Version 2.0 - last updated 13 November 2026. This version replaces the previous Data Processing Addendum (published as a PDF).
This Data Processing Addendum ("DPA") is concluded between ASQUARED S.R.L., a Romanian company with registered office in Brasov, str. Harmanului nr. 15, registered with the Trade Register under no. J2024032303003, fiscal registration code 50719801, e-mail contact@joinmymoment.com ("JoinMyMoment", "we", "Processor"), and the customer that uses the Services and determines the purposes and means of the processing of Customer Data ("Customer", "Controller").
1.1. Conclusion without signature. This DPA forms part of the Terms of Service ("Agreement"). It is concluded and becomes binding, without any further signature, when the Customer purchases a paid Service or otherwise creates or uses a Moment under the Agreement. This satisfies the requirement of Art. 28(9) GDPR that the contract be in writing, including in electronic form.
1.2. Signed copy on request. Customers who need a signed copy for their records may request one at contact@joinmymoment.com, stating their company name, address and the e-mail address of their JoinMyMoment account. We will send a copy of this DPA, signed by JoinMyMoment, with the same content. A signed copy does not change the content of this DPA.
1.3. Scope. This DPA applies whenever and to the extent that JoinMyMoment processes personal data on behalf of the Customer in the course of providing the Services ("Customer Data"). The details of the processing are set out in Annex 1. It applies in particular to business customers (companies, organisations, event agencies) that use the Services for their own events or for events of their clients.
1.4. Precedence. In the event of a conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of Customer Data. Where the Customer is an event agency acting on behalf of its own client, the Customer is responsible for having the authority to give instructions and enter into this DPA, and acts as our point of contact.
1.5. Processing as controller. This DPA does not apply to personal data that JoinMyMoment processes as a controller, such as the data of the Customer's account holder and representatives (account, billing, customer support and communication data), website analytics and data needed to secure the Services, prevent fraud and comply with legal obligations. That processing is described in our Privacy Policy. Where we use data about how the Services are used to improve them, we only use it in aggregated or anonymised form, or as described in the Privacy Policy.
2.1. Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given to them in Regulation (EU) 2016/679 ("GDPR").
2.2. "Data Protection Laws" means the GDPR and all other data protection laws of the European Union, the European Economic Area and their member states that apply to the processing of Customer Data, as well as, where applicable, the UK GDPR and the Swiss Federal Act on Data Protection.
2.3. "Services" means the JoinMyMoment event photo and video sharing service, available at joinmymoment.com and app.joinmymoment.com, as described in the Agreement.
2.4. "Moment" means an event created by the Customer in the Services, and "Guest" means any person who joins a Moment.
2.5. "Sub-processor" means any processor engaged by JoinMyMoment to process Customer Data.
2.6. "Storage Period" means the period during which the content of a Moment is kept available, as set out in Section 11.
3.1. JoinMyMoment processes Customer Data only on the documented instructions of the Customer, including with regard to transfers of personal data to a third country, unless required to do so by Union or Member State law to which JoinMyMoment is subject. In that case, we inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
3.2. The Customer's instructions are given by this DPA and the Agreement, by the settings the Customer chooses for each Moment in the Services (for example the number of guests, photos per guest, whether videos and voice messages are allowed, who can see the gallery, sign-in requirements, the Google Photos integration) and by other written instructions sent to contact@joinmymoment.com. Instructions that go beyond the functionality of the Services may be subject to a separate agreement, including on costs.
3.3. JoinMyMoment shall immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Laws. We may suspend carrying out such an instruction until the Customer confirms or changes it.
4.1. The Customer is responsible for the lawfulness of the processing of Customer Data, including having a legal basis for it and for its instructions, and for informing Guests and other data subjects in accordance with Art. 13 and 14 GDPR (for example by a notice on the invitation, at the event or on the QR code sign). Where Guests are employees of the Customer, the Customer is also responsible for complying with applicable employment law and any requirements involving employee representatives.
4.2. The Customer is responsible for keeping the access credentials of its account and the links and QR codes of its Moments confidential, and for choosing settings appropriate to its event.
4.3. The Customer shall inform JoinMyMoment without undue delay if it finds errors or irregularities in the processing of Customer Data.
