Privacy Notice

In this privacy notice, we inform you about the processing of personal data when using our website or platform.

Personal data is information that relates to an identified or identifiable person. This primarily includes information that allows conclusions to be drawn about your identity, such as your name, telephone number, address or email address. However, personal data also includes certain identifiers such as your IP address or the device ID of the device you are using.

1. Responsible Person and Contact Person

The contact person and data controller for the processing of your personal data when you visit this website is

GotPhoto, Inc., 433 Broadway, New York, NY 10013, United States

Email: privacy@gotphoto.com

If you have any questions about data protection in connection with our services or the use of our website, you can contact us at any time using the above mentioned email address.

2. Data Storage and Integration

2.1 AWS Aurora and AWS DynamoDB

We use AWS Aurora and AWS DynamoDB from Amazon Web Services EMEA Sarl, 38 John F. Kennedy, L-1855, Luxemburg (“AWS”) to store your data. These databases may store the following information:

• Your details: email address, phone number (if applicable), first name, last name
• Subject details: first name, last name, group/grade, teacher, gender, birthdate, organization, address
• Order details: Billing address, purchased products and photos, order amount, order date, delivery address
• Technical data: IP Address, User-Agent / Browser Information, Operating System, Referrer URL, Cookies, Timestamp, Session ID
• Data analytics: location (based on IP address), device/browser information, where did they come from (referral), user behaviour and events (clicks, scrolls, session recordings, task completion, etc)

Data processing by AWS is necessary to provide you with the secure storage of your data.

The AWS Data Processing Addendum (https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf) is incorporated into the AWS service terms.

Further information can be found in AWS’ privacy policy at https://aws.amazon.com/privacy/.

2.2 Snowflake

We use Snowflake provided by Snowflake Computing Netherlands B.V., FOZ Building, Gustav Mahlerlaan 300-314,  1082 ME Amsterdam, Netherlands (“Snowflake”) as a data warehouse. Snowflake enables us to securely store and analyze all data.

All data in Snowflake is anonymized and encrypted.

Further information can be found at https://www.snowflake.com/privacy-policy/.

2.3 Airbyte

Airbyte provided by Airbyte, Inc., 2261 Market Street, Suite 4381, San Francisco, CA 94114, United States (“Airbyte”) is a powerful data integration engine that enables us to consolidate all of the data processed and stored in the databases and data warehouse listed above. We have an interest in identifying changes in the source file and replicating them in the target system, thus properly synchronizing the data across all systems we use.

For our core data we have deployed the self-managed version of Airbyte in our own infrastructure. The data does not leave our servers and Airbyte has no access to any of the data processed.

2.4 Metabase

Metabase provided by Metabase, Inc., 9740 Campo Rd. Suite 1029, Spring Valley, CA 91977 (“Metabase”) is a data intelligence tool that we use to visualize data, gain insights from such data and share the corresponding reports with our team for collaborative data analysis.

We self-host Metabase on our servers and Metabase has no access to any of the data processed.

Further information on data processing by Metabase can be found at https://www.metabase.com/privacy-policies.

3. Data Processing on our Website

3.1 Accessing our Website / Technical Information

Each time you use our website, we collect technical information that your browser automatically transmits to enable you to visit the website. This technical information consists of the so-called HTTP header information, including the user agent, and includes in particular

• IP address of the requesting device,
• Method (e.g. GET, POST), date and time of the request,
• Address of the requested website and path of the requested file,
• if applicable, the previously accessed website/file (HTTP referrer),
• Information about the browser and operating system used,
• Version of the HTTP protocol, HTTP status code, size of the delivered file,
• Request information such as language, type of content, encoding of content, character sets,
• If applicable, the user name applied for authentication in the case of directory password protection.

The processing of this technical information is absolutely necessary to enable your visit of the website, to ensure the permanent functionality and security of our systems and to maintain our website. The technical information is temporarily stored in internal log files for the purposes described above, limited in content to what is absolutely necessary, in order to find the cause and take action in the event of repeated or criminal access that jeopardizes the stability and security of our website. For these storage purposes your IP address will be anonymized immediately.

3.2 Contact

You have several options to contact us. These include email, telephone, our contact form and our live chat. In this context, we process data exclusively for the purpose of communicating with you.

The data collected by us when you contact us will be automatically deleted after your enquiry has been fully processed, unless we still need this data to fulfil contractual or legal obligations (see section 7 “Storage period”).

3.2.1 Contact Form

The contact form, which can be accessed via our Help Centre (https://help.gotphoto.com/hc/de), is provided by Freshworks Inc, 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, United States, who process your data on our behalf. We have a data processing agreement in place with Freshworks Inc.

