Data Processing Agreement (DPA)

The subject matter of the processing is the technical handling of photos guests upload during a specific event and the AI images and videos generated from them: receiving and storing uploads, transmitting them to the AI provider for image and video generation, storing and displaying the results on the event screen, providing a password-protected online gallery for viewing and downloading the content, and receiving and handling reports about individual content. Processing continues for the duration of the respective event and the subsequent retention period set out in the Privacy Policy, section 6.

Categories of data subjects: event guests who upload photos, and persons depicted in the photos. Categories of data: uploaded photos, generated images and videos, processing time and status, IP address of the uploading device (30 days), signed device identifier, the guest's confirmation before upload, name and email address of persons who report content.

Jolti processes the data only on the organizer's documented instructions. The organizer issues instructions through the platform's functions (creating, starting and ending an event, choosing generation settings, deleting individual content or the event, enabling the online gallery and excluding individual files from it); further instructions require text form. If Jolti considers an instruction unlawful, Jolti informs the organizer.

Jolti further undertakes to

• use only persons who are bound to confidentiality (Art. 28 (3)(b) GDPR);
• implement the technical and organizational measures described in section 4 (Art. 32 GDPR);
• assist the organizer, using the platform's means, in responding to data subject requests (deleting individual content, reporting procedure, data export);
• inform the organizer without undue delay if Jolti becomes aware of a personal data breach affecting the guest content of their event (Art. 33 (2) GDPR), and assist with the obligations under Art. 32 to 36 GDPR;
• make available all information necessary to demonstrate compliance with this agreement and allow for audits; audits are generally conducted by written information and, where there is a legitimate reason, on site after prior coordination;
• delete or return the data in accordance with section 5 once processing has ended.

The organizer gives general authorization for the use of the sub-processors listed below. Jolti has concluded agreements with them that pass on the obligations of this agreement. If Jolti intends to add or replace a sub-processor, Jolti informs the organizer at least 14 days in advance by email or in the dashboard; the organizer may object to the change for important data-protection reasons and, in that case, terminate the usage agreement extraordinarily.

Only the photo or intermediate image and the generation settings are transmitted to xAI, never names, email addresses, or account data. xAI does not use this content to train AI models. Jolti uses xAI in "Zero Data Retention" mode: inputs and results are not stored permanently at xAI and are deleted no later than one hour after processing; xAI places the video directly in Jolti's storage. xAI announces changes to its sub-processors at least 15 days in advance; Jolti passes on such changes, where they affect processing for the organizer, under the rules of this section. Stripe processes only the organizer's account and payment data, for which Jolti itself is the controller, and is therefore not a sub-processor within the meaning of this agreement.

• Access control: servers reachable only via key-based authentication; services run in separate containers; administrative platform functions protected by role-based access control (RBAC); organizers see only the content of their own events.
• Encryption: TLS for all connections (browser, TV screen, AI provider); stored API keys encrypted at rest; passwords stored as hashes only.
• Pseudonymization and data minimization: guests upload without an account; device identifiers are random and signed; no identity data is sent to the AI provider.
• Availability: queue with automatic restart of aborted processing; status monitoring of the AI provider; new uploads are blocked during disruptions instead of losing data.
• Deletion: automated deletion jobs (IP addresses after 30 days, deleted accounts after 30 days, event media 30 days after the event ends or, without the online gallery, 24 hours after the event ends, never-started passes after twelve months).
• Reporting procedure: generally immediate hiding of reported content with an abuse limit per reporting sender, review within 72 hours, deletion only by decision, logging of the decision.