JoinMyMoment ensures that all persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process Customer Data only as needed to provide, maintain and support the Services, in accordance with the Customer's instructions. Access to Customer Data is limited to the persons who need it for these purposes.
6.1. JoinMyMoment implements and maintains the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, in accordance with Art. 32 GDPR.
6.2. The measures are subject to technical progress. JoinMyMoment may update them, provided that the overall level of security is not reduced.
7.1. General authorisation. The Customer gives JoinMyMoment a general written authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA are listed in Annex 3 and are hereby approved.
7.2. Changes. JoinMyMoment will inform the Customer of any intended addition or replacement of a Sub-processor at least fourteen (14) days in advance, by e-mail to the e-mail address of the Customer's account and by updating Annex 3. The Customer may object to the change in writing within that period on reasonable grounds relating to data protection. The parties will then discuss the objection in good faith. If no solution is found, the Customer may terminate the affected Services and receive a refund of fees paid for Services not yet provided (for example a Moment whose event has not yet taken place).
7.3. Sub-processor obligations. JoinMyMoment imposes on each Sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28(4) GDPR). JoinMyMoment remains fully liable to the Customer for the performance of the Sub-processors' obligations.
7.4. Services that the Customer chooses to connect, such as the Customer's own Google Photos account, are not Sub-processors. When the Customer enables such an integration, it instructs JoinMyMoment to transfer the relevant content to that service, which processes it under the Customer's own agreement with its provider.
8.1. Customer Data is stored in the European Union (see Annex 3). JoinMyMoment transfers Customer Data to a country outside the European Economic Area only where the conditions of Chapter V GDPR are met, in particular:
8.2. The Customer will be informed of any change to the locations or safeguards listed in Annex 3 in accordance with Section 7.2.
9.1. Data subject requests. Taking into account the nature of the processing, JoinMyMoment assists the Customer by appropriate technical and organisational measures, insofar as this is possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR. The Services allow the Customer to view, download and delete the content of its Moments. If a data subject contacts JoinMyMoment directly about Customer Data, we will forward the request to the Customer without undue delay and will not respond to it ourselves without the Customer's authorisation, unless required by law.
9.2. Other obligations. JoinMyMoment assists the Customer in ensuring compliance with its obligations under Art. 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to JoinMyMoment.
9.3. Costs. Assistance under this Section is free of charge, unless the effort is substantial and not caused by a breach of this DPA by JoinMyMoment. In that case, we will agree the costs with the Customer in advance.
10.1. JoinMyMoment notifies the Customer without undue delay, and where feasible within forty-eight (48) hours, after becoming aware of a personal data breach affecting Customer Data. The notification is sent to the e-mail address of the Customer's account.
10.2. The notification describes, as far as the information is available, the nature of the breach, including the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its possible adverse effects. Where the information is not available at once, it is provided in phases without undue further delay.
10.3. JoinMyMoment takes the measures necessary to secure Customer Data and mitigate the possible adverse effects, documents the breach, and supports the Customer in notifying the supervisory authority and data subjects where required. Notifying the supervisory authority and data subjects about Customer Data remains the responsibility of the Customer.
11.1. Storage Period. The content of a Moment (photos, videos, voice messages) and the related Guest data are kept available until sixty (60) days after the end of the Moment, unless a different period is shown in the Services or agreed with the Customer. The Customer may request a longer or shorter Storage Period in writing.
11.2. Return. During the Storage Period, the Customer can download the content of its Moments at any time in full resolution, including as a single archive (the "Download all" function). This is the means by which Customer Data is returned to the Customer.
11.3. Deletion. Customer Data is deleted after the end of the Storage Period, at the latest within thirty (30) days, including copies held by Sub-processors, unless Union or Member State law requires its storage. The Customer may delete individual content at any time in the Services and may request the early deletion of all content of a Moment by e-mail to contact@joinmymoment.com; we carry out such a request within fourteen (14) days and confirm the deletion in writing on request.
11.4. Server logs containing technical data (such as IP addresses) are deleted after at most six (6) months.
12.1. JoinMyMoment makes available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR and this DPA, including this DPA, its annexes and written answers to reasonable security and data protection questionnaires.
