Privacy policy

Last updated: 20.12.2025

1. General Information

"IZZIPIX" LTD (hereinafter – the "Platform" or "We") is an intermediary Platform that connects individuals wishing to obtain photographs with photographers who offer them, providing the opportunity to purchase and order photographs also remotely.

Buyers – are individuals who use the Platform to purchase photographs. Photographers – are individuals who provide photographs. Producers – are individuals who use the Platform to access photographs and ensure their printing (hereinafter – "Buyers", "Photographers" and "Producers"). Together they are hereinafter referred to as Platform users.

This privacy policy applies to all Platform users who use Our services, including making payments and receiving photographs.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council ("General Data Protection Regulation" or "GDPR") and other regulatory acts.

About Us

  • Company: "IZZIPIX" LTD
  • Registration number: HE434168
  • Legal address: Romanou 2-601, Nicosia, 1070, Cyprus
  • Email: [email protected]

2. Special Conditions/Exceptions

In accordance with Recital 14 of the General Data Protection Regulation, this regulation does not apply to the processing of personal data concerning legal persons, in particular undertakings established as legal persons, including their name, form of business and contact information. Also, if self-employed individuals' data is directly related to commercial activities, in certain cases it may be considered as legal entity data. Therefore, this privacy policy does not apply to cooperation partners, such as Photographers, to the extent that their data is processed in connection with commercial activities (in cases where they are not data subjects).

The use of the Platform is intended for adults.

For photo sessions involving minors, the consent of their parents or legal representatives is required. Our partnership agreement with Photographers establishes the obligation of Photographers to obtain such consent for photographing and processing personal data of minors, including providing their personal data for the purposes of Platform data processing in accordance with this policy.

We assume that consent has been obtained from parents or legal representatives of all minors participating in the photo session for photographing and processing of personal data, so that the Platform can fulfill its contractual obligations.

We acknowledge that Photographers provide access to the Platform's cloud storage to parents or legal representatives of minors in cases where the Photographer has photographed these minors and uploaded the photographs to the Platform's cloud storage.

Purposes and Legal Basis for Personal Data Processing

To ensure the operation of the Platform, We may need to process Your personal data as described below. Providing personal data is necessary for using Our services. If the required data is not provided, We cannot provide the corresponding services.

Creation and Management of User Account

For users to use the Platform, they need to create an account. This includes entering basic registration information and account management, such as password recovery.

  • Categories of personal data: First name, last name, email address, phone number, password, profile picture.
  • Legal basis: Performance of contract (GDPR 6(1)(b)). Regarding profile picture – consent (GDPR 6(1)(a)). Uploading a profile picture is voluntary.

Payment Processing

To process payments and ensure payment for goods and services, payment data is processed. We use Stripe for payment processing.

  • Categories of personal data: Bank account number, payment information, etc.
  • Legal basis: Performance of contract / Legal obligation (GDPR 6(1)(b), 6(1)(c)).

User Support and Complaint Handling

Users can submit questions or complaints related to Platform operation, payments, etc.

  • Categories of personal data: First name, last name, email, complaint content.
  • Legal basis: Performance of contract / Legitimate interests (GDPR 6(1)(b), 6(1)(f)).
  • Legitimate interests:
    • to ensure a high level of service and effectively resolve issues;
    • to protect the legitimate interests of the Platform, for example, by investigating user complaints about possible rule violations or fraud;
    • to ensure analysis of complaint history to improve services and prevent recurring issues.

Communication

We may contact You by email or other means to provide service-related information, such as: providing information on security and legal matters, providing information about Platform updates, reminders and recommendations.

  • Categories of personal data: First name, last name, email, correspondence content.
  • Legal basis: Performance of contract / Legitimate interests (GDPR 6(1)(b), 6(1)(f)).
  • Legitimate interests:
    • to ensure effective communication with users on important aspects of the service;
    • to maintain a high level of service by ensuring timely and accurate exchange of information.