Further information on data protection can be found here: https://www.freshworks.com/legal/.

3.2.2 Live Chat (HubSpot)

Our live chat, which is used to improve communication with website visitors, is provided by HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland (“HubSpot”).

In order to answer live enquiries, the chat content you provide is collected and stored for the duration of the chat. We only collect your email address and telephone number, if you voluntarily provide them to us and give us permission to contact you subsequently. The chat will be deleted immediately as soon as the chat conversation has ended.

We have concluded a data processing agreement with HubSpot.

Further information can be found in HubSpot’s privacy policy.

3.3 Registration for Photographers and User Authentication

We manage registration, user logins, access permissions and security protocols with cidaas, an authentication tool provided by Widas ID GmbH, Maybachstrasse 2, 71299 Wimsheim, Germany (“cidaas”).

You have the option to register for a user account in order to use the full range of functionalities of our software and to operate a photography online shop via our platform.

The data fields first and last name, the selection criteria (professional or amateur photographer or photo order), email address, telephone number (optional), desired domain or shop name must be provided by you. Registration is not possible without the provision of this data.

Moreover, cidaas processes the following information for authentication and security purposes:

• User Identification: Email addresses or other unique identifiers used for logging in (could include other personal details such as name, phone, customer number, PID etc.)
• Authentication Credentials: Passwords, multi-factor authentication tokens, and other security mechanisms.
• Access and Authorization Data: Roles, permissions, and access levels associated with each user to control what resources they can access.
• Audit Logs: Records of login attempts, password changes, access history, and other related activities for security and compliance purposes.
  We have concluded a data processing agreement with Widas ID GmbH. Further information on data processing by cidaas can be found here: https://www.cidaas.com/privacy-policy/.

3.4 Orders

Photographers have the option to order software licenses or physical products in our online shop. During the ordering process we collect the mandatory information required to fulfil the contract:

• First name and surname,
• Email address,
• Telephone number,
• Billing and shipping address.

3.5 Newsletter

You have the option to subscribe to our newsletter, in which we regularly inform you about webinars, new guides, innovations to our products and promotions.

You can unsubscribe from the newsletter at any time. A corresponding unsubscribe link can be found in every newsletter. A message to the contact details given above or in the newsletter (e.g. by email or letter) is also sufficient for this purpose.

3.6 Advertising to Existing Customers by Email

If you register for a user account or make a purchase from us, we will also use your contact details to send you further information about our products and services by email (“existing customer advertising”). This may include news, promotions and offers as well as feedback and other surveys.

You can object to the use of your data for advertising purposes at any time by clicking on the corresponding link in the emails or by sending a message to the contact details given above (e.g. by email or letter).

3.7 Surveys

You have the opportunity to take part in one of our surveys. We use the results of these surveys to improve our service.

You can object to receiving a satisfaction survey and the use of your data for advertising purposes at any time by clicking on the corresponding link in the emails or by sending a message to the above-mentioned contact details (e.g. by e-mail or letter).

3.8 Contests

In the context of contests, we use your data for the purpose of organizing the contest and notifying the winners. Detailed information can be found in the terms and conditions for the respective contest.

3.9 Job Applications

You can apply for open job positions by email or via our career portal. The purpose of data collection is the selection of applicants for the possible establishment of an employment relationship. In order to process your application, we collect the data you provide (usually: first and last name; email address; application documents such as references and CV; earliest possible starting date for the job; channel through which you became aware of the job advertisement; telephone number; salary expectations). We would like to point out that confidentiality cannot be guaranteed if application documents are sent by email without encryption.

Ashby, Inc, 49 Geary Street, Suite 411, San Francisco, CA, 94108, United States, is providing our career portal and managing applications. We have concluded a data processing contract with the provider. The provider’s privacy policy can be accessed here: https://www.ashbyhq.com/resources/privacy.

We store your personal data upon receipt of your application. If we accept your application and an employment relationship is established, we will store your application data for as long as it is required for the employment relationship and to comply with statutory regulations.

If we reject your application, we will store your application data for a maximum of three months following the rejection, unless you give us your consent to store it for longer. If you have given us explicit consent, we will store your data in our pool of applicants for a further twelve months after the end of the application process in order to identify any other interesting positions for you and to contact you again if necessary. After this period, the data will be deleted. You can revoke this consent at any time for the future by sending us an email to jobs@fotograf.de.

4. Use of Tools on the Website

This website uses various services and applications (collectively “tools”) that are provided either by us or by third parties.

The tools we use are listed below organized by category. We inform you about the providers of the tools, the collection of data and the transfer of data to third parties.

In the event that the information in the consent banner contradicts the information in this privacy notice, the information in this privacy notice shall take precedence.