12.2. JoinMyMoment allows for and contributes to audits, including inspections, conducted by the Customer or by an independent auditor mandated by the Customer who is bound by confidentiality and is not a competitor of JoinMyMoment. Audits shall be announced at least thirty (30) days in advance, take place during normal business hours without disrupting operations, and take place no more than once in any twelve (12) months, unless a personal data breach has occurred or a supervisory authority requires it. The parties will first try to satisfy the audit request with the information under Section 12.1. Each party bears its own costs of an audit.
12.3. For the data centres of Sub-processors, JoinMyMoment may provide the Sub-processors' current certifications and audit reports (for example ISO/IEC 27001 or SOC 2) instead of an on-site inspection.
If a public authority requests access to Customer Data, JoinMyMoment will, unless prohibited by law, refer the authority to the Customer, inform the Customer without undue delay and give it the opportunity to seek appropriate remedies. JoinMyMoment will only disclose Customer Data where legally required and will limit the disclosure to the minimum required.
Each party's liability under this DPA is governed by Art. 82 GDPR and, otherwise, by the limitations of liability in the Agreement, to the extent permitted by applicable law.
15.1. This DPA applies for as long as JoinMyMoment processes Customer Data, and its obligations continue until all Customer Data has been deleted or returned in accordance with Section 11, even after the Agreement ends.
15.2. JoinMyMoment may amend this DPA in accordance with the Agreement, with at least fourteen (14) days' notice. Amendments may not reduce the level of protection of Customer Data, except where required by law.
15.3. This DPA is governed by the law of Romania, without prejudice to the mandatory provisions of Data Protection Laws and to the powers of the competent supervisory authorities.
15.4. If any provision of this DPA is invalid, the remaining provisions remain in force. The invalid provision shall be replaced by a valid provision that comes closest to the purpose of the invalid one.
15.5. Contact for data protection matters: contact@joinmymoment.com.
| Subject matter | Provision of the JoinMyMoment Services: collecting, storing and sharing photos, videos and voice messages taken by Guests at the Customer's events. |
|---|---|
| Duration | For each Moment, from its creation until the end of the Storage Period and deletion (Section 11). |
| Nature and purpose | Receiving and storing content uploaded by Guests; creating preview images and converting videos into a common format; showing content to the Customer and, according to the Customer's settings, to Guests (including slideshows); counting each Guest's photos against the limit set by the Customer; packaging content for download; sending service e-mails to the Customer about its Moments; checking a Guest's sign-in and e-mail domain where the Customer requires it; transferring content to the Customer's Google Photos account where the Customer enables this; operating, securing and supporting the Services. |
| Categories of data subjects | Guests (for example the Customer's employees, clients and invited guests); persons shown or heard in the content; persons named in content or in Moment details entered by the Customer. |
| Types of personal data |
|
| Special categories of data | The Services are not intended for processing special categories of personal data (Art. 9 GDPR). Content may nevertheless incidentally reveal such data (for example in a photo). JoinMyMoment does not analyse content and does not use facial recognition or any other biometric processing. |
| Place of processing | European Union (see Annex 3). |
Note on voice messages: the optional text transcript is produced by the speech recognition service built into the Guest's own browser (for example Google in Chrome or Apple in Safari), not by a Sub-processor engaged by JoinMyMoment. Customers who do not want this can keep voice messages switched off for their Moment.
| Sub-processor | Purpose | Location of processing |
|---|---|---|
| Scaleway SAS (France) | Storage of photos, videos and voice messages | Paris, France (EU) |
| Hetzner Online GmbH (Germany) | Application servers: handling uploads, video conversion, preparing download archives, server logs | Germany (EU) |
| Google Cloud EMEA Limited (Ireland), with Google LLC (USA) - Firebase and Google Cloud | Database, user authentication, hosting and delivery of the web application, storage of content of older Moments | EU for the database and stored content. Authentication and content delivery may involve processing outside the EEA, covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. |
| Amazon Web Services EMEA SARL (Luxembourg) | Storage of content of older Moments and backup storage | Frankfurt, Germany (EU) |
| ROMARG SRL (Romania) | Website hosting and e-mail server (service e-mails to the Customer and to Guests who sign in) | Romania (EU) |
Not Sub-processors. The following providers do not process Customer Data and are listed for transparency only:
ASQUARED S.R.L. - contact@joinmymoment.com