Data Processing Agreement

How we process, on your behalf, the personal data of other people that you upload to Polimake.

Last updated: November 5, 2026

This agreement governs how Polimake processes the personal data its customers upload to the services, in accordance with Article 28 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Article 33 of Spanish Organic Law 3/2018 (LOPDGDD) and the model published by the Spanish Data Protection Agency (AEPD).

It forms part of the Terms of service and you accept it together with them when you create your account or sign up for a plan. It applies whenever you upload other people's personal data to Polimake. If you need a copy signed by both parties, ask for it at dpo@polimake.com.

1. Parties and roles

The Controller is you, the Polimake customer: the person or company that owns the account and decides what data it uploads and why.
The Processor is NEBULAR MEDIA SLU (Polimake), Tax ID B56931686, Calle Platería 6, Piso 2B, 30004 Murcia, Spain. Data protection contact: dpo@polimake.com.
This agreement covers only the data Polimake processes on the Controller's behalf. The data Polimake processes for its own purposes (the customer's account, billing, security or commercial communications) is governed by the privacy policy.

2. Subject matter, duration, nature and purpose

Subject matter. Polimake processes the personal data contained in the Controller's content only to provide the contracted services: the cloud, desktop app sync, Studio, the AI design agent and the assistant connector.
Processing operations: collection and recording when files are uploaded; storage and backups; organization and structuring; format conversion and preview generation; AI analysis to tag, describe and search; generation of designs from the Controller's instructions; consultation; disclosure to the people the Controller shares with and to the social networks it decides to publish to; erasure.
Duration. The same as the services contract. When it ends, section 14 applies.

3. Data and data subjects

Types of data: images and videos in which people appear, with their image and voice; names, contact details and other data contained in files, metadata, texts and comments; names and emails of team members and guests; and instructions given to the AI.
Data subjects: the Controller's clients and their representatives; the people who appear in the files; the Controller's employees, collaborators and guests; and any other person whose data the Controller decides to upload.
Special categories. The service is not designed for special categories of data (health, ethnic origin, political opinions, religion, sex life, or biometric data used to identify a person). The Controller will not upload them unless necessary and lawful, and will not ask Polimake to identify people by their face.

4. The Controller's instructions

Polimake processes the data only on the Controller's documented instructions, which are: the Terms of service, this agreement and what the Controller does in the service (upload, share, publish, ask the AI, delete). If Polimake considers that an instruction infringes the GDPR or another data protection rule, it will inform the Controller immediately.

5. The Processor's obligations

Polimake undertakes to:

Not use the data for its own purposes. It will never use it for anything other than providing the service. In particular, it will never use it to train artificial intelligence models, its own or third parties', or as a showcase or in advertising, unless the Controller expressly authorizes it.
Keep the record of processing activities it carries out on the Controller's behalf (art. 30.2 GDPR).
Not disclose the data to third parties, except to authorized sub-processors (section 8), to those the Controller decides to share with or publish to, or where the law requires. In that last case, it will inform the Controller beforehand, unless the law prohibits it.
Apply the security measures in Annex I.
Assist the Controller with data subjects' rights (section 10), security breaches (section 11) and impact assessments (section 12).
Make available to the Controller the information needed to demonstrate compliance with this agreement and allow audits (section 15).

6. Confidentiality

Polimake will keep the data confidential, also after the agreement ends. Only the members of its team who need it to provide the service will access it; they have committed in writing to confidentiality and know their data protection obligations. Polimake keeps that documentation available to the Controller.

7. Security

Polimake applies the technical and organizational measures appropriate to the risk required by Article 32 GDPR, described in Annex I. It may improve them over time, but never lower their level of protection.

8. Sub-processors

Authorization. The Controller authorizes Polimake to engage the sub-processors in Annex II.
Changes. Before adding or replacing a sub-processor, Polimake will notify the Controller by email at least 30 days in advance, stating who it is, what it will do and where.
Objection. The Controller may object on reasonable data protection grounds within that period, by writing to dpo@polimake.com. If no solution is found, the Controller may terminate the agreement at no cost, and Polimake will refund the part paid that was not enjoyed.
Same obligations. Each sub-processor is contractually bound to the same obligations as Polimake under this agreement. Polimake remains fully liable to the Controller for what its sub-processors do.

9. International transfers

All sub-processors process data in the European Union except sign-in (Auth0), which is currently in the USA and which we are moving to the EU. Polimake only allows this with the safeguards of Chapter V GDPR: the EU-U.S. Data Privacy Framework (DPF), if the sub-processor participates, or the European Commission's standard contractual clauses (Decision 2021/914, processor-to-processor module), with supplementary measures where needed.

