Live Chilli
Data Processing Agreement
This Data Processing Agreement ("DPA") applies when you use Live Chilli features that process personal data on your instructions, especially Find me (face recognition on gallery photos and guest selfies). By enabling Find me (or otherwise instructing us to process as described below), you accept this DPA.
1. Parties and roles
- Controller: you, the Live Chilli account holder who uploads and publishes event photos and decides to enable Find me.
- Processor: Live Chilli (livechilli.com), operated by Chilli. We process data only to provide the Service on your documented instructions.
For your account login data, Live Chilli is typically an independent controller as described in the Privacy Notice.
2. Subject matter and duration
We process personal data in your galleries for as long as the gallery/feature is active and for a short period afterward needed for deletion, backups, and security. When you turn Find me off, we delete the face index for that gallery. Consent audit logs follow gallery lifetime unless withdrawn earlier.
3. Nature and purpose of processing
On your instruction when Find me is enabled:
- derive face embeddings from photos in that gallery and store them in a gallery face index;
- process a guest selfie in memory to match against that index (selfie not stored);
- store guest Find me consent records (email, time, version, technical hashes) and send confirmation/withdrawal emails.
Purpose: to let consenting guests find photos of themselves in your gallery. We do not use this data for our own marketing or to train unrelated models.
4. Types of data and data subjects
- Data: gallery photos and derived face embeddings; guest email and consent metadata; technical logs needed for security/abuse prevention.
- Subjects: people appearing in your event photos; guests who use Find me.
5. Your instructions and responsibilities (Controller)
You instruct us to process as above when you enable Find me on a gallery. You confirm that:
- you have a lawful basis under GDPR (including Art. 9 where biometric data is involved) to enable face recognition on that event's photos;
- you inform guests that face recognition is active (the gallery shows a notice; you remain responsible for event-appropriate notice/consent);
- you will not instruct us to process data unlawfully;
- you handle guest privacy requests that relate to your Content, and we will assist reasonably as processor.
6. Our obligations (Processor)
- process only on your documented instructions (including this DPA and in-product settings);
- ensure persons authorised to process are under confidentiality;
- implement appropriate technical and organisational security measures;
- engage sub-processors only as needed to run the Service (hosting, email delivery, and auth providers such as Google if used), under written terms that provide equivalent protection;
- assist you with data-subject requests and with security/breach notifications where legally required;
- delete or return personal data when you disable Find me / delete a gallery, subject to legal retention needs;
- make available information reasonably necessary to demonstrate compliance with Art. 28.
7. International transfers
If a sub-processor processes data outside the EEA/UK, we use appropriate safeguards (such as EU Standard Contractual Clauses) where required.
8. Security incidents
We will notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, with information reasonably available to help you meet your obligations.
9. Hierarchy
If this DPA conflicts with the Terms for processing of personal data under Art. 28, this DPA prevails for that subject. Contact: hello@livechilli.com.
Practical draft for Live Chilli product use. Not legal advice. Have qualified counsel review before relying on it in a dispute. Version id used in product logs: 2026-08-30.