Delivery Provision

To ensure delivery of ordered goods.

  • Categories of personal data: First name, last name, address or contact phone number, depending on the delivery method (courier delivery or parcel locker).
  • Legal basis: Performance of contract (GDPR 6(1)(b)).

Verification of Biometric Data in Photographs Uploaded by Photographers

The purpose is to show the Buyer only those photographs in which the Buyer or their child is depicted.

Biometric personal data is data that we obtain by performing special technical processing of photographs uploaded by Photographers to the Platform's cloud. This data relates to mathematical features that allow unique identification of the client and distinguish them from other persons depicted in the photograph.

When processing photographs, a mathematical representation is automatically generated – the so-called set of vector features. This is a structured array of numerical values describing the relative position of individual facial points (for example, distances between characteristic landmarks).

It is important to emphasize that it is impossible to reconstruct a person's image from vector feature data. This data does not contain information about appearance – such characteristics as skin color, eye color, hairstyle shape or other visual features. Figuratively speaking, this is not a "portrait", but a set of numbers describing the relationships between individual facial points. If a photograph is a complete image, then vector biometric data is an abstract scheme suitable only for technical comparison with other similar schemes within one photo session. Data from different photo sessions do not overlap and cannot be used to search for or identify persons outside our Platform.

Vector feature data is stored in a separate, protected database isolated from user and media data. Access to this database is only possible with two independent encrypted keys that are regularly updated (key rotation is performed at least once a month). Direct access to this data is not available to either external persons or employees not involved in servicing the relevant system.

After completing the sorting of photographs from the relevant photo session, biometric vector data is deleted. It is not archived and is not reused.

Our use of special technical processing of photographs allows for maximum personalization of the Buyer's experience by showing only relevant images and protecting the rights of third parties who may be in the image.

Biometric data:

  • is used exclusively for sorting photographs within a specific photo session;

  • is not used for identification purposes in any other context;

  • is not transferred to third parties and is not used for other purposes.

  • Categories of personal data: Photographs uploaded to the Platform's cloud storage.

  • Legal basis: Consent (GDPR 6(1)(a)) and (GDPR 9(1)(a)).

The Buyer has the right to refuse to provide biometric data when accessing the Platform's cloud storage. In this case, We will not process data using special technical processing of photographs. Refusal to provide biometric data in no way means that We refuse to provide services to the Buyer and/or We cannot access photographs stored in the Platform's cloud storage.

Marketing Communication

Users may receive Platform news, special offers and promotional emails. Users can opt out of commercial notifications at any time.

  • Categories of personal data: Email, phone number.
  • Legal basis: Consent (GDPR 6(1)(a)) or legitimate interests (GDPR 6(1)(f)), if applicable.

The Platform may send existing customers news and similar offers based on legitimate interests to inform about current events and improve user experience. Such communication is carried out only in relation to similar services that the customer has already received from the Platform. Legal basis: GDPR 6(1)(f) – the Platform's legitimate interests in promoting customer loyalty and informing about similar services.

Security and Fraud Prevention

To prevent unauthorized access, technical data is analyzed.

  • Categories of personal data: IP address, device data, browser information.
  • Legal basis: Legitimate interests (GDPR 6(1)(f)).
  • Legitimate interests:
    • to protect Platform and user data from unauthorized access and cyberattacks;
    • to identify suspicious or unusual activities that may indicate account hacking or fraud;
    • to ensure compliance with the Platform's internal security standards and prevent malicious use of the Platform;
    • to investigate and prevent possible violations of the Platform's terms of use.

Ensuring Technical Operation of the Platform

To ensure the operation of the Platform's basic functions, such as maintaining an authenticated user session, technically necessary cookies are used. These cookies are used only, for example, to maintain login so that the user can navigate the Platform without the need to re-authenticate on each page. The Platform does not use analytical, personalization or marketing cookies that would require prior user consent.

