Data Processing Agreement

This DPA applies when you upload content containing personal data of third parties to the Pablito Service (e.g., photographs of identifiable individuals). In this context, you act as the Data Controller and Pablito acts as your Data Processor. The Processor shall process personal data only on documented instructions from the Controller, solely for the purpose of providing the Pablito Service as described in the Terms of Service.

The Processor shall:

• Process personal data only on documented instructions from the Controller, unless required by EU or Spanish law
• Ensure that persons authorized to process personal data have committed to confidentiality
• Implement appropriate technical and organizational security measures as described in our Security Policy
• Not engage another processor without prior written authorization from the Controller (see Subprocessors page for current list)
• Assist the Controller in responding to data subject rights requests
• Assist the Controller in ensuring compliance with obligations under GDPR Articles 32–36 (security, breach notification, impact assessments)
• Delete or return all personal data upon termination of the Service, unless retention is required by law
• Make available all information necessary to demonstrate compliance and allow for audits

The Controller authorizes the Processor to engage the subprocessors listed at /legal/subprocessors. The Processor will notify the Controller at least 14 days before adding new subprocessors. The Controller may object to new subprocessors within this period. All subprocessors are bound by data processing agreements providing at least the same level of data protection as this DPA.

The Processor shall assist the Controller in fulfilling data subject requests (access, rectification, erasure, portability, restriction, objection) by providing appropriate technical and organizational measures. The Processor will promptly notify the Controller of any data subject requests received directly.

The Processor implements security measures appropriate to the risk, including: encryption of data in transit (TLS 1.3), secure password hashing (bcrypt), access controls and authentication, regular automated backups, and secure cloud infrastructure. Full details are available in our Security Policy at /legal/security.

The Processor shall notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of a personal data breach. The notification shall include: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to mitigate the breach.

Where personal data is transferred outside the EEA, the Processor ensures appropriate safeguards through Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions. See our Subprocessors page for the location of each processor.

Upon termination of the Service or this DPA, the Processor shall, at the Controller's choice, return or delete all personal data processed on behalf of the Controller within 90 days, unless retention is required by applicable law. The Controller may request data export in machine-readable format (JSON/CSV) before termination.

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. The Processor is liable for damage caused by processing that violates GDPR or this DPA. The Processor is not liable for damage caused by processing carried out in accordance with the Controller's instructions.

For questions about this Data Processing Agreement: legal@pablito.app Marie du Mesnil du Buisson, Llull 200, Barcelona 08005, Spain