Luma Albums
Português
Data processing agreement
Luma Studio · Last updated: 24 October 2026
This agreement is part of the Luma Studio terms and applies to every subscription with no need to sign it. The parties are the subscribing photographer ("Controller") and Nelson Silva, sole trader trading as VisualMind, Portuguese tax number (NIF) 257272259, business address Rua de São Vicente, 20, Braga, Portugal ("Processor"). It meets Article 28 of the General Data Protection Regulation (GDPR). If you need a signed copy, ask at [email protected].
1. Subject and duration
The Processor hosts and displays the album proofs the Controller publishes, receives clients' comments and approvals, and sends the service's emails. The agreement lasts as long as the Processor holds data from the Controller's proofs.
2. Data and data subjects
| Data subjects | Data |
|---|---|
| The Controller's clients and anyone they invite to view the proof | Client name and email, if entered; spread images, which may show people; comments and their positions; name of whoever approved; dates; IP address, used only in memory to limit requests; PIN session cookie. |
| People photographed | Their image, in the published spreads. |
The service is not meant for special categories of data (Art. 9 GDPR). If an image reveals them, the Controller ensures it has a lawful basis to process them.
3. Instructions
The Processor processes the data only to provide the service and on the Controller's instructions. Those instructions are given by using the app and the service (publishing, changing, deleting, sending emails), by these terms, and in writing. The Processor will say so if it believes an instruction breaks the law. It does not use the data for its own purposes: it does not analyse it, sell it or train models on it.
4. Confidentiality
Only people who need access to keep the service running have it, and they are bound to confidentiality.
5. Security (Art. 32)
- Encrypted connections (HTTPS) and a server in the European Union, behind Cloudflare's protection.
- Random proof links, of which only a hash is stored. Optional PIN, stored hashed, with limited attempts.
- Each account sees only its own proofs; random access tokens, stored hashed.
- Images checked on upload; storage quotas and limits on emails and requests.
- Daily backups kept for 14 days, with a copy off the server in Cloudflare R2, EU jurisdiction, encrypted at rest.
- Server logs without IP addresses and without the codes in proof links.
6. Sub-processors
The Controller authorises these sub-processors:
| Entity | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Server | Germany |
| Cloudflare, Inc. | Proxy, protection and backups (R2, EU jurisdiction) | Global network; backups stored in the EU |
| Brevo (Sendinblue SAS) | Emails to clients and to the photographer | France |
The Processor binds them to data protection obligations equivalent to this agreement. It emails the Controller at least 30 days before adding or replacing a sub-processor. If the Controller objects on reasonable grounds and no solution is found, the Controller may cancel the subscription and receive the unused part of the paid period.
7. International transfers
The data is stored in the European Union. Cloudflare may process data in transit outside the European Economic Area to deliver and protect the service. That processing relies on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
8. Assisting the Controller
The app and the service let the Controller view, correct and delete proofs and their data. If a data subject asks the Processor to exercise their rights, it forwards the request to the Controller without answering it directly. The Processor helps, as far as reasonable, with impact assessments and consultations with the supervisory authority.
9. Data breaches
The Processor notifies the Controller without undue delay, and within 48 hours at most, after becoming aware of a breach affecting its data. It describes what happened, which data and data subjects are affected, the likely consequences and the measures taken.
10. End of processing
The Controller can delete proofs at any time. When the subscription ends, the proofs stay read-only for 30 days and are then deleted. They leave the backups within 14 days of deletion at most. The original images and albums always stay on the Controller's Mac, so there is no data to return beyond what the app already receives (comments and approvals).
11. Information and audits
The Processor gives the Controller the information needed to show it complies with this agreement. It answers reasonable questionnaires and allows audits with 30 days' notice, at most once a year, except after a data breach or at an authority's request. Audits are carried out without putting at risk the security or confidentiality of other customers' data.
12. The Controller's obligations
The Controller ensures it has a lawful basis for the data it publishes, including the images of people photographed, and tells its clients that the proofs are hosted on Luma Studio.
This is a translation; if it differs from the Portuguese version, the Portuguese version prevails.