Data Processing Addendum (DPA)

This DPA forms part of the Terms of Service and applies automatically when a business customer (the “Controller”) uses bgready in a way that involves processing of personal data in uploaded images or shop content by Codepower OÜ (the “Processor”). For the Controller’s own account data, see the Privacy Policy — there we are controller.

Sign in to download a PDF draft stamped with your company name.

1. Parties

Processor: Codepower OÜ, registry 17543223, Ahtri tn 12, 10151 Tallinn, Estonia, info@codepower.io.

Controller: the natural or legal person who holds a bgready account and uploads images or connects a shop/API that may contain personal data (including photos of people).

2. Subject matter and duration

The Processor processes personal data solely to provide background removal, optional AI fill, temporary storage, API/plugin delivery and related support, for the term of the service and lawful wind-down / retention.

3. Nature, purpose, data subjects, categories

• Purpose: process images to remove/replace backgrounds and return results to the Controller.
• Data subjects: persons appearing in or identifiable from uploaded images or metadata the Controller submits.
• Categories: image content and derived cutouts/masks/results; shop product image references and tokens when plugins are used; technical logs tied to processing.

4. Processor obligations (Art. 28)

• Process only on documented instructions (including product configuration), unless law requires otherwise;
• Ensure authorised persons are bound by confidentiality;
• Implement appropriate TOMs under Art. 32;
• Engage sub-processors only under Art. 28(2)/(4) conditions;
• Assist with data-subject requests insofar as feasible;
• Notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller data;
• Delete or return personal data after the retention period / end of service, unless law requires storage.

5. Controller obligations

The Controller warrants a valid legal basis, informs data subjects as required, issues lawful instructions, and does not require unlawful processing. Only upload images you have rights to process.

6. Sub-processors

The Controller grants a general written authorisation to use the sub-processors needed for the Service. Current list:

On a material change we will update the public list. The Controller may object on reasonable grounds within 14 days; if we cannot accommodate, the Controller may stop using the affected feature or terminate under the Terms.

7. International transfers

Where a sub-processor is outside the EEA, we ensure Chapter V safeguards (including SCCs) where applicable.

8. Security (TOMs)

Measures include access control, TLS, private media storage, encrypted shop tokens, retention purge jobs, and abuse limits. Staff maintain an internal TOMs document.

9. Breach notification

We will notify the Controller without undue delay after becoming aware of a personal-data breach affecting their data, with information reasonably available to assist the Controller’s own obligations.

10. Deletion

Uploads and results are deleted after approximately 24 hours. Account deletion removes or anonymises personal data per the Privacy Policy retention table.

11. Audits

We make available information necessary to demonstrate Art. 28 compliance, primarily via documentation, questionnaires and third-party reports where available — not more than once per year except on reasonable suspicion of a breach, with prior notice and without compromising other customers’ security.

12. Governing law

Laws of the Republic of Estonia, without prejudice to the mandatory application of the GDPR. Contact: info@codepower.io.