4.1 Technologies Used

Some of the tools used on this website use technologies to store or access information on your device:

• Cookies: Information stored in the browser, consisting of a cookie name, a value, the storing domain and an expiry date. So-called session cookies are deleted after the session, while other cookies are deleted after the specified expiry date. Cookies can also be removed manually.
• Local Storage / Session Storage: Information stored in the browser, consisting of a name and a value. Information in session storage is deleted after the session, while information in local storage has no expiry date and remains stored. Information in local and session storage can also be removed manually.
• Fingerprints: Profile stored by a service, created on the basis of automatically transmitted connection information (“passive fingerprinting”) and/or by retrieving the information through scripts (“active fingerprinting”) (in particular IP address, information about end user device, browser, plugins/add-ons, operating system, language, time zone, scripts, fonts, screen resolution, time of access). Fingerprints make it possible to recognize visitors. They cannot be prevented completely. However, active fingerprinting can be reduced or prevented by blocking scripts. In this case, however, most services will no longer work.
• Pixel/ web beacon: A graphic automatically loaded by a service which makes it possible to recognise visitors or, for example, to determine when an email has been opened. Similar to fingerprints, information can be retrieved and profiles can be created. The use of pixels can be prevented by blocking images in emails.

Information about the cookies we use can be found in our cookie declaration at https://www.gotphoto.com/cookie-declaration/. This cookie declaration is automatically generated by Usercentrics.

4.2 Data Processing and Opting-Out

4.2.1 Necessary and Optional Data Processing

We use tools strictly necessary for the operation of our website to customize the use of our website and to make it more convenient and as time-saving as possible. In certain cases, these tools may also be necessary for the fulfilment of a contract or for the implementation of pre-contractual measures. Access to and storage of information on your device is absolutely necessary in these cases.

We also use other tools, for instance tools to improve the user experience on our website and to offer you more functions and tools for statistical recording and analysis of general user behavior. In these cases, where legally required, we give you the opportunity to opt out of data processing. Where legally required, you can also refuse to give a tool access to and store information on your device.

4.2.2 Opting Out

In states, where the provision of an opt-out mechanism is legally required, we use a consent management tool to manage and store your consent. Cookiebot is a tool provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (“Usercentrics”). The tool generates a consent banner that informs you about the data processing on our website and gives you the opportunity to opt out of data processing for analytical and advertising purposes. This banner appears the first time you visit our website and when you call up the selection of your settings again in order to change them. The banner will also appear on subsequent visits to our website if you have deactivated the storage of cookies or if the cookies or information in Usercentrics’ local storage have been deleted or have expired.

When you visit our website, your consent or opt-out, your IP address, information about your browser, your device and the time of your visit are transmitted to Usercentrics. Usercentrics also stores the necessary information on your device in order to retain your consents and opt-outs. If you delete your cookies or information in local storage, we will ask you for your consent again when you visit the site at a later date.

4.2.3 Revoking Your Consent or Changing Your Selection

In states, where this is legally required, you can revoke your consent given for certain tools at any time. To do so, click on the following button:

Change cookie settings

By clicking the button you can also change the selection of tools you wish to consent to and obtain additional information on the tools used. Please be advised that we have only implemented a consent management tool in states, where an opt-out mechanism is legally required. Alternatively, you can revoke your consent for the use of certain tools directly with the provider.

4.3 Essential Tools

We use certain tools to enable the basic functions of our website (“essential tools”). Without these tools, we would not be able to provide our service. Access to and storage of information in the end device is absolutely necessary in these cases.

4.3.1 Google Tag Manager

Our website uses Google Tag Manager, a service provided in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and for all other geographical areas by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, United States (together “Google”).

Google Tag Manager is used exclusively to manage website tools by integrating so-called website tags. A tag is an element that is stored in the source code of our website in order to execute a tool, for example through scripts. If these are optional tools, they will only be integrated by Google Tag Manager with your consent.

Google collects information about the tags integrated through our website for the purpose of ensuring stability and functionality for the use of Google Tag Manager, but generally no personal data is collected, in particular no data about user behavior, the IP address or the pages visited.

We have concluded a data processing agreement with Google Ireland Limited.

Further information can be found in Google’s privacy policy.

4.3.2 Freshdesk (HelpCentre)

We use Freshdesk provided by Freshworks Inc, 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, United States (“Freshworks”) for our HelpCentre.

In our HelpCentre you can, for example, ask questions about our services, the website or our company and leave us a comment.

When using Freshdesk, the IP address of the device and the address of the subpage from which you access Freshdesk are recorded. Moreover, Freshdesk processes all data, messages and other material provided by you through the HelpCentre. This may include your first name, last name, business name, telephone number and email address.

