This annex forms an integral part of the Terms and governs the personal data processing that Race Day Vault (processor) carries out on behalf of the Organizer (controller): the participants' photographs and, when selfie search is enabled, the biometric data derived from them. Processing lasts from upload until the event is deleted.

Instructions: Race Day Vault processes this data only on the Organizer's documented instructions, given through the platform's features (upload, feature activation, deletion), and solely to provide the service described in these Terms;
Confidentiality: persons authorized to process the data are bound by confidentiality obligations;
Security: Race Day Vault applies appropriate technical and organizational measures, including encryption in transit, per-account and per-event access controls, and certified infrastructure providers;
Sub-processors: the Organizer gives general authorization for the use of specialized technology providers (hosting, storage, payments, communications and search features), bound by contracts with safeguards equivalent to those in this annex. Provider changes affecting this processing are communicated at least 30 days in advance, and the Organizer may object on justified grounds;
Assistance: Race Day Vault provides reasonable assistance to the Organizer in responding to data subject requests and in meeting security and impact assessment obligations;
Data breaches: Race Day Vault notifies the Organizer without undue delay after becoming aware of a personal data breach affecting the data processed on their behalf;
Deletion: at the end of the service (event archiving, early deletion by the Organizer or account deletion), the data is deleted as described in the Privacy Policy, except where retention is required by law;
Information and audits: Race Day Vault makes available to the Organizer the information necessary to demonstrate compliance with Art. 28 GDPR and allows reasonable audits, upon written notice and without access to third-party data.