Data Processing Agreement

• "Controller" means the photography club that uses Prism to manage its members and competitions.
• "Processor" means Templeton-Smith Ltd, a company registered in England and Wales under company number 14618653, which operates Prism. Its registered office is as recorded at Companies House against that number.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined by UK GDPR.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, and deletion.
• "Sub-processor" means any third party engaged by Prism to process Personal Data on Prism's behalf.

Prism processes Personal Data on behalf of the Controller for the purpose of administering the club's competition programme, including member management, competition entry, judging, scoring, and results publication.

This agreement applies for as long as the club uses Prism and for a reasonable period afterwards pending deletion of all associated Personal Data.

Prism processes the following categories of Personal Data:

• Names and email addresses of club members.
• Competition entries (image files, titles, photographer's statements).
• Competition scores and results.
• Member grades/classes per discipline.
• Personal image bank uploads.

Processing is carried out solely for the purpose of providing competition management services to the Controller. Prism does not use the data for any other purpose.

Prism agrees to:

1. Process Personal Data only on documented instructions from the Controller, except where required by applicable law.
2. Ensure that all persons authorised to process the Personal Data are bound by appropriate confidentiality obligations.
3. Implement appropriate technical and organisational security measures as described in the Security Overview document.
4. Assist the Controller in responding to requests from data subjects exercising their rights under UK GDPR.
5. Assist the Controller in meeting its obligations under Articles 32 to 36 of UK GDPR (security, breach notification, DPIAs).
6. Delete or return all Personal Data to the Controller at the end of the service provision, at the Controller's choice.
7. Make available all information necessary to demonstrate compliance with this agreement and allow audits or inspections by the Controller or an authorised auditor.
8. Notify the Controller without undue delay upon becoming aware of a personal data breach.

Prism uses the following sub-processors:

Prism will notify the Controller before engaging any new sub-processor and will give the Controller the opportunity to object. All sub-processors are bound by contractual obligations equivalent to those in this agreement.

What reaches the two United States sub-processors, and when. Resend receives the recipient's email address and the text of the message being sent. Anthropic receives a reduced copy of a photograph (768 px, never the stored original) only while AI tagging is switched on for the club, and receives the text of a conversation only when a user chooses to use the in-app help assistant. No competition data, scores or membership list is sent to either for any other purpose.

All Personal Data at rest is held in the United Kingdom. Two sub-processors named above are United States companies, so the data described there is transferred outside the United Kingdom in the course of being processed: Resend, for email, and Anthropic, for AI tagging and the help assistant.

Those transfers are made under each provider's standard data processing terms, which incorporate the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. No other Personal Data is transferred outside the United Kingdom or European Economic Area.

Prism implements the technical and organisational measures described in the Security Overview, including: encryption in transit and at rest, role-based access controls, two-factor authentication available on every account and recommended for administrative accounts, regular automated backups, and audit logging.

The Controller agrees to:

1. Provide Prism with lawful instructions for processing Personal Data.
2. Obtain any necessary consents from data subjects and provide required notices.
3. Ensure that members are informed about how their data will be processed through Prism.
4. Notify Prism promptly of any data subject requests that require action.

Upon termination of the club's use of Prism, the Controller may request a full export of all Personal Data in a machine-readable format. Following confirmation of successful export, Prism will securely delete all Personal Data associated with the club within 30 days, with the exception of anonymised or aggregated data that cannot reasonably be linked to individuals.

This agreement is governed by the laws of England and Wales and subject to the jurisdiction of the English courts. It incorporates and is subject to the requirements of UK GDPR and the Data Protection Act 2018.