We have a data processing agreement in place with Freshworks Inc.

Further information on data protection can be found here: https://www.freshworks.com/legal/.

4.3.3 jam.dev

We use jam.dev by Jam, Inc., 4806 Ribbecke Ave, Unit B, Austin, TX 78721, United States (“jam.dev”) for incident reporting.

The tool enables us to capture bugs reported by you, diagnose them and resolve technical issues brought to our attention. The bug reports provided by you may include screen recordings displaying personal data. Personal data that may appear on screen recordings, includes names, images, or other identifying information. Recordings are automatically deleted after a specified retention period.

4.3.4 Intercom

Intercom is a provider of proactive customer engagement tools. These tools are provided in the United States by Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, United States and for all other geographical areas by Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18-21 St. Stephen’s Green, Dublin 2, Ireland (together „Intercom“).

We use Intercom to share relevant technical information related to the GotPhoto platform, for instance downtimes, planned maintenance, bugs, new features or significant system changes. Intercom also enables us to offer you context-sensitive help and information in the form of tool tips and product tours as well as guidance around the best usage of the GotPhoto platform. Educating our customers can help them make more money and save time. All this information is displayed in the admin area of our customers’ GotPhoto account.

The following information is processed by Intercom in order to provide the described features: customer first name, last name, email address and basic user behavior (page visits).

We have concluded a data processing agreement with Intercom.

4.4 Functional Tools

We also use optional tools to improve the user experience on our website and to offer you more functions (“functional tools”). Although these are not absolutely essential for the basic functionality of the website, they can bring significant benefits to visitors, particularly in terms of user-friendliness and the provision of additional communication, display or payment channels.

4.4.1 FIN AI Chatbot

Our website uses FIN, a service provided in the United States by Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, United States and for all other geographical areas by Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18-21 St. Stephen’s Green, Dublin 2, Ireland (together „Intercom“).

FIN is an AI chatbot that uses sophisticated AI language models to automatically solve customer service issues. The AI chatbot understands complex queries, asks clarifying questions and fully converses with the user.

The following information is processed: any personal data contained in questions, data, content or information submitted by you during each conversation with FIN.

FIN uses OpenAI as a sub-processor of any personal data submitted to FIN. Any processing of personal data by OpenAI is governed by a data processing agreement in place between Intercom and OpenAI.

OpenAI has activated zero retention for all customer inputs and outputs. As a result, the inputs and outputs will not be stored by OpenAI. OpenAI is contractually prohibited from using customer data to improve or train its AI model.

We have concluded a data processing agreement with Intercom.

4.4.2 tl;dv

We use the meeting assistant tl;dv provided by tldx Solutions GmbH, Kaiser-Friedrich-Allee 51, 52074 Aachen, Germany (“tl;dv”).

tl;dv records, transcribes and summarizes meetings. It provides valuable insights from the meetings. tl;dv processes the following data:

• Your name and email address to set up meeting
• IP address
• geographical location (approximate)
• operating system, browser type, version
• browser configuration, plugins
• language preferences, cookie data
• pages accessed (date, time, URL, title, length of visit)
• device type, device settings, application IDs, unique device identifiers
• video recording and transcript of the meeting.

More information on data processing by tl;dv can be found here: https://tldv.io/privacy/.

4.4.3 Gong

Gong is a revenue intelligence platform provided by Gong.io, Inc., 201 Spear Street, 13th Floor, San Francisco, CA 94105, United States (“Gong”).

We use Gong to record, transcribe and analyze sales calls. The call recordings are also used for internal training purposes to improve the communication with our (potential) customers.

“Gong bot” joins each scheduled sales call to record the session (both audio and video are recorded). Each call is transcribed from speech to text and analyzed by conversation analytics technology.

Gong processes the following data:

• (Potential) customer’s name, email, phone number, time zone, usually city, state, and country,
  lead status, lifecycle stage
• (Potential) customer’s business address, phone number, GMV, company size, number of heads
• Contract commitment/commitment, history of deals
• Meeting/call/interaction (like a text or email) that we have with the (potential) customer

We have concluded a data processing agreement with Gong.io, Inc.

4.5 Analysis Tools

In order to improve our website, we use optional tools for statistical recording and analysis of general user behavior based on access data (“analysis tools”). We also use analysis services to analyze the use of our various marketing channels.

4.5.1 Google Universal (Google Analytics)

Our website uses Google Analytics, a service provided in Europe, the Middle East and Africa (EMEA) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and for all other geographical areas by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (together “Google”).

