This policy explains how we process your personal data when you visit our galleries, save favorites, order photos, sign up for a photo session or write to us.
Data controller
We are the data controller for the personal data we process about you:
Burow IT
Bredgade 10, 7470 Karup
CVR 30930290
Email: rene.soerensen@gmail.com
Phone: 42800002
If you have questions about how we process your data, or want to exercise your rights, contact us using the details above or the contact form.
The photos
The gallery shows photos from our photo session. They may show you, your child or others. We show the photos to the people who have the link to the gallery, and its password if it has one, so they can view, choose and buy photos. Search engines cannot find the gallery.
We keep the original photo files with the data the camera stored in them, such as when the photo was taken and possibly its GPS position. The photos shown in the gallery do not contain this data.
We process the photos to fulfil the agreement about the photo session and deliver the photos (Article 6(1)(b) of the General Data Protection Regulation). When the photos show people who are not themselves party to the agreement, we rely on our legitimate interest in showing and delivering the photos to those who ordered the session (Article 6(1)(f)). If you want a photo of you removed from the gallery, contact us.
When you order photos
When you order, we ask for your name, address, postcode, city, phone number and email address, and optionally your mobile number. If the prints are sent to someone else, we also receive the recipient's name, address and optionally phone number. If you buy photos with an editorial license, we also ask for the company name and CVR number of the business the license is issued to; they are in the license and in the files you download, together with the order number. With the order we keep the photos and products you chose, the prices, the delivery and payment, the status of the order and when your files were downloaded.
We use the data to:
- deliver your order: send or hand over prints and give you a link to your digital files, which works for 30 days
- send you an order confirmation and let you know when your prints are shipped or ready for pickup
- contact you about your order and handle any complaints
- keep track of free digital photos if the gallery gives a number of them per email address
- comply with bookkeeping law.
The legal bases are the agreement with you (Article 6(1)(b)), our legal obligation to keep accounts (Article 6(1)(c)) and our legitimate interest in knowing and being able to contact our customers (Article 6(1)(f)). You must provide the data to place an order.
Payment
If you pay online, the payment is made with Stripe on our own Stripe account. You enter your payment details directly with Stripe, and we never see your card number. Stripe also receives your name, email address, the delivery address and the phone number. Stripe also processes the data as an independent data controller, for example to prevent fraud, under Stripe's privacy policy.
If you pay in the store, we only process the data on the order.
Favorites
If you save favorites, we ask for your email address and optionally your name. We keep them with the photos you mark, so we can see your choice and send you your favorites as a download, possibly with a message from us. The legal basis is your request and the agreement with you (Article 6(1)(b)).
Choosing photos to be edited
In a gallery where you choose the photos we edit, we ask for your name and email address when you send us your selection. We keep them with what you say about each photo – your rating, wishes, notes, suggested crops and markers – and your note for the whole gallery, so we can edit the photos as you want and send you a receipt, and a reminder before the deadline if we reopen your selection. Everyone with the link to the gallery can see and change the same selection. The legal basis is the agreement with you (Article 6(1)(b)).
When you sign up for a photo session
If you sign up for a photo session on our sign-up page, we ask for your name, your email address and your answers to the questions in the sign-up form, such as the name of the person to be photographed. We keep them with the language you used and when you signed up, so we can plan the session and deliver the photos to you. You get a receipt by email, and when the photos are ready, an email with a link to your own gallery.
We usually protect your gallery with an access code, which we send to you by email. The code only opens your gallery. We store it encrypted, so we can send it to you again if you lose it. The data stays with us and our data processor (see Who we share the data with), and other people who sign up can see neither your details nor your gallery.
The legal basis is the agreement with you about the photo session (Article 6(1)(b)). If you sign up someone else, such as your child, you enter into the agreement on their behalf, and we process the data about them on the same basis. You must provide the required data to sign up.
