Data Processing Agreement
pursuant to Art. 28 GDPR · Version 1.0 · November 1, 2026
between
the Customer (the studio that accepted the Terms of Service of The Black Line) — "Controller"
and
Roberto Panciatici, trading as The Black Line, Germany, VAT ID DE315901832 — "Processor"
1. Subject and duration
1.1 This Agreement governs the processing of personal data by the Processor on behalf of the Controller when providing The Black Line (the "Service") under the Terms of Service (the "Main Agreement"). Subject, nature, purpose, types of data and categories of data subjects are set out in Annex 1.
1.2 This Agreement applies for as long as the Processor processes personal data for the Controller, including the read-only period and deletion after the Main Agreement ends.
1.3 This Agreement does not cover data for which the Processor is itself the controller (studio accounts, billing, website); that is described in the Privacy Policy.
2. Instructions
2.1 The Processor processes personal data only on documented instructions from the Controller, including regarding transfers to third countries, unless required to do so by EU or member state law; in that case the Processor informs the Controller before processing, unless the law prohibits it.
2.2 The Main Agreement, this Agreement and the Controller's use and configuration of the Service (for example sending a contract, approving an email, connecting an integration, deleting a client) are the Controller's complete instructions. Further instructions must be in writing or text form (email).
2.3 The Processor informs the Controller without delay if it believes an instruction infringes data protection law; it may suspend that instruction until confirmed or changed.
3. Controller's responsibilities
3.1 The Controller is solely responsible for the lawfulness of the processing, in particular for having a legal basis for the data it enters, for informing its clients (Art. 13 and 14 GDPR) with its own privacy notice, and for the content of the contracts, questionnaires and emails it sends.
3.2 The Controller does not enter special categories of personal data (Art. 9 GDPR) unless strictly necessary and appropriately protected, and does not store payment card numbers or passwords of its clients in the Service.
3.3 The Controller informs the Processor without delay of errors or irregularities it detects in the processing.
4. Confidentiality
The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access personal data only to the extent needed for their tasks (for example, a support request from the Controller).
5. Security of processing
5.1 The Processor implements the technical and organisational measures in Annex 2 (Art. 32 GDPR). They take into account the state of the art, costs, and the nature, scope, context and purposes of processing and the risks for data subjects.
5.2 The measures may be updated as technology develops, provided the level of protection is not reduced. Significant changes are documented and made available to the Controller.
6. Sub-processors
6.1 General authorisation. The Controller authorises the Processor to engage the sub-processors listed in Annex 3 and on the Subprocessors page.
6.2 Changes. The Processor informs the Controller by email to the studio owner at least 30 days before adding or replacing a sub-processor, stating its name, purpose and location. The Controller may object on reasonable data-protection grounds within 14 days of the notice. The parties will try in good faith to find a solution; if none is found, the Controller may terminate the affected part of the Main Agreement with effect from the change and receives a pro-rata refund of prepaid fees. In an emergency (for example the sudden failure of a provider) the notice may be shorter; the Processor then explains why.
6.3 Same obligations. The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those in this Agreement, in particular sufficient guarantees for appropriate technical and organisational measures. The Processor remains fully liable to the Controller for the performance of its sub-processors' obligations.
6.4 Not sub-processors. The following are not sub-processors: services that the Controller connects and that act as independent controllers or as the Controller's own processors (for example the Controller's email provider, its Stripe or PayPal account, Google Calendar, MailerLite, or an AI assistant the Controller connects through MCP or the API); providers of ancillary services without access to personal data (for example public exchange-rate sources, telecommunications).
7. Transfers to third countries
7.1 Personal data is stored on servers in the European Union (Germany), including backups. Processing outside the EU/EEA takes place only through the sub-processors listed in Annex 3 and under the conditions of 7.2.
7.2 A transfer to a country outside the EU/EEA, including remote access, takes place only if the requirements of Art. 44 et seq. GDPR are met: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses (Commission Decision (EU) 2021/914), with supplementary measures where needed. Annex 3 states the safeguard for each sub-processor.
8. Assistance to the Controller
8.1 Data subject requests. Taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects (Art. 15–22 GDPR). The Service provides functions to view, correct, archive and delete client data; a complete copy of a client's data in a machine-readable format is provided on request within the time the Controller needs to meet its own deadline. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without delay and does not answer it on its own.
8.2 Other obligations. The Processor assists the Controller with Art. 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the information available to it.
8.3 Assistance that goes beyond the functions of the Service and is not caused by a breach of the Processor may be charged at reasonable cost, agreed in advance.
9. Personal data breaches
9.1 The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, by email to the studio owner.
9.2 The notification contains, as far as available: the nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact point. Information not yet available is provided in stages.
9.3 The Processor takes the measures needed to secure the data and mitigate possible adverse consequences, documents every breach, and supports the Controller in its notification to the supervisory authority (Art. 33 GDPR, 72 hours) and to data subjects (Art. 34 GDPR).
10. Deletion and return
10.1 During the term, the Controller can delete personal data with the functions of the Service and download signed contracts as PDF. On request, the Processor provides a copy of all personal data of the Controller in a structured, commonly used and machine-readable format within 30 days.
10.2 After the end of the Main Agreement, the Service remains available read-only for 90 days, during which the Controller may request the copy under 10.1. The Processor then deletes all personal data of the Controller from its systems, informs the Controller at least 14 days in advance, and confirms deletion in writing on request. Copies in backups are deleted when those backups are overwritten in their regular cycle; until then they are protected and used only to recover from a technical failure.
