Privacy Policy

As of: September 2026 · Version 1.3

1. Controller

Controller within the meaning of the GDPR:

2. Scope of Application

This Privacy Notice applies to the use of the SaaS platform Pixalo and the associated website. Pixalo is directed exclusively at commercial users (B2B) and offers professional photographers a technical platform to operate digital shops.

Pixalo is neither a marketplace nor a mediator. There are no contractual relations between Pixalo and the end customers of the photographers.

3. Role Allocation under the GDPR

3.1 Pixalo as Controller

Pixalo is the Controller (Art. 4 No. 7 GDPR) for the following processing activities:

• Registration and management of Tenant accounts (photographers)
• Billing of the Pixalo subscription via Stripe
• Operation and security of the platform
• Communication with Tenants
• Visitor statistics of the website (upon consent)

3.2 Pixalo as Processor

Insofar as photographers (Tenants) process personal data of their end customers via the platform, Pixalo acts exclusively as a Processor pursuant to Art. 28 GDPR.

In this case, the Tenant is the Controller for the data processing. A Data Processing Agreement (DPA) is bindingly concluded upon registration.

4. Processed Data and Legal Bases

4.1 Tenant Account Data

Data: Name, email address, company name, address, login credentials, billing details

Legal basis: Art. 6 Abs. 1 lit. b GDPR (performance of contract)

Storage period: Duration of the contractual relationship plus statutory retention periods

4.2 Subscription Payment (Stripe)

Payment of the Pixalo subscription is processed via Stripe. Pixalo transmits necessary details for this to Stripe Payments Europe Ltd. (Ireland).

Legal basis: Art. 6 Abs. 1 lit. b GDPR (performance of contract)

Stripe processes payment details independently. Further details: stripe.com/de/privacy

4.3 Payment Processing by Tenants

Tenants can connect their own payment providers (e.g., Stripe, PayPal). Pixalo merely provides the technical interface.

4.4 Protocol and Security Data

Data: IP address, timestamp, access paths, user-agent, error logs

Purpose: Security, stability, error analysis, abuse prevention

Legal basis: Art. 6 Abs. 1 lit. f GDPR (legitimate interest)

Storage period: Maximum 90 days, unless longer retention is required for investigation

4.5 Legal Records (DPA, AGB)

Data: Time of consent, IP address, document version

Legal basis: Art. 6 Abs. 1 lit. c GDPR (legal obligation)

Storage period: Indefinite (legal burden of proof)

4.6 Contact

When you contact us by email or via our contact form, we process the data you provide (e.g. name, email address, content of the enquiry) exclusively to handle your enquiry. The contact form is operated by us; no external service provider is involved.

Legal basis: Art. 6(1)(b) GDPR (contract initiation/performance) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries)

Storage period: deletion after the enquiry has been fully processed, unless statutory retention obligations apply

4.7 AI-Powered Text Recognition (Class Lists)

Tenants can upload photos of printed or handwritten class lists from which student names and classes are automatically extracted (text recognition). Processing takes place via Amazon Bedrock using Anthropic models; the connection is made via the AWS Frankfurt region (eu-central-1) and inference runs exclusively in AWS EU regions (EU inference profile) — the data does not leave the EU. Inputs and outputs are not used by AWS or Anthropic to train the models and are not permanently stored. The extracted data is shown to the Tenant for review before being imported.

Legal basis: Art. 6(1)(b) GDPR (contract performance); for end-customer data, processing on the Tenant's instructions (Art. 28 GDPR)

Storage period: the list image is processed only for extraction and not permanently stored; imported student data is subject to the regular storage periods

4.8 Newsletter and product information (tenants)

If you have expressly consented during shop setup or elsewhere, we will inform you by email about news, new features and offers from Pixalo. We process your name, email address, language setting and the proof of your consent (time, IP address and the consent text shown to you).

Consent is voluntary and not a prerequisite for using Pixalo. You may withdraw it at any time with effect for the future — via the unsubscribe link in every email or informally to [email protected]. The lawfulness of processing carried out until withdrawal remains unaffected.

Legal basis: Art. 6(1)(a) GDPR (consent); for existing customer relationships additionally § 7(3) UWG.

Retention: until consent is withdrawn or your account is deleted. Proof of consent is kept for the duration of processing to meet the accountability obligation (Art. 5(2) GDPR); after unsubscribing, your address is only kept on a suppression list to prevent further mailings.

5. Photos, Downloads, and Data Minimization

Pixalo consistently pursues the principle of data minimization:

• Preview images: Low resolution, watermarked. No access to originals without purchase.
• Download links: Valid for the period set by the photographer (7 to 90 days from the order, default 7 days). After expiration, access is no longer possible.
• End customer data: Processed exclusively upon instructions of the Tenant (order processing).

