Data Processing Agreement (DPA)
The binding version is the Spanish version: DPA
Simplified Summary: This document governs how Batwomanhub S.L. handles personal data provided by you, as a professional client, for the purpose of photographic services. We guarantee information security, limit access to authorized personnel, and detail the external providers (hosting and forms) that process this data under strict EU regulations.
Table of Contents:
Updated 12 October 2026.
1. Definitions and Parties
This Data Processing Agreement (hereinafter, "DPA") is entered into between the Client, acting as the Data Controller, and Batwomanhub S.L., located at Calle de Fuencarral, 142, 28004 Madrid, with a share capital of 3,000 € and under the direction of Carmen Torres Díaz, acting as the Data Processor.
This agreement is governed by Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).
2. Subject Matter and Duration
The purpose of this DPA is to ensure that the processing of personal data carried out by Batwomanhub S.L. on behalf of the Client is conducted in accordance with current legislation. This agreement comes into force upon the contracting of the service and remains in effect for the duration of the contractual relationship, extending until the total deletion of data as provided in our terms of service.
3. Categories of Data and Subjects
Processing is limited to the data necessary for the execution of photographic services (corporate portraits, products, etc.). Categories include:
- Subjects: Client employees, models hired by the client, or legal representatives.
- Data: Names, email addresses, phone numbers, facial images (photographs), and contact details for session coordination.
4. Processor Obligations
Batwomanhub S.L. undertakes to:
- Process data solely according to the documented instructions of the Controller.
- Ensure that authorized personnel are subject to strict confidentiality.
- Not transfer data to third countries outside the European Economic Area without express consent and appropriate legal safeguards.
- Assist the Controller in fulfilling requests regarding data subject rights (access, rectification, erasure).
5. Authorized Sub-processors
The Controller authorizes the use of the following sub-processors necessary for the provision of the service:
| Provider | Function | Location |
|---|---|---|
| Arsys Internet S.L.U. | Web hosting and storage | Logroño, Spain |
| FormSubmit | Contact form management | United States (with GDPR guarantees) |
6. Security and Incident Notification
Batwomanhub S.L. implements appropriate technical and organizational measures to prevent loss, alteration, or unauthorized access to data. In the event of a security breach, the Processor shall notify the Controller without undue delay, providing available information regarding the nature of the incident.
7. Return and Deletion of Data
Upon completion of the service, Batwomanhub S.L. will proceed to return or delete personal data. In accordance with our business rules, source files (RAW) and backups will be kept for a maximum period of 6 months before definitive deletion, unless a longer period is required by law.
8. Audit and Jurisdiction
The Controller has the right to conduct reasonable audits to verify compliance with this DPA. Any dispute arising from this agreement shall be submitted to the courts and tribunals of the city of Madrid.
For claims regarding data protection, the supervisory authority is the Agencia Española de Protección de Datos (AEPD), located at C/ Jorge Juan 6, 28001 Madrid (www.aepd.es).
For any questions regarding this agreement, you may contact us at [email protected] or by calling 91 566 20 83.