Minors' Data Addendum to the DPA — School and Nursery Modules
Version 2.0 — May 5, 2026
School and Nursery Modules — Article 8 of the GDPR
Preamble
This addendum (hereinafter "the Addendum") supplements the Data Processing Agreement (hereinafter "the DPA") concluded between Attimo (Processor) and the photographer subscribed to the Platform (Data Controller, hereinafter "the Client").
It exclusively concerns the processing of personal data relating to minors implemented within the framework of the School and Nursery modules of the Attimo Platform.
This Addendum applies only when the Client uses one of these modules. It is accepted by the Client upon first use of the relevant module by means of a separate checkbox.
Article 1 — Purpose of the Addendum
The purpose of the Addendum is to define the specific conditions under which Attimo processes, on behalf of the Client, personal data relating to minors within the framework of school photography activities and photography in early childhood facilities.
It specifies in particular:
- The categories of minors' data processed.
- The methods of collecting parental authorization.
- The rights of parents and minors themselves.
- The specific obligations of each Party.
- The particular rules applicable to the School module (FFPMI contract, French Circular No. 2003-091).
Article 2 — Minors' Data Processed
2.1 School Module
Within the framework of the School module, the categories of data processed are:
- Students' first name and last name (used to identify individual galleries).
- Class or school level.
- Individual and group photographs.
- Sibling links (for calculating sibling discount).
- Parents' contact details (email, phone) for sending access codes to individual galleries.
2.2 Nursery Module
Within the framework of the Nursery module, the categories of data processed are:
- Children's first name and last name.
- Individual and group photographs.
- Parents' contact details (email, phone) for sending access codes to individual galleries and, where applicable, for collecting digital parental authorization.
- Digital parental authorizations (yes/no responses, timestamp, IP address).
Article 3 — Collection of Parental Authorization
3.1 General Principle
In accordance with Article 8 of the GDPR and the French Data Protection Act, the processing of personal data of a minor requires the authorization of the holders of parental authority. The Client is solely responsible for the effective and compliant collection of this authorization.
3.2 School Module — Management by the School
Within the framework of the School module, the collection of parental authorizations is the exclusive responsibility of the School (primary school, middle school, high school), in accordance with French Circular No. 2003-091 of June 5, 2003 relating to school photography.
The School is responsible for sending image rights authorizations to parents prior to the photo sessions, collecting their responses, and verifying class by class that students whose parents have refused do not participate in the sessions.
Attimo does not process any parental authorization within the framework of the School module. Parents' contact details possibly recorded in the Platform (emails, phones) are exclusively used for sending access codes to students' individual galleries, once the sessions have been carried out and the authorizations validated by the School.
3.3 Nursery Module — Digital Parental Authorization
Within the framework of the Nursery module, the Attimo Platform integrates a digital parental authorization module allowing the management of the establishment to send an encrypted link to each parent to collect their consent (yes/no) prior to the photo sessions.
When this module is used, Attimo processes parents' emails on behalf of the Client to collect this consent. The responses are timestamped and retained for evidential value.
If the Client collects parental authorizations by another means (paper, external system, direct email), Attimo does not process any consent data. The Client remains solely responsible for the retention and proof of the collection of authorizations.
Article 4 — Legal Basis of Processing
The legal basis for processing minors' data within the framework of the School and Nursery modules rests on:
- Prior parental authorization (Article 8 of the GDPR), obtained according to the methods described in Article 3.
- The execution of a contract between the School / Nursery and the Client (photographer).
- For France in school matters: French Circular No. 2003-091 of June 5, 2003 and the FFPMI contract (French Federation of Photography and Image Professions).
The Client guarantees that they have all the necessary authorizations before any uploading of photographs to the Platform.
Article 5 — Specific Obligations of Attimo
Within the framework of this Addendum, Attimo undertakes to:
- Process minors' data only for the purposes described in this Addendum.
- Implement the reinforced technical measures provided for in Article 6.
- Not use minors' photographs for commercial, advertising or artificial intelligence model training purposes.
- Allow the effective exercise of the rights of the holders of parental authority under the conditions provided for in Article 8.
- Delete data according to the durations provided for in Article 7.
- Strictly isolate the data of each establishment and each child (multi-tenant architecture, individual galleries secured by unique access code).
Article 6 — Reinforced Security Measures
Given the sensitive nature of minors' data, Attimo implements the following measures:
6.1 Access to individual galleries
- Each child's individual gallery is protected by a unique, randomly generated access code.
- The codes are sent to parents by email and/or SMS, according to the Client's choices.
- No public directory lists the galleries: they are only accessible with the corresponding code.
- A child's gallery does not allow access to the galleries of other children, even within the same class or the same establishment.
6.2 Transmission of access codes
- Secure sending by email (TLS connection) and/or SMS via the SMS Envoi provider (France).
- Access codes are never publicly displayed or transmitted to unauthorized third parties.
6.3 Storage of photographs
- Photographs stored encrypted on OVH Object Storage (Gravelines, France).
- Temporary signed access URLs (HMAC) with 2-hour expiration.
- Watermark applied to public versions of photographs (protection against unauthorized download).
- Protection against right-click, drag-and-drop and source code inspection.
Article 7 — Retention Periods
7.1 School Module — France (FFPMI contract)
Photographs from school galleries taken in France within the framework of the FFPMI contract are retained in accordance with Article 5 of said contract, i.e. for a maximum of one (1) month after the end of the relevant school year.
The Client (photographer) is contractually committed to the School, via the signed FFPMI contract, to proceed with the deletion of photographs within this period. It is up to the Client to use the technical deletion tools made available by the Platform (manual deletion of the gallery or session, non-activation of paid extension) to comply with this contractual obligation.