Google Analytics uses JavaScript and pixels to read information on your device, as well as cookies to store information on your device. Google Analytics serves to evaluate your usage behavior and improve our website. We will process the information obtained to analyze your use of the website and to compile reports on website activity for the website operator.

We have chosen the following data protection settings for Google Analytics:

• IP anonymization (shortening of the IP address before evaluation so that no conclusions can be drawn about your identity);
• Automatic deletion of old logs/limitation of storage duration;
• Deactivated Measurement Protocol;
• Deactivated cross-page tracking (Google signals);
• Deactivated data sharing with other Google products and services.

The following data is processed by Google Analytics:

• IP address;
• Referrer URL (previously visited page);
• Pages accessed (date, time, URL, title, length of visit);
• Downloaded files;
• Clicked links to other websites;
• If applicable, achievement of certain goals (conversions);
• Technical information: Operating system; browser type, version and language; device type, make, model and resolution;
• Approximate location (country and, if applicable, city, based on anonymised IP address).

We have concluded a data processing agreement with Google Ireland Limited.

Further information can be found in Google’s privacy policy.

4.5.2 PostHog

Our website uses PostHog, an analysis tool provided by PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, United States (“PostHog”).

PostHog tracks user behavior on and interaction with our website. We use this information to improve product performance, troubleshoot issues and optimize the overall user experience.

PostHog processes anonymized behavioral data such as clicks, page views, session duration, and interaction events.

Further information on data processing by PostHog can be found in https://posthog.com/privacy.

4.5.3 HubSpot

Our website uses an analysis and tracking tool from Hubspot. This tool can be used to monitor and analyze visitors’ interactions with our website. This helps us to attribute your visits to specific campaigns we have created and generally analyze the sources for our website traffic. The tool can recognize and differentiate between new and returning visitors.

The following data is processed by HubSpot:

• IP address
• geographical location
• type of browser
• duration of visit
• websites accessed
• actions you take on our site, such as page views, clicks, form submissions, and other.

We have concluded a data processing agreement with HubSpot.

Further information can be found in HubSpot’s privacy policy.

4.5.4 Microsoft Clarity

Our website uses Clarity, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, United States (“Microsoft”).

Clarity is a behavioral analysis tool that captures how you use and interact with our website through metrics, heatmaps, and session replay. In order to do so, the following information is processed: IP address, location, browser information, visited website and subpages, date and time of access to the website, clicks, scrolls and mouse movements. Clarity assigns each user a unique user ID and uses tracking technologies to determine online activity. We use this information for site optimization and advertising.

For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement: https://privacy.microsoft.com/en-gb/privacystatement.

4.5.5 Google Meet

Google Meet is a service provided in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and in all other geographic areas by Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, United States (together “Google”).

We use Google Meet to conduct and record interviews with our (prospective) customers in order to get feedback on our products and services. Google processes the customer’s name and email to set up the interview as well as audio and video recording of the customer during the interview.

Further information can be found in Google’s privacy policy: https://policies.google.com/privacy.

4.6 Marketing Tools

We also use optional tools for advertising purposes (“marketing tools”). Some of the access data collected when you use our website is used for interest-based advertising. By analyzing and evaluating this access data, we are able to show you personalized advertising, i.e. advertising that corresponds to your actual interests and needs, on our website and on the websites of other providers.

In the following section, we would like to explain these technologies and the providers used for this in more detail. The data collected may include in particular

• the IP address of the device;
• the information of a cookie or in local storage or session storage;
• the device identifier of mobile devices (e.g. device ID, advertising ID);
• Referrer URL (previously visited page);
• Pages accessed (date, time, URL, title, length of visit);
• Downloaded files;
• Clicked links to other websites;
• If applicable, achievement of certain goals (conversions);
• Technical information: Operating system; browser type, browser version and browser language; device type, device make, device model and device resolution;
• Approximate location (country and city, if applicable).

However, the data collected is only stored under a pseudonym, so that no direct conclusions can be drawn about individuals.

4.6.1 Hubspot

We use Hubspot for tracking and remarketing purposes. Hubspot processes your pseudonymized email address and shares it with Meta Platforms and Google Ads.

This allows us to achieve conversion tracking and optimize our marketing campaigns. By sharing the data with the platforms we are able to retarget a specific audience.

We have concluded a data processing agreement with HubSpot.

Further information can be found in HubSpot’s privacy policy.

4.6.2 Intercom

We use Intercom to market relevant product and service offers to our customers. This marketing information is displayed directly in the admin area of our customers’ GotPhoto account.

The following information is processed by Intercom: customer first name, last name, email address and basic user behavior (page visits).

We have concluded a data processing agreement with Intercom.

