Data processing agreement
Last updated 31 October 2026
This agreement forms part of the terms of service between an organiser (the controller) and Salzburg 101 Adventures Ltd, trading as GBA Solutions (the processor) for the guest content processed through Snazooka. It meets the requirements of Article 28 of the General Data Protection Regulation.
1. What is processed
| Subject matter | Running an event photo wall: collecting, storing and showing guests' photos, videos and messages |
| Duration | From the event's creation until it is deleted, 90 days after uploads close, or sooner on the organiser's instruction |
| Kinds of personal data | Guests' first names, images and voices in photos and videos, messages, hearts, browser identifiers |
| People concerned | The organiser's guests, and people who appear in their photos and videos |
2. The processor's commitments
- Process guest content only on the organiser's documented instructions, which are the organiser's use of Snazooka's settings and controls, unless the law requires otherwise.
- Make sure anyone with access to the content is bound to keep it confidential.
- Keep appropriate security in place, including encrypted connections, encrypted storage, access limited to the event's admins, and storage in the EU.
- Help the organiser respond to guests' requests to see or delete their information, and with any data protection impact assessment.
- Tell the organiser without undue delay, and within 48 hours where possible, after becoming aware of a breach affecting their event.
- Delete the content at the end of the processing, as set out above, and not keep copies except where the law requires.
- Make available the information needed to show these commitments are met, and allow reasonable audits on 30 days' notice.
3. Sub-processors
The organiser authorises the following sub-processors. We'll give at least 30 days' notice of any change, and the organiser may object.
| Sub-processor | Service | Location |
|---|---|---|
| Google Cloud (Google Ireland Limited) | Storage, database, sign in, hosting | EU (Belgium) for stored content |
| Google reCAPTCHA (Google Ireland Limited) | Checking that uploads come from real browsers, using technical details of the guest's browser and device | Google's servers, which may be outside the EU |
| Google Workspace (Google Ireland Limited) | Emails to organisers only, no guest content | Google's servers, which may be outside the EU |
Where a sub-processor handles data outside the EU, it does so under the European Commission's standard contractual clauses.
4. The organiser's commitments
The organiser has a lawful basis for the processing, gives guests appropriate information (Snazooka shows a short notice on the upload page), and only gives the event link to people they intend to invite.