6. Retention Periods

7. Hosting and Infrastructure

The platform is operated on servers within the European Union (Amazon Web Services, Frankfurt region / eu-central-1 — hosting, database, object storage, daily database backups and email dispatch via Amazon SES).

Content is delivered via Amazon CloudFront and the Cloudflare network (DNS, reverse proxy, TLS termination, DDoS protection); encrypted content and connection data may be cached or processed at worldwide locations (see Section 9). A complete list of sub-processors is contained in Annex 2 of the DPA.

Legal basis: Art. 6 Abs. 1 lit. b and f GDPR

8. Mobile App (Pixalo Photographer)

The Pixalo Mobile App is used by photographers to start shooting sessions and create student tags.

The app does not store or process photos directly on the mobile device. Photos are processed later via the Pixalo Dashboard.

The app can transmit the following data:

• Session ID
• Tagging information (association of students to photos)
• Photographer's user account (authentication)

Legal basis: Art. 6 Abs. 1 lit. b GDPR (performance of contract)

9. Third Country Transfer

If personal data is transferred to countries outside the EU/EEA, this occurs exclusively on the basis of:

• Adequacy decisions of the EU Commission (Art. 45 GDPR, e.g. the EU-US Data Privacy Framework)
• Standard contractual clauses (Art. 46 Abs. 2 lit. c GDPR)
• Additional technical and organizational protection measures

10. Cookies and Tracking

Pixalo uses a cookie consent banner pursuant to § 25 TDDDG and Art. 6(1)(a) GDPR. Your selection is stored locally in your browser and can be changed or deleted there at any time.

Technically Necessary Cookies

These cookies are required for the operation of the platform and are set without consent.

Legal basis: § 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR

Analytics Cookies

Statistics and analytics tools (currently Google Analytics) are only activated after explicit consent. Data may be transferred to the USA; this is based on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

Legal basis: Art. 6 Abs. 1 lit. a GDPR (consent)

Consent can be revoked at any time via the cookie banner.

Meta Pixel (Facebook and Instagram)

On parts of our website – in particular campaign landing pages and the login and registration pages – we use the Meta Pixel provided by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland). The pixel is loaded only after your explicit consent. If you do not consent, no Meta script is loaded and no data is transmitted to Meta.

The purpose is to measure and evaluate our advertising on Facebook and Instagram: we learn whether an ad led to a page view or to a registration for the free trial, and can target our advertising accordingly. Meta processes, among other things, your IP address, browser and device information, the page visited and the events triggered (e.g. “page view”, “trial interest”, “registration completed”).

In addition, we transmit the same events to Meta from our server via the Conversions API. The reason is that browser extensions and tracking protection frequently block the pixel; without this second channel the measurement would be incomplete. The data listed above is transmitted, along with a SHA-256 hashed version of your email address if you have registered — Meta never receives your email address in plain text. Both channels send the same event identifier so that an action is counted only once. This server-side transmission likewise only takes place with your consent; if you withdraw it, the transmission stops entirely.

For the collection and transmission of this data, we and Meta are joint controllers within the meaning of Art. 26 GDPR; the details are set out in Meta's Controller Addendum. Meta is solely responsible for the subsequent processing of the data.

A transfer of data to the USA cannot be ruled out. This is based on the EU-US Data Privacy Framework and EU standard contractual clauses.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent).

You can withdraw your consent at any time with effect for the future via the cookie banner. Further information on data processing by Meta can be found in Meta's privacy policy.

11. Disclosure of Data

A transfer of personal data only occurs:

• for the performance of the contract (e.g., payment processing via Stripe)
• if there is a legal obligation
• within the scope of order processing with appropriate contracts
• to Meta Platforms Ireland Limited for measuring and targeting our advertising – only after your consent (see section 10.3)

We do not sell your data. Any transfer for advertising purposes takes place solely within the scope of the Meta Pixel described in section 10.3, and only if you have given your explicit consent beforehand.

12. Automated Decision Making

There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.

13. Rights of the Data Subjects

Data subjects have the following rights:

• Access (Art. 15 GDPR) to the processed data
• Rectification (Art. 16 GDPR) of incorrect data
• Erasure (Art. 17 GDPR), provided that no retention obligations exist
• Restriction (Art. 18 GDPR) of processing
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR) to the processing
• Withdrawal of granted consents with effect for the future
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

Please address requests to: [email protected]

Insofar as Pixalo acts as a processor, requests must be addressed to the respective controller (tenant).

Competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen

13.1 Right to Data Erasure

Users have the right to request the erasure of their user account and all associated personal data (Art. 17 GDPR).

Erasure usually occurs within 30 days, unless statutory retention obligations (e.g., tax or commercial retention duties pursuant to § 147 AO, § 257 HGB) prevent this.

14. Changes to this Privacy Policy

This Privacy Policy may be adjusted in the event of legal, technical, or organizational changes. The current version is available at any time on this page.