Data processing agreement

DALFAST Studio · DALFAST, s.r.o. · Last updated and effective: 1 November 2026

This agreement governs DALFAST's processing of personal data on a customer's instructions under Article 28 GDPR. Its four annexes (processing details, security measures, subprocessors and transfers, and retention and exit) form part of it.

1 Parties, scope and precedence

DALFAST, s.r.o., Na pasekách 20, 831 06 Bratislava, Slovakia. IČO 52 237 826; DIČ 2121001949; VAT number SK2121001949. Registered in the Commercial Register of the Municipal Court Bratislava III, section Sro, insert no. 137031/B. Email: support@dalfast.studio. Website: https://dalfast.studio.

The other party is the customer who holds the DALFAST Studio account, identified by the account's name and email address and, for paid services, by the order. The customer accepts this agreement as part of the Terms of use when creating the account; DALFAST keeps a record of the Terms version accepted and when. The customer acts as controller, or as a processor authorised by its controller to appoint DALFAST as subprocessor; in that case, references to the customer's instructions mean instructions lawfully passed on from that controller.

This agreement applies whenever DALFAST processes personal data on the customer's behalf: in customer content, website forms, visitor counts kept on the customer's instructions, and collaboration and review data. It is not limited to business customers. It does not cover processing for DALFAST's own purposes, described in the Privacy policy. Genuinely anonymous information is not personal data; processing before it is made anonymous is covered.

For processing matters, this agreement prevails over conflicting general terms. Applicable international transfer clauses prevail where they require it. A general liability clause does not reduce the customer's statutory responsibilities or the rights of data subjects.

2 Instructions and limits

DALFAST processes customer personal data only on documented instructions, including about transfers outside the EEA, unless EU or Member State law requires otherwise; it then informs the customer before processing unless that law prohibits it on important public-interest grounds. This agreement, the customer's lawful choices of features and settings, and documented support requests are the customer's instructions.

DALFAST informs the customer at once if it believes an instruction infringes data protection law, and does not carry out unlawful processing. Additional instructions that change the service are agreed in writing, without limiting mandatory assistance.

DALFAST does not use customer content for advertising or for training AI models, and does not allow its subprocessors to use it outside the agreed purpose.

The AI providers in Annex 3 do not use our requests to train their models under their published terms. Higgsfield, whose standard terms allow training, is not used for customer content unless it confirms in writing that it will not train on it.

3 Confidentiality and security

DALFAST ensures that the people authorised to process customer personal data are bound by confidentiality and have access only as needed. It applies appropriate technical and organisational measures under Article 32 GDPR, taking account of the risks and the nature of the data; Annex 2 records them.

DALFAST tests and reviews its measures, including before each release of the Studio, and restores availability after incidents as far as it can. It may improve measures without materially reducing the agreed level of protection. Security contact: support@dalfast.studio; the managing director is responsible for security and for notifying changes to these measures.

4 Assistance and rights requests

Taking account of the nature of the processing, DALFAST assists through appropriate measures, as far as possible, with requests from data subjects. It forwards promptly any request about customer data and does not reply on the customer's behalf unless instructed or legally required. The export and deletion tools help with this but do not replace necessary assistance.

DALFAST assists the customer with its obligations under Articles 32 to 36 GDPR, taking account of the processing and the information available to it, including security, breach notification, impact assessments and prior consultation. It provides the information the customer needs and tells the customer about relevant enquiries from authorities unless prohibited.

The customer contacts DALFAST for assistance or incidents at support@dalfast.studio. DALFAST acknowledges within two working days and replies in substance without undue delay. Assistance the law requires is free; any other additional service is agreed in advance at a reasonable price.

5 Personal data breaches

DALFAST notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data, and aims to send the first notice within forty-eight hours. This is not permission to delay a notice that can be given sooner, and does not affect the customer's own deadlines.

The notice describes what is known: the nature of the breach, the data and people affected where possible, the likely consequences, the measures taken and a contact point. If information is incomplete, DALFAST sends a first notice and updates it without undue delay. It preserves evidence, limits the effects and cooperates with the customer's investigation. The customer decides on its own notifications unless the law requires DALFAST to act itself. Notices are sent to the email address of the customer's account.

