This Data Processing Agreement (the "Agreement") governs the processing of your clients' personal data that PhotoHeart carries out on your behalf when you use the platform. It implements Article 28 of Regulation (EU) 2016/679 ("GDPR") and Article 33 of Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights ("LOPDGDD").
Terms defined in the GDPR ("personal data", "processing", "controller", "processor", "data subject", "personal data breach") have the same meaning in this Agreement.
1. Parties
Controller: the photographer or studio that holds the PhotoHeart account (the "Controller"), identified by the details of their account and professional profile.
Processor (the "Processor" or "PhotoHeart"):
Company Name: JorgeX Technologies LLC EIN: 61-2301728 Address: 30N Gould St Ste N, Sheridan, WY 82801, USA Data protection contact: privacy@photoheart.app
2. Subject Matter and Scope
2.1. Subject matter
The Processor processes, on behalf of the Controller, the personal data that the Controller enters, collects or generates in PhotoHeart about its own clients and contacts, for the sole purpose of providing the service described in the Terms and Conditions.
2.2. Processing not covered
This Agreement does not apply to the Controller's own data as a PhotoHeart user (account, subscription, subscription billing and platform usage data). For that data, JorgeX Technologies LLC acts as controller and the Privacy Policy applies.
3. Acceptance, Duration and Precedence
3.1. Acceptance
This Agreement forms part of the Terms and Conditions and is accepted together with them. It is in writing in electronic form, in accordance with Article 28(9) GDPR.
3.2. Duration
The Agreement applies for as long as the Processor processes personal data on behalf of the Controller: from the moment the Controller enters the first data until its deletion is completed in accordance with section 14.
3.3. Precedence
In the event of a conflict between this Agreement and the Terms and Conditions regarding the protection of personal data processed on behalf of the Controller, this Agreement prevails. None of its clauses may be interpreted in a way that conflicts with the rights and obligations laid down in the GDPR.
4. Description of the Processing
4.1. Nature and purpose
The Processor provides an online management platform for photographers. The purpose of the processing is to enable the Controller to manage its professional activity with its clients: contacts, appointment bookings, sessions and galleries, contracts with electronic signature, quotes and invoices, and the related communications.
The processing operations are: collection of data through the Controller's public forms (booking, contract signing and gallery selection), recording, organisation, storage, consultation, alteration, generation of PDF documents, disclosure by transmission to the Controller's client when the Controller so instructs (emails and messages), export and erasure.
4.2. Categories of data subjects
- Clients and prospective clients of the Controller
- People who request or book an appointment
- Contract signatories and, where applicable, the second parent or guardian
- Minors included in a contract by their legal representatives
- People who appear in the photographs and videos uploaded by the Controller
- People to whom the Controller gives access to a gallery
- Recipients of quotes and invoices
4.3. Types of personal data
| Category | Data |
|---|---|
| Identification and contact | First and last name, national ID or equivalent document number, email, phone, postal address, social media profiles, important dates, notes and tags added by the Controller |
| Bookings and sessions | Appointments, dates, session type, image selections made by the client |
| Contracts | Signatory details, contract content, accepted checkboxes, digitised handwritten signature, date and time, IP address and browser from which it was signed; identification details and signature of the second parent or guardian; identification details of the minors included |
| Images | Session photographs and videos |
| Billing | Data in the quotes and invoices the Controller issues to its clients |
| Communications | Log of the emails and messages sent to clients on the Controller's instructions |
4.4. Data requiring particular care
The service processes data of minors, identity document numbers, digitised handwritten signatures and images of people. PhotoHeart does not perform facial recognition or any other biometric processing of images.
PhotoHeart is not designed to process special categories of data under Article 9 GDPR (for example, health data). If the Controller chooses to include such data in notes, contracts or images, it is the Controller's responsibility to have a valid legal basis for doing so.
4.5. Duration of the processing
As set out in section 3.2.
5. Instructions from the Controller
The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by Union or Member State law to which the Processor is subject. In that case, the Processor will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
The Controller's documented instructions are this Agreement, the Terms and Conditions, and the actions and settings the Controller applies in its account (for example, creating a contact, publishing a gallery, sending a contract for signature, enabling a notification or connecting an integration). The Controller may give further instructions in writing at privacy@photoheart.app.
The Processor will not use the data for its own purposes. It will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.
