Data Processing Addendum

Effective 13 October 2026 · Version 2026-10-13

1. Definitions

"Data Protection Law" means all laws that apply to the processing of Personal Data under the Terms, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP and the CCPA/CPRA. "Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Supervisory Authority" have the meanings given in the GDPR. "Customer Personal Data" means Personal Data that Baloka processes on Customer's behalf in providing the Service. "Sub-processor" means a third party engaged by Baloka to process Customer Personal Data.

2. Roles and scope

• For Customer Personal Data, Customer is the Controller, or a Processor acting for its own Controller, and Baloka is the Processor (or Sub-processor).
• Baloka is an independent Controller of account, billing and usage data about Customer's own users, as described in the Privacy Policy. This DPA doesn't cover that data.
• For the CCPA/CPRA, Baloka is a "service provider". It will not sell or share Customer Personal Data, keep, use or disclose it outside the direct business relationship with Customer, or combine it with other data except as the CCPA allows.

3. Customer instructions

Baloka processes Customer Personal Data only on Customer's documented instructions. The Terms, this DPA and Customer's use and configuration of the Service are those instructions. If Baloka believes an instruction breaks Data Protection Law, it will tell Customer. If the law requires Baloka to process data in another way, Baloka will tell Customer first, unless the law forbids it.

Customer is responsible for the lawfulness of the Customer Personal Data it provides, including having a lawful basis and giving any notices that are required, and for sending to the Service only the data needed to personalize images.

4. Confidentiality

Baloka ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality obligations.

5. Security

Baloka implements the technical and organizational measures in Annex 2, taking into account the state of the art, the cost of implementation and the risks of the processing. Baloka may update these measures if the overall level of protection doesn't decrease.

6. Sub-processors

• Customer gives general authorization for Baloka to engage Sub-processors. The current list is in Annex 3.
• Baloka will update this page, and will notify Customers who ask for notices by email, at least 14 days before it adds or replaces a Sub-processor. Within that period, Customer may object on reasonable data protection grounds. If the parties can't resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid, unused credits.
• Baloka imposes data protection obligations on each Sub-processor that are substantially as protective as those in this DPA, and it remains liable for its Sub-processors' performance.

7. Data subject requests and assistance

Taking into account the nature of the processing, Baloka will help Customer respond to Data Subjects' requests to exercise their rights. If Baloka receives a request directly, it will pass it to Customer and won't respond itself, unless Customer authorizes it to. Baloka will also give reasonable help with data protection impact assessments and prior consultations with Supervisory Authorities.

8. Personal data breaches

Baloka will notify Customer without undue delay, and in any event within 72 hours, after it becomes aware of a Personal Data breach affecting Customer Personal Data. The notice will include the information Customer reasonably needs to meet its own notification obligations. Baloka will take reasonable steps to contain and fix the breach.

9. Deletion and return

When the Service ends, Baloka will delete Customer Personal Data within 30 days, and it will leave backups within a further 30 days, unless the law requires Baloka to keep it. Before the Service ends, Customer can export its templates and content from the Service, or ask us for help.

10. Audits

Baloka will make available the information reasonably needed to show compliance with this DPA, for example written answers to security questionnaires and Sub-processors' certifications. If that isn't enough, or a Supervisory Authority requires it, Customer may audit once a year. Customer must give 30 days' notice, the audit must take place during business hours, it must be under confidentiality, and it is at Customer's cost.

11. International transfers

Where Customer Personal Data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). Module 2 applies where Customer is a Controller, and Module 3 where Customer is a Processor. The SCCs are incorporated by reference with these choices:

• Clause 7 (docking clause) applies.
• Clause 9: option 2, general authorization, with the notice period in section 6.
• Clause 11: the optional language doesn't apply.
• Clauses 17 and 18: the law and courts of Ireland.
• Annexes I and II are completed by Annexes 1 and 2 of this DPA.

For UK transfers, the UK International Data Transfer Addendum (version B1.0) applies, with the tables completed by the information above. For Swiss transfers, references to the GDPR are read as references to the FADP, and the Swiss FDPIC is the competent authority where the FADP applies. Where a recipient is certified under the EU–US Data Privacy Framework (or its UK or Swiss extensions), Baloka may rely on that certification instead.

12. General

If this DPA conflicts with the Terms, this DPA prevails on data protection matters. If the SCCs conflict with this DPA, the SCCs prevail. The limitations of liability in the Terms apply to this DPA as far as Data Protection Law allows.

Annex 1: Details of processing

Annex 2: Technical and organizational measures

• Encryption: TLS for all data in transit, and encryption at rest provided by our hosting, database and storage providers.
• Data minimization: personalization values and requester IP addresses are stored only as one-way (salted) hashes in view, rate-limit and error records. No raw user agents or precise location are stored.
• Access control: per-user authentication, row-level security in the database, server-side credentials kept in a secrets manager, and administrative access limited to named staff.
• Input safety: fetched URLs are validated against server-side request forgery (SSRF), and requests are rate-limited per client.
• Resilience: managed infrastructure with provider backups and redundancy.
• Vendor management: Sub-processors are chosen for their security posture and bound by data protection terms.
• Incident response: errors are logged and monitored, and the breach notification process in section 8 applies.

Annex 3: Sub-processors

These Sub-processors may process Customer Personal Data:

Providers that process only Baloka's own account and billing data, such as Stripe and Resend, are listed in the Privacy Policy.