DALFAST detects incidents through its admin checks of the service, its security records (Annex 2) and reports from users and providers; these checks are made by people and are not monitored around the clock.

6 Subprocessors

The customer gives general written authorisation for the subprocessors listed in Annex 3, only for the processing described there. DALFAST imposes on each the data protection obligations Article 28 requires, including sufficient security guarantees, and remains fully liable to the customer for each subprocessor's performance as Article 28(4) requires.

DALFAST emails the customer's account address at least thirty days before adding or replacing a subprocessor, and keeps a dated list at https://dalfast.studio/legal/dpa. The customer may object within that period on reasonable data protection grounds. The parties then look in good faith for an alternative or for safeguards; the new subprocessor does not process that customer's data until the objection is resolved or the affected service ends.

If no reasonable solution is found, the customer may end the affected service and receives a proportionate refund of unused prepaid fees for it, with return and deletion under section 9. Where an urgent replacement is needed to keep the service secure or available, DALFAST tells the customer at once and the customer keeps the same right to object and end the service. Neither path permits unlawful processing.

7 International transfers

DALFAST and its subprocessors transfer customer data outside the EEA only on documented instructions and in compliance with Chapter V GDPR. Annex 3 identifies the receiving recipients, countries and safeguards, including onward access. This may involve an adequacy decision or the appropriate standard contractual clauses with completed annexes, assessments and supplementary measures.

The EU-US Data Privacy Framework is relied on only for a covered transfer to a currently certified US recipient. It does not cover recipients in Singapore or other countries. Copies of, or information about, the safeguards are available on request, with confidentiality redactions that do not prevent assessing compliance.

8 Compliance information and audits

DALFAST makes available all information necessary to demonstrate compliance with Article 28 and allows and contributes to audits, including inspections, by the customer or an independent auditor it appoints. Routine audits may be planned once a year on thirty days' notice, with reasonable confidentiality, security and non-disruption arrangements.

This does not prevent additional or faster audits reasonably needed after a personal data breach, credible evidence of non-compliance, an important change in the processing or a request from a competent authority. Auditors may be required to avoid conflicts and to protect other customers' data.

The customer bears its reasonable costs of routine audits; DALFAST bears its ordinary cooperation costs, and the audit costs if an audit finds a material breach by DALFAST. No cost arrangement may prevent an audit the law requires.

9 Return, deletion and end of service

At the customer's choice, DALFAST returns customer personal data or deletes it at the end of the service, and deletes the remaining copies unless EU or Member State law requires storage. The customer returns data to itself at any time with the export tools (Annex 4) and deletes it by deleting the content or the account.

If the customer has made no choice at the end of the service after the notice and export period in Annex 4, deletion is the documented default instruction. Data kept under a legal requirement is limited to that purpose and period. Confidentiality and safeguards continue until deletion is complete, and DALFAST confirms deletion by email on request.

10 Customer obligations

The customer is responsible for lawful instructions, its legal basis, notices and the authority to disclose personal data and to appoint processors. A customer acting as processor must have its controller's authority, including for the approved subprocessors and transfers. It must choose appropriate sharing and retention settings and cooperate on requests and incidents.

The customer must not submit special-category data or criminal-offence data unless DALFAST has expressly agreed to it in writing. The service is not designed for biometric identification, health records or the data of children other than within the Studio's own family accounts. Processing images or voices in the ordinary editing and AI features is not biometric identification and must not be used for it.

11 Liability, term and law

This agreement lasts while DALFAST processes customer personal data. The business liability provisions of the Terms apply only as far as lawful and without reducing Article 28(4) responsibility, data subjects' rights under Article 82, mandatory obligations or regulatory powers. Consumers do not become subject to a business liability cap by accepting this agreement.

Slovak law applies, subject to mandatory EU law and the precedence of applicable transfer clauses. Changes follow the Terms only as far as consistent with the customer's instructions and data protection law.

