Skip to content
Casco Antiguo • Mon-Fri 10-7, Sat 10-2 By appointment only 95 460 94 08

Data Processing Agreement (DPA)

The binding version is the Spanish version available at DPA

Updated 14 October 2026

Simplified Summary:
  • This document governs how Asterniva S.L. handles data provided to us by a corporate client.
  • We act as the "Data Processor," strictly following the instructions of the client.
  • We use secure providers for data storage and transmission.
  • We guarantee the deletion of files once the service is completed and the storage period expires.

1. Definitions and Parties

This Data Processing Agreement (hereinafter, "DPA") is entered into between the Client (hereinafter, the "Data Controller"), any legal entity contracting the services of Asterniva S.L., and Asterniva S.L., with registered office at Calle San Fernando, 42, 41004 Sevilla, represented by its director Javier Ramos López (hereinafter, the "Data Processor").

This agreement is governed by Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).

2. Purpose and Duration

The purpose of this DPA is to ensure that the processing of personal data carried out by the Processor on behalf of the Controller is performed in accordance with European regulations. The duration of this agreement coincides with the validity of the main contractual relationship, as detailed in our terms of service.

3. Categories of Data and Subjects

Processing is limited to the data necessary for the execution of photography services:

  • Subjects: Employees, executives, models, or clients of the Data Controller.
  • Categories: Facial images, names, contact email addresses, and billing information.
  • Purpose: Production of visual material, retouching, and delivery of final files.

4. Obligations of the Processor

Asterniva S.L. undertakes to:

  • Process data solely according to the documented instructions of the Controller.
  • Ensure that authorized personnel are subject to strict confidentiality.
  • Not transfer data to third countries outside the European Economic Area without prior consent.
  • Assist the Controller in fulfilling data subject requests (access, rectification, erasure).

5. Authorized Sub-processors

The Controller authorizes the appointment of the following sub-processors necessary for the provision of the service:

  • Raiola Networks S.L. (Avenida de Magoi 66, 27002 Lugo): Provider of hosting infrastructure and storage.
  • FormSubmit (US-based service): Management of contact forms and reception of initial requests.

6. Security and Incident Notification

The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encrypted transfers and restricted access control.

In the event of a data security breach, Asterniva S.L. will notify the Controller without undue delay after becoming aware of it, providing the information necessary to comply with the notification to the Spanish Data Protection Agency (AEPD).

7. Return, Deletion, and Audit

Upon completion of the service, the Processor will return or delete the personal data. In accordance with our business rules, RAW files will be kept for a maximum period of 6 months for backup and recovery purposes, after which they will be permanently deleted.

The Controller has the right to conduct reasonable audits to verify compliance with this DPA, subject to prior written notice.

8. Applicable Law and Jurisdiction

This agreement is governed by Spanish law. For any dispute, the parties expressly submit to the jurisdiction of the courts of the city of Sevilla, waiving any other jurisdiction that may correspond to them.

For further inquiries, you may contact us at [email protected] or call 95 460 94 08.