10.3 Retention by the Processor beyond this is permitted only where EU or member state law requires it.
11. Audits and information
11.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR, in particular this Agreement, Annex 2 and its current sub-processor list, and answers written questions once a year without charge.
11.2 The Controller (or an auditor bound to confidentiality and not a competitor of the Processor) may carry out an on-site audit if the information under 11.1 is not sufficient, after a breach, or if a supervisory authority requires it, with at least 30 days' notice, during business hours and without disrupting operations. Each party bears its own costs, unless the audit reveals a material breach by the Processor.
12. Liability
Liability is governed by Art. 82 GDPR. Within the parties' relationship, the limitations of the Main Agreement apply, except where the GDPR does not allow them.
13. Final provisions
13.1 In case of conflict regarding the processing of personal data, this Agreement prevails over the Main Agreement.
13.2 This Agreement is governed by German law. Place of jurisdiction is Berlin.
13.3 Amendments require text form. The Processor may update this Agreement where required by law or to reflect new sub-processors under section 6; section 12 of the Terms of Service applies.
Annex 1 — Description of the processing
| Subject and purpose | Providing a client management service for photography and video studios: managing clients and bookings, preparing and electronically signing contracts, collecting client data and questionnaire answers, planning payments and recording receipts, issuing invoices, sending emails from the studio, a client portal (Client Lounge), calendar, contact forms, automations and, if enabled, AI-assisted drafting |
| Nature | Collection, recording, organisation, storage, adaptation, retrieval, use, disclosure by transmission (emails to the Controller's clients, PDFs), restriction, erasure |
| Data subjects | The Controller's clients and prospects (couples, families, companies and their contact persons); their guests or family members named in questionnaires; the Controller's suppliers and collaborators (wedding planners, venues, second shooters, assistants); visitors who submit the Controller's contact forms |
| Types of personal data | Identification and contact data (names, email, phone, postal and billing address, language); date of birth where the Controller asks for it; booking data (dates, places, timeline, package, price); contract data (contract text, signature name, email code verification, timestamp, IP address and user agent at signature); payment data (instalments, amounts, method, receipts; no card numbers); questionnaire answers and notes; photos and files uploaded by the Controller; consents and their withdrawal; email content and delivery status; event log entries |
| Special categories | Not intended. Questionnaires may reveal information such as dietary needs or religious ceremonies if the Controller asks for them; the Controller is responsible for this (section 3.2) |
| Duration | Term of the Main Agreement plus the period in section 10 |
| Place of processing | Germany (Hetzner, Falkenstein) |
Annex 2 — Technical and organisational measures (Art. 32 GDPR)
Status November 1, 2026. This annex describes the measures in place on that date; new measures are added in a new version.
Confidentiality
- Physical access: servers in data centres operated by Hetzner Online GmbH in Germany, with access control by the operator; no own premises with personal data.
- System access: individual accounts; passwords stored only as hashes; sign-in with email and password or Google; sessions expire; administrative server access restricted to the Processor.
- Data access: every record belongs to one studio (tenant separation enforced on the server for every request); roles owner/admin/member (members do not see financial data); API keys bound to the studio with expiry and rate limit; AI assistants connect via OAuth 2.1 with PKCE, revocable by the user; client pages only via random single-purpose tokens.
- Separation: production, staging and development are separate; staging uses no real client data; the demo studio uses generated data.
- Encryption: TLS for all connections; integration credentials and client link copies encrypted with AES-256-GCM.
- Data minimisation: the event log entry for a deleted client contains no personal data; the Service asks only for the client data the studio configures.
Integrity
- Transfer control: encrypted transmission only; webhooks from payment providers verified with signatures; platform emails sent authenticated (SPF, DKIM).
- Input control: append-only event log of actions in each studio (who, what, when, from where); signed contract versions cannot be changed or deleted at database level.
Availability and resilience
- Copies of the database before every release; health checks and automatic restart of services; graceful shutdown; database migrations stop the release on error.
- Software dependencies kept up to date; build and type checks before every release.
Procedures for regular review
- Documented release procedure with version numbers and changelog.
- Data breach procedure: assessment, containment, notification of controllers without undue delay, documentation of every breach (section 9).
- Sub-processor review before engagement and once a year.
- Privacy by default: every automated email to clients needs the studio's approval unless the studio releases it; AI never sends anything to clients without confirmation; AI drafts are created only when the studio uses an AI feature.
Annex 3 — Sub-processors
| Sub-processor | Service | Data | Location | Safeguard for transfers |
|---|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | servers, database, file storage | all data in Annex 1 | Germany (Falkenstein) | none needed (EU) |
| Anthropic Ireland, Limited, Dublin, Ireland (parent Anthropic PBC, USA) | AI features (drafting emails, setting up an inquiry, imports), only when the studio uses them | text fields sent with the request (names, booking details, questionnaire answers, template text); no files or photos | USA | SCC 2021/914 (Anthropic DPA); no training on customer data; API data deleted within 30 days |
| Google Cloud EMEA Limited, Dublin, Ireland (Google Workspace) | sending emails of the platform (account, invitations, notices) | recipient address, email content | EU/USA | DPF (Google LLC); SCC 2021/914 |
Not sub-processors (section 6.4): the Controller's own email provider (SMTP), Stripe and PayPal accounts of the Controller, Google Calendar and Google sign-in (Google LLC as independent controller under the Google API terms), MailerLite, AI assistants or tools connected by the Controller via MCP or API keys, CoinGecko and Kraken (public exchange-rate requests without personal data), GitHub (source code and container images without personal data).