When you write to us
If you write using the contact form, we receive your name, your email address, optionally your phone number, your message and the name of the gallery you write from. The message is sent to us by email and is not stored in the gallery. We use the data to answer you. The legal basis is our legitimate interest in answering enquiries (Article 6(1)(f)).
Cookies and statistics
Necessary cookies
The gallery uses a session cookie and a security cookie, so your cart, your favorites and your access to the gallery work, and the forms are protected against misuse. They expire 120 minutes after your last visit. Until then, your IP address and details about your browser are kept with the session. They are necessary for the gallery to work and therefore need no consent (Article 6(1)(f)).
Statistics without consent
We count which pages and photos are viewed, with the device type (computer, tablet or phone), the website you came from and the date. Nothing is stored in your browser and no IP address is kept, so the count cannot be traced back to you. The counts are deleted after 25 months.
Statistics with consent
If you accept statistics in the cookie banner, your browser stores a random ID in its local storage (localStorage). This lets us see how many times you have visited the gallery, your first and latest visit and which photos you have viewed, and recognise you when you come back – also when you order, so we can see your visits with your order. The legal basis is your consent (Article 6(1)(a)).
The ID is kept for up to 13 months after your last visit. You can withdraw your consent at any time under “Cookie settings” at the bottom of the gallery. We then delete the ID at once, and your visits can no longer be linked to you. We ask again after 12 months.
We do not use third-party cookies, advertising or tracking across websites.
Who we share the data with
The gallery and the shop run on the platform Mit Galleri, which is operated by RO Udvikling I/S. RO Udvikling I/S is our data processor and stores and processes the data for us under a data processing agreement. RO Udvikling I/S may not use the data for its own purposes and uses these sub-processors:
- Hetzner – Finland
- OVH SAS (OVHCloud) – Frankrig
- Laravel Holdings Inc. (Laravel Forge) – USA
Apart from that, we only share data when it is necessary:
- with Stripe when you pay online (see Payment)
- with the postal service or carrier when we send prints to you
- with our advisers, such as our accountant, and with public authorities when the law requires it.
We never sell your data.
Countries outside the EU and EEA
The data is stored in the EU. If a sub-processor is outside the EU and EEA, for example to manage the server, the transfer is based on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or on the EU standard contractual clauses. Stripe may also transfer data to countries outside the EU and EEA on the same basis.
How long we keep the data
| Data | How long |
|---|---|
| Orders with contact details | As long as necessary to deliver the order and handle complaints. Accounting records are kept for 5 years from the end of the financial year under bookkeeping law. If you ask us to, we delete your contact details from a finished order, while the amounts stay for the accounts. |
| Orders that were never paid | The contact details are deleted 30 days after the payment was abandoned. |
| Favorites | Until the gallery is deleted, or until we delete the list because you ask us to. Favorites we have sent to you are kept like orders. |
| Your choice of photos to be edited | Until the gallery is deleted, or until we delete your details because you ask us to. |
| Sign-ups with your answers and the access code | Until we delete the sign-up or the sign-up gallery, for example because you ask us to. A deleted sign-up gallery can be restored for 30 days. Your gallery with its photos is kept like other galleries. |
| Messages from the contact form | In our email, as long as necessary to answer and follow up on your enquiry. |
| Photos and galleries | Until we delete the gallery. A deleted gallery or photo can be restored for 30 days. Then it is deleted for good, and the photo files are gone 14 days later, when the backup copy expires. |
| Session data with IP address | 120 minutes after your last visit. |
| Statistics with consent | 13 months after your last visit, or until you withdraw your consent. |
| Anonymous counts | 25 months. |
Your rights
You have the right to:
- access the data we process about you
- have incorrect data corrected
- have data deleted when we may or must no longer keep it
- have the processing restricted
- receive your data in a common, machine-readable format (data portability)
- object to processing based on our legitimate interest
- withdraw your consent. This does not affect the processing before you withdrew it.
Contact us to exercise your rights. If you are unhappy with how we process your data, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, or to the supervisory authority in the country where you live.
Changes
We update this privacy policy when we change how we process data. The current version is always here.