Data processing agreement
A studio on Lensea is the controller of its clients’ personal data, and Lensea processes that data for it. This is the agreement the two sides need for that under Art. 28 GDPR.
1. Parties and roles
The studio that holds the account is the controller of the personal data in its galleries (the Studio). Ing. Fabian Wimberger, Am Sonnenhang 11, 4240 Freistadt, Austria, operates Lensea and processes that data as a processor (Lensea). Questions and notices go to contact@fabianwimberger.at.
This agreement applies from the moment a Studio signs up and stays in force while the account exists. It is part of the subscription and, for personal data, takes precedence over the terms where the two differ.
2. Subject matter
Lensea stores and delivers what the Studio creates in its dashboard: gallery and collection metadata, uploaded photos with their generated previews, client email addresses entered to view a gallery, hashed download PINs, share links, custom domain records, purchase records for paid downloads, and campaign and favorites data.
The data subjects are the Studio's clients and anyone else whose data the Studio uploads.
3. Instructions
Lensea processes the data only on the Studio's documented instructions. Using the dashboard — uploading, publishing, sharing, emailing clients, selling downloads and deleting — is that instruction; Lensea does nothing else with the data and does not use it for its own purposes.
Lensea informs the Studio without undue delay if an instruction appears to infringe data protection law.
4. Confidentiality
The operator alone has access to the server, database and photo storage. No other staff and no freelancers are involved in running Lensea.
5. Security measures
Transport: every apex, tenant and custom domain is served over HTTPS, with certificates issued and renewed automatically.
Access: studio sign-in is delegated to the platform's identity provider, so account passwords never reach Lensea. Sessions are HttpOnly and SameSite cookies, marked Secure on HTTPS. Each request is scoped to one studio's tenant id, so one studio cannot read another's galleries.
Secrets: gallery passwords and download PINs are stored as salted hashes; share links, invites and unsubscribe links use unguessable tokens; a studio's Stripe API key is encrypted at rest.
Infrastructure: application, database, photo storage and the mail queue run on servers at Hetzner Online GmbH in Germany. There is no third-party analytics, advertising script or external CDN on the platform or on client galleries.
Backups: the operator pulls database snapshots and the photo volume to a machine he controls; the retained set is rotated, and backup copies are used only to restore the service.
6. Sub-processors
Hetzner Online GmbH, Germany — servers, storage and network.
Stripe — card payments for subscriptions on the platform's own Stripe account and, where a studio enables paid downloads, on that studio's own Stripe account. Card details are entered on Stripe's hosted checkout and never reach Lensea's servers.
Email is not a sub-processor: signup and notification mail is sent from Lensea's own server with DKIM signing, and only the destination mailbox and its provider see the message.
Lensea announces a new sub-processor or a replacement by email to the Studio's account address at least 30 days before it starts. The Studio may object; if the objection cannot be resolved, the Studio may end the subscription before the change takes effect.
7. Data subject requests
Requests from clients reach the Studio first; Lensea supports the Studio in answering them. A gallery or photo deleted in the dashboard is removed from the database and its files from storage right away, which is also how an access, erasure or objection request is usually resolved.
8. Retention and erasure
Galleries and photos stay until the Studio deletes them; nothing is expired automatically.
Deleting a gallery or a photo removes the record and its files (original, watermarked copy and previews) immediately.
When a Studio leaves, processing stops. The Studio can delete its galleries itself, or ask for the account and all of its data to be erased; that request is carried out within 30 days. Subscription invoices and payment records are kept for the statutory retention period of seven years, and purchase records of a studio's own sales are the studio's own responsibility.
Data already deleted can survive in backups until the retained set is rotated; it is not read back into the service except to restore it after a failure.
9. Breach notification
Lensea informs the Studio without undue delay after becoming aware of a personal data breach affecting its data, and describes what happened, which data was affected and what was done about it, so the Studio can meet its own 72-hour deadline.
10. Information and audits
Lensea answers reasonable questions about the measures above and makes the documentation behind them available. An on-site audit needs prior arrangement and must not disturb other studios' galleries.
11. End of the agreement
When the subscription ends, Lensea stops processing and, at the Studio's choice, deletes the data as described under Retention and erasure or holds it while the account is settled.
Version 1.0 · contact@fabianwimberger.at