6. Obligations of the Controller
The Controller is responsible for:
- Having a legal basis for processing its clients' data and informing them in accordance with Articles 13 and 14 GDPR, including the use of PhotoHeart as a processor
- Obtaining the applicable authorisations, in particular image-use authorisations and those of the legal representatives of minors
- Entering only the data needed for its activity and keeping it accurate and up to date
- Responding to data subjects' requests to exercise their rights
- Meeting its own legal document retention obligations by exporting the data before the service ends (section 14)
- Safeguarding its login credentials and deciding with whom it shares the links and passwords of its galleries, bookings and contracts
7. Confidentiality
The Processor will ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. It will grant its personnel access to the data only to the extent strictly necessary to provide, maintain and support the service.
8. Security of Processing
The Processor will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. The measures in place are described in Annex I.
The Processor may update these measures provided that it does not lower the level of security.
9. Sub-processors
9.1. General authorisation
The Controller grants the Processor a general authorisation to engage other processors ("sub-processors"). The current sub-processors are listed in Annex II.
9.2. Changes
The Processor will inform the Controller, by email or by a notice in the platform, of any intended addition or replacement of sub-processors at least 30 days in advance, so that the Controller can object before the change takes effect. Objections are sent in writing to privacy@photoheart.app. If the parties do not find a solution, the Controller may cancel the service before the change takes effect, in accordance with the Terms and Conditions.
9.3. Same obligations
The Processor will impose on each sub-processor, by way of a contract, the same data protection obligations as those set out in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organisational measures. Where a sub-processor fails to fulfil its obligations, the Processor remains fully liable to the Controller.
10. International Transfers
The Processor is a company established in the United States and some sub-processors may process data outside the European Economic Area. The service's database and files are hosted in the European Union (see Annex II).
Transfers of personal data to a third country will only take place on the Controller's documented instructions set out in this Agreement and in compliance with Chapter V GDPR: on the basis of an adequacy decision of the European Commission (Article 45) or of appropriate safeguards, such as the standard data protection clauses adopted by the Commission (Article 46(2)(c)).
The Controller agrees that, where the Processor engages a sub-processor whose activity involves an international transfer, both may ensure compliance with Chapter V GDPR by using those standard clauses, provided that the conditions for their use are met.
11. Data Subject Rights
It is for the Controller to respond to its clients' requests concerning the rights of access, rectification, erasure, objection, restriction of processing, data portability and not to be subject to automated individual decision-making.
If the Processor receives a request directly from a data subject, it will promptly notify the Controller and will not respond itself, unless authorised to do so by the Controller.
The Processor assists the Controller through the platform's features, which allow it to view, correct, export and delete its clients' data. If those features are not enough to deal with a request, the Controller may ask for help at privacy@photoheart.app.
12. Assistance to the Controller
Taking into account the nature of the processing and the information available to it, the Processor will assist the Controller in ensuring compliance with its obligations regarding:
- Security of processing (Article 32 GDPR)
- Notification of personal data breaches to the supervisory authority and their communication to data subjects (Articles 33 and 34)
- Data protection impact assessments and prior consultation of the supervisory authority (Articles 35 and 36)
13. Personal Data Breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the data processed on its behalf. The notification will be sent to the email address of the Controller's account and will include at least:
- The nature of the breach, including, where possible, the categories and approximate number of data subjects and data records concerned
- A contact point where more information can be obtained
- The likely consequences and the measures taken or proposed to address the breach and mitigate its possible adverse effects
Where it is not possible to provide all the information at the same time, it will be provided in phases without undue further delay.
It is for the Controller to assess whether the breach must be notified to the supervisory authority within the period laid down in Article 33(1) GDPR and communicated to the data subjects.
14. End of the Service: Return and Deletion
14.1. Return
The Controller may obtain a copy of the data at any time from Settings → Storage: an export of the structured data (contacts, sessions and selections, quotes and invoices, signed contracts with their PDFs, appointments and catalog) and a separate export of the original files. The export is offered again before the account deletion is confirmed.
14.2. Deletion
Once the provision of the service has ended, the Processor deletes the personal data processed on behalf of the Controller:
- Account deletion: the data is deleted according to the schedule set out in section 7.3 of the Terms and Conditions. Once started, deletion is irreversible.
- Subscription cancellation without deleting the account: the data is kept for the periods set out in that same section, so that the Controller can export it or reactivate the service, and is deleted afterwards.
