In the first instance Twirl will satisfy this by providing documentation: this agreement, the subprocessor list, Annex 2, the Privacy Policy, and written answers to a reasonable security questionnaire.
• Where that is genuinely insufficient for the Organizer to meet a regulatory obligation, an audit may be carried out no more than once in any 12 month period, on 30 days' written notice, during business hours, subject to confidentiality, and in a manner that does not disrupt the Services or compromise other customers' data.
• The Organizer bears its own audit costs and Twirl's reasonable costs of participation, unless the audit reveals a material breach by Twirl.
• Twirl notes plainly that it is a two person company, that it does not hold ISO 27001 or SOC 2 certification, and that it does not intend to claim otherwise. Organizers with formal certification requirements should factor that in before purchasing.

Article 28(3)(g).

• At any time during the event window, the Organizer can export guest and RSVP data as a spreadsheet and download all content in bulk, without needing to ask.
• On expiry or termination of the event window, Twirl deletes all personal data processed under this agreement, in accordance with the window and end-of-window paths described in the Terms of Service.
• Deletion covers media objects at the storage provider and the corresponding database records. Encrypted backups may retain residual copies until they rotate out, currently within 30 days, during which they are not accessed except for disaster recovery.
• Twirl retains no personal data after that point except where Union or member state law requires retention, principally billing records under Dutch tax law, which are Twirl's own controller data rather than guest data.
• Twirl will confirm deletion in writing on request.

This agreement takes effect when the Organizer accepts the Terms of Service and continues for as long as Twirl processes personal data on the Organizer's behalf. Sections 6, 10, 12 and 14 survive termination for as long as is necessary to give them effect.

• Each party's liability under this agreement is subject to the limitations in the Terms of Service, except where those limitations are not permitted by law.
• Nothing in this agreement limits either party's liability to a data subject under Article 82 of the GDPR, which cannot be contracted away.
• Where both parties are responsible for damage caused by processing, liability is apportioned according to each party's responsibility, as provided in Article 82(5).
• Nothing here limits liability for intent or deliberate recklessness, or for anything else that cannot lawfully be limited.

This agreement is governed by the law of the Netherlands. Disputes are subject to the jurisdiction provisions in the Terms of Service. Where the Standard Contractual Clauses apply to a particular transfer, their own governing law and jurisdiction provisions govern that transfer.

Data protection matters, including subprocessor objections and audit requests: privacy@twirl.photos.

Required by Article 28(3).

Article 32. A summary rather than an exhaustive description, since a complete description of security measures is itself a security risk.

Current as at 19 August 2026. The authoritative and current version is maintained at where your photos live, and the full standalone list carries additional detail.

Media and database are both in Frankfurt, Germany. Any future change of subprocessor will be notified under section 7.3 with the full 30 day notice period, and the published list will be updated before the change takes effect. Media storage will not be moved outside the European Economic Area.