4.6.3 Meta- Pixel (formerly Facebook- Pixel)

Our website uses the Meta-Pixel service for marketing purposes, which is offered outside the US and Canada by Meta Platforms Ireland Ltd, Serpentine Avenue, Block J, Dublin 4, Ireland and in the US and Canada by Meta Platforms Inc, 1601 Willow Road, Menlo Park, California 94025, United States (together “Meta Platforms”).

We use Meta-Pixel to analyze the general use of our website and to track the effectiveness of Facebook advertising (“conversion tracking”). We also use Meta-Pixel to display personalized advertising messages based on your interest in our products (“retargeting”). This also involves target group remarketing through custom audiences.

Meta Platforms processes data that the service collects via JavaScript, cookies and other technologies on our website. This includes in particular

HTTP header information such as information about the browser used (e.g. user agent, language);
Information on events such as “page view”, other object properties and buttons clicked by visitors to the website;
Online identifiers such as IP addresses and, where provided, Facebook business-related identifiers or device IDs (such as advertising IDs for mobile operating systems) and information on the status of deactivation/restriction of ad tracking.
Meta Platforms acts as our processor for matching, measurement and analysis services, in particular for analysing the use of our website, matching user IDs and creating reports on our advertising campaigns. We have concluded a data processing agreement with Meta Platforms.

In addition, we and Meta Platforms are jointly responsible for the processing of event data for the targeting of advertisements (through the creation and selection of target groups), the delivery of commercial and transactional messages, the improvement of ad delivery and the personalization of functions and content when using Meta-Pixel. The mutual obligations were set out in a joint contract, which can be accessed at the following address:

https://www.facebook.com/legal/controller_addendum.

Meta Platforms also processes the event data for the protection and security of Meta Platforms’ products, for research and development purposes and to maintain the integrity of the products and improve them.

If you are a member of Facebook or Instagram and have allowed Meta Platforms to do so via the privacy settings of your account, Facebook or Instagram may also link the information collected about your visit to our website to your member account and use it for targeted advertising. You can view and change the privacy settings of your Facebook profile at any time: https://www.facebook.com/settings/?tab=ads. You can prevent the linking of data collected outside Instagram for the display of personalized advertising in Instagram as described here:

https://de-de.facebook.com/help/instagram/2885653514995517?locale=de_DE.

If you opt out of the use of Meta-Pixel, Meta Platforms will only display generic adverts that are not selected based on the information collected about you on this website. Please be advised that an opt-out mechanism is only provided in states, where this is legally required.

Further information, e.g. regarding joint responsibility and contact details, can be found in Meta Platforms’ privacy policy, in particular for the social networks Facebook and Instagram: https://www.facebook.com/about/privacy/.

4.6.4 Google Ads

Our website uses the Google Ads service, which is offered in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and in all other geographic areas by Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, United States (together “Google”).

Applying Google Ads Conversion Tracking we define customer actions (such as clicking on an ad, page views, downloads) that are recorded and analyzed. We use Google Ads Remarketing to show you individualized advertising messages for our products on Google partner websites. Both services use cookies, JavaScript, pixels and other technologies for this purpose.

If you use a Google account, Google may link your web and app browsing history to your Google account and use information from your Google account to personalize ads, depending on the settings stored in your Google account. If you do not desire a link to your Google account, you must log out of Google before visiting our website.

If you opt out of the use of Google Ads, Google will only display general advertising that has not been selected based on the information collected about you on this website. Please be advised that an opt-out mechanism is only provided in states, where this is legally required.

In addition to opting-out, you may deactivate personalized advertising in Google’s advertising settings:

https://adssettings.google.com/anonymous?hl=de.

Further information can be found here:

in the notice on data use: https://policies.google.com/technologies/ads;
in Google’s privacy policy: https://policies.google.com/privacy.

4.6.5 Google Marketing Platform and Ad Manager (formerly DoubleClick)

Our website uses Google Marketing Platform and Google Ad Manager, services provided in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and in all other geographic areas by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, US (together “Google”).

These services use cookies and other technologies to show you adverts that are relevant to you. The use of the services enables Google and its partner websites to display adverts based on previous visits to our or other websites on the Internet.

If you opt out of to the use of Google Marketing Platform and Ad Manager, Google will only display generic advertising that has not been selected based on the information collected about you on this website. Please be advised that an opt-out mechanism is only provided in states, where this is legally required.

In addition to opting-out, you may deactivate personalized advertising in Google’s advertising settings: https://adssettings.google.com/anonymous?hl=de.

Further information can be found here:

in the notice on data use: https://policies.google.com/technologies/ads;
in Google’s privacy policy: https://policies.google.com/privacy.

