Data Processing Agreement
Processing terms for professionals and organizations that control client or team data in Glamorph.
Last updated: November 6, 2026
Glamorph is operated by CHOSTELIDIS ANGELOS TOU KONSTANTINOU, based in Greece (VAT ID: EL171051670). The full operator details, including the address, form part of this agreement through the linked Terms: Terms of Service
This agreement is part of the Terms of Service when you use Glamorph to manage personal data for your business. The professional or organization identified in the account or workspace is the controller: it decides why and how that data is used. Glamorph is the processor: it handles that data on the controller's instructions. For account, billing, security and support data that Glamorph uses for its own purposes, the Privacy Policy explains our separate responsibilities.
Scope and duration
We process data through the features you enable: hosting, storage, synchronization, client management, booking, documents, photos and videos, payments and messages. Processing continues while we provide those services and complete the applicable return or deletion process. The people concerned may include clients, booking customers, contacts and team members. Data may include contact details, appointments, notes, photos, signatures and payment references. Health-related sensitivities and records about children may be included only when lawfully provided.
Your instructions and responsibilities
Your authorized actions in Glamorph and written support requests document your instructions. You decide the lawful purposes, access permissions, privacy notices and legal bases, including any additional condition needed for sensitive data. We process data only on documented instructions unless the law requires otherwise. Where permitted, we inform you of any such legal requirement before processing. We tell you if an instruction appears to break data-protection law. Authorized personnel must be bound by confidentiality.
Security, assistance and data breaches
We maintain technical and organizational measures appropriate to the risk under GDPR Article 32. Taking account of the processing and information available to us, we assist with data-subject requests, security duties, impact assessments and regulatory consultation. We notify the controller without undue delay after becoming aware of a personal-data breach affecting its data and provide available information and cooperation needed to respond.
Data Storage & Security
Our main application and database servers are hosted by Hetzner in the European Union. Photos, videos and other files are stored in Cloudflare R2 with access restricted by default. They are delivered through controlled links or through a link or gallery an authorized professional chooses to share. Connections are encrypted using TLS 1.2 or later. Mobile sign-in credentials use the operating system’s secure storage: iOS Keychain or Android Keystore. Account permissions, team roles and technical and administrative controls also restrict access. No system guarantees absolute security.
Other providers that process data for us
You give general authorization for the providers listed below to process your data on our behalf for the services you enable. These providers are called subprocessors. A provider you contract with directly is not automatically our subprocessor. We give advance notice of intended additions or replacements and an opportunity to object. We require equivalent data-protection duties from subprocessors and remain responsible for their processing obligations. Transfers to other countries need an applicable lawful safeguard. This agreement alone does not provide one.
- Cloudflare (R2 and CDN): media storage and delivery, network security and hosting for our websites. Private content uses controlled access. An authorized professional can intentionally publish a booking page or share a document, link or gallery. Privacy Policy
- Hetzner: EU application and database hosting. Privacy Policy
- Expo: Delivers app notifications to your device. Receives a device identifier and the notification content. Privacy Policy
- Amazon Web Services SES: transactional and permitted marketing-email delivery using the recipient address and message content. Privacy Notice
- Twilio: optional SMS delivery and business-number registration. Receives recipient phone numbers, message content, delivery and opt-out data, and the business information required for number registration. Privacy Policy
- Meta / WhatsApp: optional business connection and WhatsApp messages. Receives business and phone-number identifiers, recipient numbers, template/message content and delivery information. Privacy Policy
International Data Transfers
Our primary application servers are in the European Union, and our configured PostHog and Sentry projects use EU hosting. Other providers—including Apple, Google, RevenueCat, Stripe, SumUp, Square, Cloudflare, Expo, Amazon Web Services, Twilio, Meta, and their partners—may process data in other countries. Where applicable law requires a transfer mechanism, we rely on safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses, or another lawful mechanism used by the relevant provider.
Return, deletion and accountability
When processing ends, we return or delete your data at your choice and delete copies unless the law requires retention. The applicable retention process, expiry of backup copies and other controllers' rights in shared workspaces still apply. We provide the information needed to demonstrate compliance and allow audits, including inspections, by you or an authorized auditor. We coordinate these reasonably to protect confidentiality, security and other customers' data.
Relationship with other terms
These processing terms prevail over conflicting general terms for this processing. They do not restrict mandatory GDPR obligations, data-subject rights or supervisory-authority powers. Contact privacy@glamorph.com for instructions, processing questions or an audit request.