Data processing agreement

Last updated: 11 November 2026

When a business customer ("Controller") uploads images that contain personal data (for example photos of people), Grand Avocado Ltd. acts as a processor. These terms apply automatically under GDPR Article 28.

1. Subject and duration

Processing of images for the purpose of background removal, for as long as the customer uses the service.

2. Instructions

We process images only to deliver the requested result and do not use them for any other purpose.

3. Security

• Encryption in transit (TLS) and at rest.
• The processing engine is not publicly reachable; every request is cryptographically signed.
• Automatic deletion of images after 24 hours.
• Access limited to authorised personnel bound by confidentiality.

4. Sub-processors

Cloud hosting and database provider, Amazon Web Services (image processing), payment provider. We will notify customers of changes 30 days in advance.

5. Assistance and deletion

We help the Controller respond to data subject requests and notify personal data breaches without undue delay, at the latest within 48 hours.

6. Signed copy

Need a countersigned copy? Email privacy@dropthebg.com.