4.6.6 Microsoft Advertising (formerly Bing Ads)

Our website uses Microsoft Advertising, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”). Microsoft uses JavaScript, cookies and local storage to present you with adverts that are relevant to you. The use of these technologies enables Microsoft and its partner websites to display adverts based on previous visits to our or other websites on the Internet. Microsoft  may transfer the data collected in this context for analysis to a server in the US and store the data there.

The following information in the Local Storage is stored and read by Microsoft Advertising:

• “_uetsid”: Session ID;
• “_uetvid”: Recognition of visitors, usage analysis, display of personalized advertising;
• “_uetsid_exp”, “_uetvid_exp”: Information about the expiry date of the information in Local Storage.

In addition to opting-out, you may deactivate the personalised ads in Microsoft Advertising or in the settings for ads in your Microsoft account:

Personalized ads: https://support.microsoft.com/en-us/topic/personalized-ads-and-your-privacy-4527dbbc-0d52-44cf-8ced-7c7f755b6691;
Settings for displays: https://account.microsoft.com/privacy/ad-settings/signedout.
Please be advised that an opt-out mechanism is only provided in states, where this is legally required.

Further information can be found in Microsoft’s privacy policy: https://privacy.microsoft.com/en-gb/privacystatement.

4.7 External Media

We also use external media in the form of embedded videos.

In these cases, access to and storage of information in the device is subject to consent.

4.7.1 Wistia

We use the service for hosting and embedding videos from Wistia, Inc., 120 Brookline Street, Cambridge, Massachusetts 02139, US on our website.

Wistia collects data about video usage by the visitor, e.g. how much of the video was viewed, at what point the video was paused or whether it was continued at another point, how many videos were viewed and how often they were viewed. The IP address, device class (desktop, mobile), operating system, browser, embedded URL (page on which the video is played), internet provider, location, region and country, session start time (date and time of the first video view per video) are processed.

The following information is stored in the Local Storage:

• “wistia-video-progress”: Saves whether the user has viewed embedded content;
• “Wistia”: Storage of actions performed on the website.

Further information can be found in Wistia’s privacy policy.

5. Online Presences in Social Networks

We maintain an online presence on social networks in order to communicate with customers and interested parties and to provide information about our services. User data is generally processed by the relevant social networks for market research and advertising purposes. This allows the creation of user profiles based on the interests of users. Cookies and other identifiers are stored on the devices of the data subjects for this purpose. Based on these user profiles, adverts are placed, for example within the social networks as well as on third-party websites.

For our online presences we may have access to information such as statistics on the use of such online presences provided by the social networks. These statistics are aggregated and may contain demographic information (e.g. age, gender, region), data on the interaction with our online presence (e.g. likes) and the posts and content distributed. Statistics may also provide information about the interests of users and which content and topics are particularly relevant to them. This information can be used to adapt the design, and optimize our activities and content for our audience. Please refer to the list below for details and links to the social network data that we can access as the operator of the online presence. The collection and use of these statistics are generally subject to joint responsibility.

If you have an account with the social network, it is possible that we can see your publicly available information and media when we access your profile. In addition, the social network may allow us to contact you. This can be done via direct messages or posted contributions. Communication via the social network is subject to the responsibility of the social network as a messenger and platform service. Content-related communication via the social network and the processing of content data is the responsibility of the social network as a messenger and platform service. As soon as we transfer personal data from you to our own systems or process it further, we are independently responsible for the data processing and this is done to perform pre-contractual activities or to fulfil a contract.

Information on the data processing carried out by the social networks can be found in the data protection information of the respective social network. The links below will also provide you with information on the options to object to certain data processing.

We would like to point out that data protection requests can be made most efficiently with the respective provider of the social network, as only these providers have access to the data and can take appropriate measures directly. If you contact us with your request, we will forward your enquiry to the provider of the social network.

Below is a list with information on the social networks where we have an online presence:

Facebook, Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland
Operation of the Facebook fan page under joint responsibility on the basis of an agreement on joint processing of personal data (so-called Page Insights addendum regarding the controller)
Information on the processed Page Insights data and how to contact us in the event of data protection enquiries:
https://www.facebook.com/legal/terms/information_about_page_insights_data
Privacy policy: https://www.facebook.com/about/privacy/
Opt-out: https://www.facebook.com/settings?tab=ads and
http://www.youronlinechoices.com

Instagram, Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland
Instagram Business account on the basis of an agreement on joint processing of personal data (so-called Page Insights addendum regarding the controller):
https://www.facebook.com/legal/terms/page_controller_addendum
Information on the processed Page Insights data and how to contact us in the event of data protection enquiries:
https://www.facebook.com/legal/terms/information_about_page_insights_data
Privacy policy: https://help.instagram.com/519522125107875
Opt-out (declaration):
https://de-de.facebook.com/help/instagram/2885653514995517?locale=de_DE

