aftersnap
Pricing Try free for 14 days
What your clients experience
Galleries Slideshow Face recognition Your own domain
What makes your work easier
Proofing gallery Lightroom plugin Snap-ins Vendor galleries
See all features
Example galleries About us Contact Help Center Handbook Magazine
Log in

Data Processing Agreement (DPA)
pursuant to Art. 28 GDPR

between the photographer (hereinafter: the controller)

and
Danyel André Maus, owner of aftersnap.io
Cami des Jardi d'en Ferrer 72, ES-07141 Marratxí
(hereinafter: the processor)

§ 1 Subject matter and duration

(1) The processor provides services to the controller through the aftersnap.io platform (photo gallery SaaS). In the course of providing those services, the processor processes personal data on behalf of and on the instructions of the controller.

(2) This agreement applies for the term of the usage contract between the parties.

§ 2 Nature, purpose and scope of the processing

(1) Nature of the processing: storing, displaying, transmitting and deleting digital photographs and the metadata belonging to them.

(2) Purpose: operating an online photo gallery to present and deliver photographs to the controller’s clients.

(3) Categories of personal data:

  • Digital photographs (which may show natural persons)
  • EXIF metadata (GPS data is removed from preview versions automatically)
  • Email addresses of the controller’s clients (where given for sending out the gallery)

(4) Categories of data subjects: the controller’s clients and the people shown in the photographs.

§ 3 Obligations of the processor

(1) Bound by instructions: the processor processes personal data only on documented instructions from the controller.

(2) Confidentiality: everyone authorized to carry out the processing is bound to confidentiality.

(3) Technical and organizational measures (TOMs):

  • Encrypted transmission (HTTPS/TLS)
  • Password protection for galleries (optional, switched on by the controller)
  • Restricted access to production systems
  • Automatic removal of GPS data from preview versions

(4) Sub-processors (with the controller’s consent):

  • All-Inkl.com (Neue Medien Münnich): server hosting, EU
  • Hetzner Online GmbH: server hosting and AI analysis, EU
  • Impossible Cloud GmbH: object storage for the uploaded original photos, EU
  • Cloudflare, Inc.: delivery and protection of the galleries, USA (on the basis of the EU standard contractual clauses)
  • BunnyWay d.o.o. (bunny.net): delivery of the gallery preview images via a content delivery network, Slovenia/EU

Changes are announced at least 14 days in advance. Within that period the controller may object to a new sub-processor. If the objection stands, the controller may terminate this agreement as of the date the change takes effect.

(5) Support for the controller with data subject rights (access, erasure, rectification) and with the obligations under Art. 32 to 36 GDPR.

(6) Deletion: once the agreement ends, all personal data is deleted within 30 days.

(7) Notification of data breaches without undue delay (within 24 hours where possible).

§ 4 Obligations of the controller

The controller alone is responsible for the lawfulness of the processing, and in particular for having a legal basis (for example the consent of the people shown).

§ 5 Liability

Liability follows the general terms of use of aftersnap.io and Art. 82 GDPR.

§ 6 Final provisions

Spanish law applies; the General Data Protection Regulation remains unaffected. By registering on aftersnap.io, the controller agrees to this contract. The date, the IP address and the version agreed to are recorded.

Last updated: September 2026

← Back to registration

This page is a translation. Where the language versions differ, the German wording applies; which law governs is set out in the terms of use.

With your consent we use Google and Meta on our info pages to measure how ads and content are used. We run no ad tracking in client galleries. You can decline; the site works either way. More in the privacy policy