Data Processing Agreement (DPA)
pursuant to Art. 28 GDPR
between the photographer (referred to below as the Controller)
and
Danyel André Maus, owner of aftersnap.io
Cami des Jardi d'en Ferrer 72, ES-07141 Marratxí
(referred to below as the Processor)
§ 1 Subject matter and duration
(1) The Processor provides services to the Controller through the aftersnap.io platform (photo gallery SaaS). In providing those services, the Processor processes personal data on behalf of and on the instructions of the Controller.
(2) This agreement applies for the term of the use contract between the parties.
§ 2 Nature, purpose and scope of the processing
(1) Nature of the processing: storing, displaying, transmitting and deleting digital photographs and the metadata belonging to them.
(2) Purpose: operating an online photo gallery in order to present photographs to the clients of the Controller and make them available to them.
(3) Categories of personal data:
- Digital photographs (which may show natural persons)
- EXIF metadata (GPS data is removed from preview versions automatically)
- Email addresses of the clients of the Controller (where given for sending out the gallery)
(4) Categories of data subjects: the clients of the Controller and the people shown in the photographs.
§ 3 Obligations of the Processor
(1) Processing on instructions: the Processor processes personal data solely on documented instructions from the Controller.
(2) Confidentiality: everyone authorised to carry out the processing is bound to confidentiality.
(3) Technical and organisational measures (TOMs):
- Encrypted transmission (HTTPS/TLS)
- Password protection for galleries (optional, switched on by the Controller)
- Restricted access to production systems
- Automatic removal of GPS data from preview versions
(4) Sub-processors (with the approval of the Controller):
- All-Inkl.com (Neue Medien Münnich): server hosting, EU
- Hetzner Online GmbH: server hosting and AI analysis, EU
- Impossible Cloud GmbH: object storage for the uploaded original photos, EU
- Cloudflare, Inc.: delivery and protection of the galleries, USA, on the basis of the EU standard contractual clauses
- BunnyWay d.o.o. (bunny.net): delivery of the gallery preview images via a content delivery network, Slovenia/EU
Changes are announced at least 14 days in advance. Within that period the Controller may object to a new sub-processor. If the objection is maintained, the Controller may terminate this agreement with effect from the date on which the change takes effect.
(5) Support for the Controller with data subject rights (access, erasure, rectification) and with the obligations under Art. 32 to 36 GDPR.
(6) Erasure: after the agreement ends, all personal data is deleted within 30 days.
(7) Notification of personal data breaches without undue delay (within 24 hours where possible).
§ 4 Obligations of the Controller
The Controller alone is responsible for the lawfulness of the processing, in particular for having a legal basis (the consent of the people pictured, for example).
§ 5 Liability
Liability is governed by the general terms of use of aftersnap.io and by Art. 82 GDPR.
§ 6 Final provisions
Spanish law applies; the General Data Protection Regulation is unaffected by this. By registering on aftersnap.io, the Controller accepts this agreement. The date, the IP address and the version accepted are logged.
Last updated: September 2026
This page is a translation. Where the language versions differ, the German wording applies; which law governs is set out in the terms of use.