Data Processing Addendum

Last updated: 2026-11-11

This Data Processing Addendum (“DPA”) forms part of the agreement between Tobren Software LLC (“Tobren”, “we”, “us”) and the customer that holds a Tobren Deliver studio or a Tobren Operations organization (“Customer”, “you”). It governs our processing of Customer Personal Data under the GDPR, the UK GDPR and other data protection laws that apply to it. Where this DPA and the Terms of Service conflict about personal data, this DPA wins. Where the Standard Contractual Clauses apply and conflict with either, the Standard Contractual Clauses win.

1. Definitions

• Customer Personal Data is personal data that you, your team or your clients put into the Service, and that we process on your behalf to provide it.
• Data Protection Law means the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law (“UK GDPR”) with the UK Data Protection Act 2018, and any other privacy law that applies to the processing.
• Service means Tobren Deliver or Tobren Operations, whichever you use.
• Subprocessor is a third party we engage to process Customer Personal Data.
• Standard Contractual Clauses or SCCs means the clauses adopted by European Commission Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).
• “Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR.

2. Roles

You are the controller of Customer Personal Data, and Tobren is your processor. If you process it as a processor for someone else, Tobren is your subprocessor and you confirm that your controller has authorized our engagement. Tobren is a controller only for the personal data it uses to run its own business: account administration, billing, security, support and the marketing described in our Privacy Policy. This DPA does not cover that data.

3. Processing on your instructions

We process Customer Personal Data only on your documented instructions. Those instructions are the Terms of Service, this DPA, and how you configure and use the Service. We process it for no other purpose unless the law requires us to, and in that case we tell you first unless the law forbids it. If we believe an instruction infringes Data Protection Law, we tell you. Annex 1 describes the processing.

We never sell Customer Personal Data, never use it to train artificial intelligence models, and never use it for advertising.

4. Confidentiality

Everyone at Tobren who can access Customer Personal Data is bound by a duty of confidentiality. Staff access to a workspace requires a written reason and is recorded in an append-only log, as described in Annex 2.

5. Security

We apply the technical and organizational measures in Annex 2 to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. We may update them, but never so that the overall level of protection falls. Our Security page describes them in more detail, and also what we do not have yet.

6. Subprocessors

You give us general authorization to engage subprocessors. Annex 3 lists the ones we use today. Before a new subprocessor starts processing Customer Personal Data, we update Annex 3 and email the workspace owner at least 30 days in advance. You may object on reasonable data protection grounds. If we cannot resolve the objection, you may stop using the affected Service, and we refund any prepaid fees for the period after that. Each subprocessor is bound by written terms that protect Customer Personal Data at least as well as this DPA. We remain responsible to you for each subprocessor’s performance.

7. Data subject requests

We give you tools to answer requests from data subjects. Deliver lets a client request deletion of their own data from their account; the request appears in your queue. Operations lets the owner export the whole workspace, and each pilot can download their own logbook. Both products export your data. If a data subject contacts us directly about Customer Personal Data, we pass the request to you and do not answer it ourselves, unless the law requires otherwise. Where your own tools are not enough, we help you as far as reasonably possible.

8. Assistance

Taking into account the nature of the processing and the information we have, we help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority.

9. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we notify the workspace owner without undue delay, and in any case within 72 hours of confirming the breach. We tell you what we know about the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures we have taken or propose. Where we cannot give all of it at once, we give it in stages as we learn it. Notifying you is not an admission of fault.

10. Return and deletion

You can export Customer Personal Data at any time while your workspace is active. When the agreement ends, we keep your workspace data for 30 days so you can export it or reactivate, as section 11.4 of the Terms of Service says, and then delete it. Copies in our encrypted database backups expire on the backup cycle described in Annex 2. We keep only what the law requires us to keep, such as billing records for up to 7 years, and we keep it confidential.

11. Information and audits

We make available the information needed to show we comply with this DPA, including this document and our Security page. We have not been through a SOC 2 or ISO 27001 audit. If that information is not enough to show compliance, or if a supervisory authority requires it, you may audit our compliance with this DPA, at your own cost, with reasonable advance notice. The audit must take place during business hours, not disrupt the Service, and not give you access to other customers’ data. The auditor must be bound by confidentiality.