YouTube, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://policies.google.com/privacy
Opt-out: https://www.google.com/settings/ads

X, X Corp., 865 FM 1209, Building 2, Bastrop, TX 78602, United States
Privacy policy: https://x.com/en/privacy
Opt-out: https://x.com/settings/account/personalization

LinkedIn, LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland
Operation of the LinkedIn company page under joint responsibility on the basis of an agreement on the joint processing of personal data (so-called Page Insights Joint Controller Addendum)
Information on the processed Page Insights data and how to contact us in the event of data protection enquiries: https://legal.linkedin.com/pages-joint-controller-addendum
Privacy policy: https://www.linkedin.com/legal/privacy-policy
Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

6. Disclosure of Data

The data collected by us will only be passed on if:

• you have not opted out,
• the disclosure is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest in the non-disclosure of your data,
• we are legally required to pass on data in accordance, or
  necessary for the performance of a contract to which you are a party or to take steps prior to a contract at your request.

Data processing may be carried out by our service providers. In addition to the service providers mentioned in this privacy notice, these may include, in particular, photo labs, data centers that host our website and store our databases, software providers, IT service providers that maintain our systems, agencies, market research companies, group companies and consulting firms. If we pass on data to our service providers, they may only use the data to fulfil their specific tasks. The service providers have been carefully selected and commissioned by us. They are contractually bound by our instructions, have suitable technical and organizational measures in place to protect the rights of the data subjects and are regularly monitored by us.

In addition, data may be passed on in connection with official enquiries, court orders and legal proceedings, if necessary.

7. Data Transfer to Third Countries

As previously disclosed in this privacy notice, we use services whose providers may be located or process personal data in so-called third countries (outside the US), i.e. countries whose level of data protection may not correspond to that of the US.

Outside of the US, we use providers that process personal data in the European Union, the European Economic Area and the UK. In each case we have taken appropriate precautions to ensure an adequate level of data protection for any data transfers.

8. Storage Period

In principle, we only store personal data for as long as necessary to fulfil the purposes for which we collected the data. We then delete the data immediately, unless we still need to retain the data as evidence for civil law claims (until the statutory limitation period expires) or due to statutory retention obligations.

In accordance with the statute of limitation in the State of New York, claims based on contract expire at the earliest six years from the date of breach. For evidence purposes, we must retain contract data for a period of six years from the end of the contract with you.

Thereafter, we still have to store some of your personal data for accounting, tax, audit and potential litigation reasons. We are obliged to comply with statutory documentation obligations and regulatory requirements  that may arise from the New York statute of limitations for written contracts, IRS tax documentation requirements, applicable data privacy legislation, as well as other applicable legislation and established principles. The periods specified for the retention of documents are between three to seven years.

9. Your Privacy Rights (B2B)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), individuals acting in a business-to-business (B2B) context, such as contractors or representatives of another business, have specific rights regarding their personal data. These rights include:

• Right to Know/Access: You have the right to know what personal data we have collected about you, the purposes for the data collection, and with whom it is shared.
• Right to Correct: You can request that inaccurate or incomplete personal data held by us be corrected.
• Right to Delete: You have the right to request the deletion of personal data collected about you, subject to certain exceptions (e.g., data needed for legal compliance or ongoing business purposes).
• Right to Opt Out of Sale or Sharing: You can opt out of the sale or sharing of your personal data with third parties for monetary or other valuable consideration.
• Right to Data Portability: You can request your personal data in a portable, machine-readable format, enabling you to transfer it to another entity.
• Right to Non-Discrimination: You cannot be denied goods or services, charged different prices, or provided lower-quality services for exercising your privacy rights.
• Right to Transparent Information: We must provide clear and easily accessible information about data collection and processing practices, which we do in this privacy notice.

We are committed to protecting your privacy and ensuring compliance with applicable laws. Please be advised that for individuals outside of California, these rights may not apply in a B2B context. If you wish to exercise your rights or learn more, please contact us at privacy@gotphoto.com.

To assert your rights described here, you can contact us at any time using the contact details above. This also applies if you wish to receive copies of guarantees to demonstrate an adequate level of data protection. If the respective legal requirements are met, we will comply with your data protection request.

Your requests for the assertion of data protection rights and our responses to them will be stored for documentation purposes for a period of up to seven years and, in individual cases, beyond this period if there is a reason to assert, exercise or defend legal claims.

10. Changes to the Privacy Notice

We occasionally update this privacy notice, for example when we customize our website or when legal or regulatory requirements change.

Updated: January 2025