Data Processing Addendum
Last updated October 11, 2026
For business customers who upload personal data (for example photos of models or staff). It forms part of the Terms of Service and meets Article 28 GDPR.
Roles and instructions
You are the controller and Amondu is your processor for personal data in your workspace. We process it only to provide the service and on your documented instructions, which are the Terms and your use of the product.
Our commitments
Confidentiality of everyone with access; appropriate technical and organisational security measures; help with data subject requests, security incidents and impact assessments; notice of a personal data breach without undue delay and at the latest within 48 hours; deletion or return of data at the end of the service; information and audits to show compliance.
Subprocessors and transfers
You authorise the subprocessors on the Subprocessors page. We bind them to equivalent obligations, give 30 days' notice of changes so you can object, and use the Standard Contractual Clauses (and the UK addendum) for transfers outside the EEA and UK.
Signed copy
If you need a countersigned copy, write to legal@amondu.com.