10. Assistance with data subjects' rights

If a person exercises their rights of access, rectification, erasure, objection, restriction or portability before Polimake over the Controller's data, Polimake will forward the request to the Controller by email by the next working day at the latest, without answering it on its own except to tell the person to contact the Controller. Polimake will help the Controller respond to those requests, through the service's features or as is reasonable.

11. Security breaches

Polimake will notify the Controller of any breach of the security of its data without undue delay and, in any case, within 48 hours at most of becoming aware of it, by email to the account address.
The notification will include, at least: the nature of the breach, with the categories and approximate number of data subjects and records concerned; a contact point for more information; the likely consequences; and the measures taken or proposed to address it and mitigate its effects.
If it is not possible to provide all the information at once, it will be provided in phases, without delay.
Notifying the AEPD and the data subjects is the Controller's responsibility. Polimake will help with the information it has.

12. Impact assessments and prior consultation

Polimake will help the Controller, with the information it has, to carry out data protection impact assessments and, where applicable, prior consultation with the supervisory authority.

13. The Controller's obligations

The Controller undertakes to:

have a legal basis for processing the data it uploads, and the consent or authorization required by law to use the image of the people who appear in its files (Spanish Organic Law 1/1982);
inform the data subjects of the processing;
give instructions that comply with the law and supervise the processing;
not upload special categories of data except on the terms of section 3.

14. End of processing: return or erasure

When the agreement ends, the Controller can download its data for at least 30 days, through the service's features or by requesting an export (section 20 of the Terms of service). Within that period it can also choose to have Polimake hand the data over to another provider it designates.
Afterwards, Polimake will erase the data and all copies. Backups are deleted in their normal cycle and, at the latest, 90 days after the end of the agreement.
If the law requires any data to be kept, Polimake will keep it blocked, available only to the authorities and for the legal period (art. 32 LOPDGDD), and will erase it afterwards.
At the Controller's request, Polimake will certify the erasure in writing.

15. Audits and inspections

Polimake will make available to the Controller the information needed to demonstrate compliance with this agreement: first, documentation, reports and certifications. If that is not enough, the Controller, or an independent auditor bound by confidentiality, may carry out an audit with reasonable notice of at least 30 days, during business hours, without accessing other customers' data or compromising the security of the service. Each party bears its own costs, unless the audit reveals a material breach by Polimake.

16. Data protection contact

For any question about this agreement, the Controller can write to dpo@polimake.com.

17. Liability and order of precedence

Each party's liability is governed by the Terms of service and Article 82 GDPR.
If a processor determines the purposes and means of processing on its own, it becomes a controller for that processing (art. 28.10 GDPR).
On data protection matters, this agreement prevails over the Terms of service and any other agreement between the parties.

18. Changes

Polimake may update this agreement to adapt it to legal or service changes, giving at least 30 days' notice, as set out in section 25 of the Terms of service. Changes will never lower the protection of the data.

Annex I. Security measures

Encryption of communications with TLS between your device, our servers and our providers.
Access control based on roles and least privilege: each team member accesses only what they need.
Separation of each account's content, and permissions per project, folder, collection and file, decided by the Controller.
Authentication handled by a specialized provider, with no passwords stored by Polimake.
Logging of sensitive operations, to detect and investigate incidents.
Regular backups, to recover data after an incident.
Minimization: hashed summaries instead of IP addresses where they are enough, and no more data than needed.
Providers selected for their security guarantees, with a data processing agreement and equivalent obligations.
Incident management: a procedure to detect, contain, notify and document security breaches.
Periodic security reviews, including code and configuration audits.
Team confidentiality in writing and data protection training.

Annex II. Authorized sub-processors

Sub-processor	Service	Location	Safeguard if outside the EU
Cloudflare, Inc.	Application servers, databases and file and preview storage (R2)	EU	DPF and standard contractual clauses
DigitalOcean, LLC	Cloud server and database	EU	DPF and standard contractual clauses
Qdrant Solutions GmbH (Qdrant Cloud)	Semantic search index of the content	EU	Does not leave the EU
Google (Google Ireland Ltd. and Google LLC)	Gemini AI, under paid terms with no training: image analysis in the cloud and the design agent	EU	DPF and standard contractual clauses
Vercel Inc.	Website hosting and delivery	EU	DPF and standard contractual clauses
Auth0 (Okta, Inc.)	Sign-in for the Controller's users and guests	USA (moving to the EU)	DPF and standard contractual clauses

Polimake will update this list using the procedure in section 8.

Related documents: Terms of service · Privacy policy · Cookie policy · Legal notice