14.3. Data that is kept
Only mandatory tax and accounting records are kept, anonymised, for six years. No other data is kept under this exception.
Signed contracts and their PDFs are deleted together with the rest of the data. If the Controller is legally required to keep those documents, it must export them beforehand: under Article 33(3) LOPDGDD, it is the Controller who ensures their retention.
15. Information and Audits
The Processor will make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and in this Agreement, and will allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.
Audits are requested in writing at privacy@photoheart.app, with reasonable notice, and may be carried out at reasonable intervals or where there are indications of non-compliance. The parties will agree their scope in advance in order to protect the confidentiality of the data of the Processor's other customers.
16. Non-compliance and Termination
If the Processor is in breach of its obligations under this Agreement, the Controller may instruct it to suspend the processing until it complies again, or cancel the service in accordance with the Terms and Conditions. The Processor will promptly inform the Controller if, for whatever reason, it is unable to comply with this Agreement.
The Processor may terminate the service insofar as it concerns the processing of personal data where, after having informed the Controller that an instruction infringes the applicable legal requirements, the Controller insists on compliance with that instruction.
17. Changes
The Processor may amend this Agreement to adapt it to changes in the law or in the service. Significant changes are notified by email, in accordance with section 15 of the Terms and Conditions. The "last updated" date indicates the version in force.
18. Governing Law
This Agreement is governed by the GDPR and, for matters not covered by it, by the law and jurisdiction set out in section 16 of the Terms and Conditions.
19. Contact
Data protection: privacy@photoheart.app General support: support@photoheart.app
Annex I. Technical and Organisational Measures
| Area | Measure |
|---|---|
| Separation between accounts | Row-level security policies in the database: each account can only access its own data |
| Access control | The Controller accesses the service through an authenticated account; account deletion operations require verifying identity again |
| Files | Session photographs and contract and invoice PDFs are kept in private storage and served through temporary signed URLs |
| Galleries | Access by link and, if the Controller sets one, a password, of which only a hash is stored |
| Encryption in transit | Communications with the application and the database take place over HTTPS/TLS |
| Integration credentials | The tokens of the integrations connected by the Controller are kept in an encrypted secrets store |
| Contract integrity | Each signed contract keeps an integrity hash of its content and the record of the date, IP address and browser of the signature |
| Traceability | Audit log of operations such as contract signing, bookings, data export and account deletion |
| Minimisation | Analytics tools are not loaded on public gallery, booking and contract pages; the messaging service logs mask phone numbers |
| AI assistant | Requests to the model provider are sent with the option that denies data collection by the provider |
| Portability and deletion | Export of data and original files at the Controller's request; deletion process at the end of the service |
Annex II. Sub-processors
| Sub-processor | Service | Data processed | Location of processing |
|---|---|---|---|
| Supabase | Database, authentication and file storage | All the data in section 4.3 | European Union (Frankfurt) |
| Vercel | Hosting of the web application and its functions | Data in transit and access logs | Global network; may process data outside the EEA |
| Resend | Sending emails to the Controller's clients | Email address, name and message content | United States |
| OpenRouter | Access to language models for the AI assistant; only if the Controller uses it | Conversation content and the account data the assistant looks up in order to answer | May process data outside the EEA |
| Hostinger | Server for the WhatsApp notification service; only if the Controller connects its number | Recipient's phone number and message content | May process data outside the EEA |
Integrations connected by the Controller. Google Calendar, Gmail, the Controller's own SMTP mail server and WhatsApp operate with the Controller's own accounts. When the Controller connects them, PhotoHeart sends the necessary data to those accounts on the Controller's instructions. The providers of those accounts are not sub-processors of PhotoHeart: their relationship is directly with the Controller.
Services outside this Agreement. Stripe handles payment of the Controller's subscription, and analytics tools measure the Controller's use of the website and the application. They do not process the data of the Controller's clients on the Controller's behalf and are described in the Privacy Policy.
Legal References
- Regulation (EU) 2016/679 (GDPR), Articles 28, 32, 33 and 44 to 46
- Spanish Organic Law 3/2018 (LOPDGDD), Article 33
- Commission Implementing Decision (EU) 2021/915: standard contractual clauses between controllers and processors
- AEPD: Guidelines for drafting contracts between controllers and processors (in Spanish)
Related documents: