Jolti
Back to homepage

Data Processing Agreement (DPA)

This document governs the data processing arrangement between the respective organizer (customer, controller for event and guest content data, see the Privacy Policy, section 1) and Jolti (processor, [Company details pending in Admin Settings], [Company details pending in Admin Settings], [Company details pending in Admin Settings], email: [Company details pending in Admin Settings]) pursuant to Art. 28 GDPR, and also serves as the record of processing activities pursuant to Art. 30 (2) GDPR.

1. Subject matter and duration

The subject matter of the processing is the technical handling of photos guests upload during a specific event and the videos generated from them (storage, forwarding for AI processing, display on the event screen). Processing continues for the duration of the respective event and the subsequent retention period set out in the Privacy Policy, section 6.

Category of data subjects: event guests who upload photos. Categories of data: uploaded photos, generated videos, technical metadata (timestamps, an anonymous device identifier).

2. Sub-processing — bring-your-own-key clarification
AI providers are the organizer's own processors, not Jolti's sub-processors

The platform is technically built as a strict bring-your-own-key model: Jolti itself holds no shared access to any of the AI providers listed below. Each organizer supplies their own API key for the chosen photo/video AI provider in the event settings. Video generation is carried out technically using that key; the AI provider is thereby engaged directly by the organizer themselves.

Legal consequence: the respective AI provider is, in this case, the organizer's own independent processor within the meaning of Art. 28 GDPR — nota sub-processor of Jolti. The organizer is responsible for entering into their own agreement with the AI provider they chose, meeting Art. 28 GDPR requirements (most providers offer their own standard DPA templates for this). Jolti merely transmits the photo/video content technically, on the organizer's instructions and using the key the organizer configured themselves, without itself becoming a party to the AI provider's processing.

For the technical infrastructure Jolti itself uses to operate the platform (database, cache, and object-storage services), Jolti remains the organizer's processor; any infrastructure operator used for that purpose is a sub-processor of Jolti.

Record of services used
Name, purpose, category, location, and processor relationship
NamePurposeLocationProcessor relationship
StripePayment processing (account/plan purchases)USA / EUJolti's processor for account/payment data (not for guests' event content data).
Server infrastructure (database, cache, object storage)Platform operation, content storageDeutschland / EUSub-processor of Jolti, unless operated by Jolti itself.

For third-country transfer details (EU-US Data Privacy Framework, supplementary Standard Contractual Clauses), see the Privacy Policy, section 5.

3. Technical and organizational measures (TOMs)

Jolti implements, in particular: encryption of stored API keys at rest, transport encryption (TLS) for all connections, role-based access control (RBAC) for administrative functions, and regular automated cleanup of data no longer needed (see the Privacy Policy, section 6).

4. Deletion and return

After the respective event ends, or on the organizer's instruction, content data is deleted or — where requested by the organizer — made available as an archive (ZIP download) and then removed according to the periods set out in the Privacy Policy.

Living document

This record is a living document. We update it whenever the services, providers, or processing activities we use change.

Draft — legal review pending.

© 2026 Jolti

ImprintPrivacyTermsWithdrawalDPA