Data Processing Agreement

1. Scope and Parties

This Data Processing Agreement ("DPA") is entered into between the Client (the "Controller") and Rhetoricbyte Inc., a company with a capital of CAD 1, directed by Stephanie Fraser, located at Jasper Avenue 10425, T5J1N3 Edmonton (the "Processor"). This agreement governs the processing of personal data necessary to perform photography services as defined in the Terms and Conditions.

2. Categories of Data

The Processor processes the following categories of data on behalf of the Controller:

• Subject Data: Names, likenesses (photographs), and contact details of the Controller's employees or representatives.
• Corporate Data: Brand guidelines, product specifications, and internal scheduling information.
• Communication Data: Email addresses and phone numbers used for project coordination.

3. Processor Obligations

Rhetoricbyte Inc. agrees to process data only on documented instructions from the Controller. The Processor shall ensure that persons authorized to process the data have committed themselves to confidentiality. All processing is conducted in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL).

4. Sub-processors

The Controller grants general authorization to the following sub-processors:

• HostPapa Inc. (115 George Street, Suite 511, Oakville ON L6J 0A2) — Infrastructure and data hosting.
• FormSubmit (USA) — Processing of initial contact requests.

Details on data transfers are available in our Privacy Policy.

5. Security and Incidents

The Processor implements technical and organizational measures to protect data against unauthorized access. In the event of a data breach, Rhetoricbyte Inc. will notify the Controller without undue delay. Security protocols include encrypted storage and restricted access to the studio's digital archives.

6. Retention and Deletion

Upon completion of the services, the Processor will return or delete all personal data, except for source files (RAW) which are stored for a period of 6 months to facilitate potential revisions, after which they are permanently erased. This aligns with the data lifecycle described in Privacy Policy Art. 6.

7. Audit and Law

The Controller has the right to request information to verify compliance with this DPA. This agreement is governed by the laws of Alberta, Canada. Any disputes shall be settled in the courts of Edmonton. For regulatory inquiries, the Office of the Privacy Commissioner of Canada (OPC), 30 Victoria Street, Gatineau QC K1A 1H3, is the competent authority.