12. International transfers

Customer Personal Data is stored and processed in the United States, on Google Cloud. Where Data Protection Law treats our processing as a transfer of personal data from the European Economic Area, Switzerland or the United Kingdom to a country without an adequacy decision, the following apply and are incorporated into this DPA by reference:

• EU transfers: the SCCs, Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. You are the data exporter and Tobren is the data importer. For the SCCs:
  • the docking clause (Clause 7) does not apply;
  • Clause 9 uses Option 2 (general written authorization), with the notice described in section 6 above;
  • the optional language in Clause 11 does not apply;
  • under Clause 13, the supervisory authority is the one competent for you;
  • under Clauses 17 and 18, the governing law is the law of Ireland and disputes go to the courts of Ireland;
  • Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA, and Annex III by Annex 3.
• Swiss transfers: the SCCs as above, read with references to the GDPR meaning the Swiss Federal Act on Data Protection, and with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
• UK transfers: the UK Addendum. Its Table 1 is completed by the parties named in this DPA. Its Tables 2 and 3 are completed by the SCC modules and Annexes described above. For Table 4, either party may end the UK Addendum as its Section 19 allows.

13. Liability and term

Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law or the SCCs do not allow it. This DPA lasts as long as we process Customer Personal Data for you.

Annex 1: Details of the processing

Subject matter, nature and purpose

Hosting, storing, displaying, delivering and transmitting Customer Personal Data so that we can provide the Service. In Deliver, that means client galleries, watermarking, delivery and sales. In Operations, it means scheduling, crew, fleet, flight records, maintenance and compliance records, quotes and invoices. Support is included.

Duration

For the term of the agreement, plus the 30-day period and the backup expiry in section 10.

Frequency

Continuous.

Categories of data subjects

• Deliver: your team members; your clients and other people you give gallery access to; buyers at checkout; people who appear in photos and videos you upload.
• Operations: your crew members and other users in your organization; the people at the clients you record, quote and invoice.

Categories of personal data

• Deliver: names, email addresses and account details; images and videos of people; gallery favorites and notes; order and download history. Card data is never seen by Tobren, because checkout runs on your own Stripe or Square account.
• Operations: names, email addresses and account details; pilot certificates, currency and training records; flight logs, including location and flight tracks; documents you upload; client contacts on quotes and invoices.

Special categories of data

The Service is not designed to process special categories of personal data. Photos and videos can reveal them. You decide what you upload and are responsible for a lawful basis for it.

Annex 2: Technical and organizational measures

• Isolation: each studio or organization is isolated at the database level by row-level security, enforced by the database itself. The test suite proves that cross-tenant reads and writes are refused, using a database role that cannot bypass it.
• Encryption: TLS 1.2 or newer in transit, with HSTS on. Data at rest is encrypted by Google Cloud’s default encryption. Two-factor secrets, connected-account tokens and integration keys are encrypted in the database. Passwords for galleries, and share tokens, are stored as hashes.
• Network: the database is reachable only on a private network, over encrypted connections. Storage buckets are private, with public access prevented. Files are served through short-lived signed links.
• Access: two-factor sign-in, which an organization can require of its members. Re-authentication before sensitive account changes. Invitations are tied to an email identity and are single-use.
• Staff access: a written reason is required first. Every access is written to an append-only, hash-chained log. The customer is emailed when support opens a session. Tobren administrators sign in only with Google or Apple.
• Backups: daily database backups, seven kept, with point-in-time recovery. Restores are drilled.
• Minimization: in Deliver, location and editing-software metadata is removed from uploads by default.

Annex 3: Subprocessors

Tobren Deliver

• Google Cloud Platform (United States): hosting, database and file storage.
• Google Workspace (United States): sending service email.
• Stripe and Square (United States): Tobren’s own subscription billing. Your clients’ checkout runs on your own Stripe or Square account, under your own agreement with them; those are your processors, not ours.
• GitHub (United States): our private issue tracker, which receives only feedback you send us from inside the app.

Our Privacy Policy also names these services. They receive no Customer Personal Data, so they are not subprocessors under this DPA:

• Plausible Analytics: aggregate statistics for our own websites.
• Meta Platforms: activity on our own marketing website and sign-up pages.
• Cloudflare: the bot check when someone starts a live demo.

Tobren Operations

• Google Cloud (United States): hosting, database, file storage and sign-in.
• Google Workspace (United States): sending service email, such as alerts, invitations and receipts.
• Google Maps Platform (United States): maps, satellite imagery, place search and address lookup.
• Stripe (United States): processing subscription payments.
• AirData: only if your organization connects it, to import your flight data.

Contact

Tobren Software LLC, PO Box 2009, Acworth, GA 30102. Email: contact@tobren.io.