7.2 School Module — Outside France
For school galleries taken outside France, the retention period is set by the Client in accordance with their own contract with the establishment and the applicable local legislation. The Attimo contractual cap of 12 months per lifecycle (renewable via paid extension) applies.
7.3 Nursery Module
Photographs and galleries of the Nursery module are retained for the duration set by the Client, with a cap of 12 months per lifecycle. An additional 12-month extension is possible via payment (€5) in accordance with Attimo's gallery lifecycle policy.
The Client is responsible for compliance with their commitments to families and the host establishment regarding this duration.
7.4 Associated data
- Orders and invoices: 10 years (legal accounting obligation).
- Digital parental authorizations (Nursery module): gallery retention period + 3-year archiving for evidential value.
- Individual gallery access logs: 1 year, then automatic purge.
Article 8 — Rights of Holders of Parental Authority
8.1 Exercisable rights
Holders of parental authority of a minor whose data is processed by the Platform may exercise the following rights:
- Right of access to their child's data.
- Right to rectification.
- Right to erasure (right to be forgotten).
- Right to restriction of processing.
- Right to object.
- Right to withdraw consent.
8.2 Right to withdraw consent
Parents may withdraw their consent at any time. Withdrawal results in:
- Immediate cessation of the processing of the child's data.
- Deletion of the child's individual photographs within 72 hours.
- Cessation of parents' access to the child's individual gallery.
The withdrawal of consent has no retroactive effect on already delivered orders: prior purchases remain acquired by the parents. Any orders in progress but not yet delivered are subject to case-by-case treatment between the parent and the Client (photographer), Attimo not intervening in this commercial relationship.
8.3 Methods of exercising rights
Requests for the exercise of rights may be addressed to:
- Directly to the Client (photographer), main data controller.
- To Attimo at [email protected], who will transmit to the Client for processing.
Attimo accompanies the Client in the technical implementation of these rights (data deletion, extraction, etc.) within a maximum period of 5 working days from the request.
Article 9 — Specific Obligations of the Client
Within the framework of this Addendum, the Client undertakes to:
- Collect or ensure that prior parental authorizations are collected according to the methods specific to each module.
- Verify with the School or nursery that authorizations have been obtained before any uploading of photographs.
- Not upload photographs of children whose parents have expressly refused.
- Strictly comply with French Circular No. 2003-091 of June 5, 2003 for activities in France: prohibition of any direct commercial canvassing of parents, prohibition of any advertising on sales materials, prohibition of remuneration of establishment personnel.
- Comply with the photograph deletion deadlines provided for in Article 7, particularly for French school galleries subject to the FFPMI contract.
- Respond to requests for the exercise of rights by holders of parental authority within legal deadlines.
- Inform Attimo of any situation likely to affect the lawfulness of the processing.
Article 10 — FFPMI Contract and Establishment Documents
Within the framework of the School module, the Attimo Platform makes available to the Client:
- An FFPMI contract template (French Federation of Photography and Image Professions) automatically pre-filled with the information of the School and the photographer, compliant with French Circular No. 2003-091 of June 5, 2003. This template is intended exclusively for use in France.
- An electronic signature tool allowing establishment management to sign contracts online, with audit trail (SHA-256 hash, IP address, timestamp).
- For interventions outside France: a free text editor allowing the Client to draft their own contract with pre-filled dynamic variables (establishment name, address, commission, etc.). Attimo does not provide any contract template for countries other than France; the drafting of the contract is the sole responsibility of the Client.
The use of the French FFPMI template does not exempt the Client from verifying its adequacy with their particular situation. The template is provided for indicative purposes only and does not replace validation by a legal professional if the Client deems it necessary.
Article 11 — Breach Notification
In case of a personal data breach specifically concerning minors, Attimo notifies the Client within a maximum of 24 hours (instead of 48 hours provided for in the main DPA), given the particularly sensitive nature of this data.
The notification includes a precise assessment of the potential impact on the minors concerned and emergency measures taken.
The Client undertakes to inform the School or nursery as well as the holders of parental authority if the breach presents a risk to the rights and freedoms of the minors concerned.
Article 12 — Liability
Each Party remains responsible for compliance with their respective obligations provided for in this Addendum and by the GDPR.
The Client acknowledges that they are solely responsible for:
- The effective and compliant collection of prior parental authorizations.
- Compliance with contractual obligations towards Schools and nurseries with which they contract, including commitments relating to retention periods and the deletion of photographs (in particular Article 5 of the FFPMI contract).
- Compliance with French Circular No. 2003-091 of June 5, 2003 and the deontological rules of the profession.
- The quality and legality of contracts drafted for interventions outside France via the free editor.
Article 13 — Term and Termination
This Addendum enters into force upon first use of the School or Nursery modules by the Client and remains in force as long as the Client uses one of these modules.
The activation and deactivation of the School and Nursery modules on the Client's account fall under Attimo's sole competence, based on the subscription plan subscribed by the Client and on administrative decisions made by Attimo (dedicated administration interface).
In case of deactivation of a module or termination of the Main Contract, minors' data processed within the framework of the relevant module is deleted in accordance with the deadlines provided for in Article 7 and Article 11 of the main DPA.
Article 14 — Articulation with the Main DPA
This Addendum is annexed to the main DPA concluded between the Parties and forms an integral part of it. The provisions of the main DPA apply to all processing not specifically governed by this Addendum.
In case of contradiction between the main DPA and this Addendum, the provisions of this Addendum prevail with regard to the processing of minors' data.
Attimo — Frédéric Gras Photographe — SIRET 453 606 253 00020
38 avenue de Tournaisis, 78990 Élancourt, France
[email protected] — attimo-gallery.com