Data Processing Agreement (DPA)

Effective Date: [21/11/2025]

  1. Parties

This Data Processing Agreement (“DPA”) is entered into between:

Controller: SP 3SIXTY EYE DIGITAL MEDIA LIMITED, Nicosia
Processor: Moments Photography by 3SixtyEye, operated by SP 3SIXTY EYE DIGITAL MEDIA LIMITED

  1. Purpose of Processing

This DPA governs the processing of personal data by the Processor on behalf of the Controller for the purpose of providing photography, videography, and digital content services.

  1. Data Types and Categories of Data Subjects
  • Personal Data: Names, contact information, event details, photos/videos, payment information.
  • Data Subjects: Clients, event participants, website visitors, subscribers.
  1. Roles and Responsibilities
  • Controller: Determines the purposes and means of processing personal data.
  • Processor: Processes personal data only on documented instructions from the Controller and in compliance with GDPR and Cyprus data protection laws.
  1. Obligations of the Processor

The Processor agrees to:

  • Process personal data only for the purposes described in this DPA.
  • Maintain confidentiality and restrict access to authorized personnel only.
  • Implement appropriate technical and organizational measures to ensure data security.
  • Notify the Controller without undue delay in case of a personal data breach.
  • Assist the Controller in responding to data subject rights requests.
  • Maintain records of processing activities and make them available to supervisory authorities if requested.
  1. Subprocessors
  • The Processor may engage subprocessors only with prior written consent from the Controller.
  • Subprocessors must comply with GDPR and Cyprus data protection laws.
  • The Processor remains fully liable for the actions of subprocessors.
  1. International Transfers
  • Any transfer of personal data outside the EEA must comply with GDPR requirements, e.g., via Standard Contractual Clauses (SCCs) or countries with an adequacy decision.
  1. Duration and Termination
  • This DPA remains effective for the duration of the services provided.
  • Upon termination, the Processor shall return or securely delete all personal data at the Controller’s discretion.
  1. Liability
  • Both parties shall comply with applicable data protection laws.
  • Liability is limited to direct damages resulting from breach of this DPA.
  1. Governing Law
  • This DPA is governed by the laws of Cyprus and applicable EU regulations.
  • Competent courts of Cyprus shall have jurisdiction over disputes arising from this DPA.
  1. Contact Information

Controller: SP 3SIXTY EYE DIGITAL MEDIA LIMITED, Nicosia
Processor: Moments Photography by 3SixtyEye / SP 3SIXTY EYE DIGITAL MEDIA LIMITED
Email: [email protected]

By signing this agreement, the Controller and Processor acknowledge and agree to the terms outlined in this DPA.