Data Processing Disclosure

1 Purpose

This Data Processing Disclosure is provided in the interest of transparency about how Studio Photuna processes personal and operational data through third-party service providers (sub-processors). We are committed to ensuring that all data processing activities comply with the Data Privacy Act of 2012 (Republic Act No. 10173), the General Data Protection Regulation (GDPR), and the UK GDPR, where applicable. For the full sub-processor list, the roles we play as controller and processor, and photo retention periods, see our Privacy Policy.

2 Sub-Processors

Studio Photuna engages the following third-party sub-processors to deliver and support our services:

3 Data Processing Purposes

Each sub-processor accesses and processes data strictly for the following purposes:

• Supabase Inc.: Stores user account data, event booking records, and uploaded files (photos, templates). Manages authentication tokens and session data for secure login.
• Vercel Inc.: Hosts and serves the Studio Photuna web application. Processes HTTP requests, serves static assets, and executes serverless API functions. May log IP addresses and request metadata for performance and security monitoring.
• Stripe Inc.: Processes subscription billing and payment card transactions for Studio Photuna software plans.
• PayMongo, PayPal, Xendit, and GCash (Mynt): Process event booking deposit payments. Each processes payment reference numbers, transaction amounts, and payment confirmation data; we do not directly store full payment card numbers.
• Google (Google Fonts): Delivers web fonts to your browser. Google may collect IP addresses and browser information as part of the font delivery process.

4 Cross-Border Transfer Safeguards

As several of our sub-processors are located outside the Philippines, personal data may be transferred internationally. We ensure that all cross-border data transfers are protected by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) as approved by the European Commission for GDPR compliance.
• NPC Circular 2016-02 guidelines on cross-border data transfer as issued by the National Privacy Commission of the Philippines.
• Compliance with GDPR Chapter V provisions on transfers of personal data to third countries.

5 Data Security

All sub-processors engaged by Studio Photuna are required to maintain industry-standard security measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. Where applicable, our sub-processors maintain SOC 2 Type II compliance and implement encryption at rest and in transit, access controls, regular security audits, and incident response procedures.

6 Your Rights

For a comprehensive overview of your data subject rights — including the right to access, correct, delete, and port your personal data — please refer to our Privacy Policy. You may exercise any of your rights by contacting our Data Protection Officer at the email address provided below.

7 Contact

For questions or concerns regarding our data processing practices, please contact us at:

• General Support: support@studiophotuna.com
• Data Protection Officer: dpo@studiophotuna.com