Annex 1 Processing details

Subject and purpose: providing the Studio's hosting, editing, collaboration, review, publishing, form, visitor-count and AI features the customer chooses. Operations: collection through forms the customer sets up, storage, organisation, retrieval, access management, transmission, export and deletion; AI processing only for the features the customer uses.

People concerned: the customer's staff and contractors, collaborators, reviewers, website visitors and members, people who submit forms, and people shown or mentioned in customer content. Data: names, email addresses, account or membership identifiers, comments and decisions, messages, form fields with a scrambled code made from the sender's network address, content files, images or audio in content, and visitor records that remain personal data until deleted (Privacy policy section 8).

Duration: while the customer uses the service and keeps the data, then return or deletion under Annex 4. Frequency: continuous, as the customer uses the service. Special categories: none are intended (section 10). Children: only within the Studio's own family accounts.

Annex 2 Technical and organisational measures

Connections: HTTPS on the live site. Passwords: stored only as one-way hashes. Accounts: optional two-step sign-in for every account; a list of signed-in devices that the customer can sign out; sessions end 30 days after sign-in and device records are deleted 31 days after their last use.

Access: only people named as DALFAST admins in the server configuration can use the admin tools; each account sees only its own data and what was shared with it; each server request checks the signed-in account's rights.

Sharing: share links can be switched off; review links expire; members-only websites need a password.

Records: important account actions are logged for 12 months; failed sign-ins and repeated requests are limited.

AI: each feature sends only what it needs to its provider; files given to the video provider are on temporary links deleted after two hours; for linked young users, stricter safety rules apply and videos of real people are switched off.

Admins: the admin tools open only for admin accounts with two-step sign-in turned on.

Backups: the hosting provider makes a weekly copy of the server for restoring it, and automatic copies of our account kept for up to five months; server logs are kept for up to two months.

Development: outside code libraries are loaded at fixed versions, and scripts with a fingerprint check (the browser refuses a changed file), except the model loaders, which browsers cannot check yet; every release of the Studio passes a complete automated test of its pages and features before it can be packaged.

Data at rest: stored on the hosting provider's servers; the Studio does not add its own encryption of stored data. Certifications: none.

Location: the server is in Phoenix, Arizona, United States, in Namecheap's data centre. Last reviewed by DALFAST: 31 October 2026.

Annex 3 Subprocessors and transfers

Namecheap, Inc.: hosting, storage and email delivery (United States).

Anthropic: writing features (text only) (United States; no training on API data; not kept, or up to 30 days for some models).

OpenAI: writing, pictures, photo editing, voice and speech-to-text fallbacks, and safety checks (United States; no training on API data; abuse-monitoring records up to 30 days).

BytePlus: pictures, photo editing, video, talking photos and presenters, voices, speech to text, translation and picture search by meaning (Malaysia, Indonesia or the EEA; acts as processor; no training; filtered requests kept 180 days).

Cloudflare: STUN for editing together (network addresses only; no content).

Stripe and the OpenStreetMap Foundation are not listed: they receive data for DALFAST's own purposes, not on the customer's instructions.

Annex 4 Retention and exit

Choice and contact: the customer chooses return (export) or deletion through its account, or by writing to support@dalfast.studio from the account's email address.

Export: each design in its download formats and as a project file; all account data as a machine-readable file ("Download my data"); website form entries are included in that file. Available while the account exists; if DALFAST ends the service or the customer's access, it gives at least thirty days' notice by email to export first, unless the law or a serious breach requires faster action.

Active data: deleted at once when the customer deletes the content or the account; live editing data within six hours; visitor records after 400 days.

Backups: only the hosting provider's copies (weekly server copies for restoring the server; account copies kept up to five months); if one is ever restored, deletions are applied again.

Subprocessors: AI requests are deleted by each provider under its own terms (Annex 3); temporary video links after two hours.

Legal retention: payment and order records for ten years (Privacy policy section 12), restricted to that purpose. DALFAST confirms deletion by email on request.