  • Categories of personal data: Strictly necessary cookies.
  • Legal basis: The Platform's legitimate interests in ensuring secure and uninterrupted technical operation (GDPR 6(1)(f)).

3. Data Sources

We obtain personal data from various sources depending on how the Platform and services are used.

We may obtain Your personal data in the following ways:

You as the data subject:

  • We obtain Your personal data directly from You when You register on the Platform and fill out Your profile, send Us requests or contact Us in any other way.

Created during Platform use:

  • During Platform operation, data is generated, such as services used, as well as technical data (for example, browser data, cookies).

Obtained from other users:

  • If You are a Buyer, Your photographs may be uploaded by a Photographer to provide the service.

Obtained from payment processing service providers:

  • We may receive information about payment status from Our payment processor (Stripe) to ensure transaction processing and compliance with legal requirements.

Obtained from third parties and institutions:

  • For example, government institutions may provide information about possible rule violations or unauthorized use of the Platform.

Public and private registries:

  • In certain cases, We may verify the form of users' business activities, etc., for example, using public registries or open databases.

4. Data Recipients

We may transfer Your personal data to other recipients to ensure the provision of Our services, fulfillment of contractual obligations, compliance with legal acts or in other necessary cases. We guarantee that we transfer only the information necessary to achieve the specific processing purpose and ensure that recipients comply with appropriate data protection measures.

Personal data may be transferred to the following recipients:

a) Cooperation Partners (including data processors)

Third parties that help ensure the operation of the Platform, for example:

  • We use a special photo technical processing service to verify photographs uploaded by users to the Platform. We use this service to check photographs for malicious and/or illegal content and to personalize the customer experience in accordance with Our policy. We do not use data obtained from photo analysis for any other purposes;
  • producers for ensuring product printing and postal/courier service providers;
  • IT system maintenance and technical support service providers that help ensure the security and functionality of the Platform;
  • payment processing service providers (for example, Stripe) that process payments and ensure money transfers.

b) Public Institutions and Law Enforcement Agencies

If necessary to fulfill requirements established by legal acts or to exercise Our rights, for example:

  • tax and financial regulatory authorities, if necessary to ensure compliance;
  • law enforcement agencies, if there is a legal obligation or legal basis for transferring information;
  • courts or other government institutions in cases where necessary.

Our data processing centers where Your personal data is stored are located in the European Union (EU) and the European Economic Area (EEA).

5. Personal Data Storage

We store personal data in accordance with the following conditions:

  • Regulatory requirements: personal data is stored for as long as necessary to fulfill obligations established by regulatory acts, such as accounting requirements and legal obligations.
  • Consent: if personal data is processed based on Your consent, it is stored until the consent is withdrawn or until the data is no longer needed for the relevant purpose.
  • Legitimate interests: data is stored for as long as necessary to achieve the specific processing purpose and to protect Our or third parties' legitimate interests, for example, for dispute resolution, compliance with limitation periods or protection of legal claims.

We store Your data for the following periods:

  • Photographs for download are stored for 6 months.
  • Marketing data is stored until consent is withdrawn.

When the personal data storage period expires, We ensure secure deletion, archiving or anonymization of data so that it can no longer be linked to You.

6. Data Subject Rights

As a data subject, You have the following rights under the General Data Protection Regulation:

a) Right to Access Your Data

When exercising Your right to access data, You need to specify the specific time period and data You wish to receive from Us. You have the right to request information from Us about what data We hold about You, why we process it, how we obtained it and to whom we transferred it, how long it will be stored, and to receive a copy of Your data. The request will be fulfilled faster if the period is as short as possible and the request for information about Your data is formulated as specifically as possible. It will help Us provide You with a response if we know for what purpose You wish to access the data.

b) Right to Data Rectification

If You need to clarify or correct Your personal data held by Us, You need to clearly indicate which data is to be clarified and what the current information is. If the data was not obtained from You, please attach justification as to why the information being corrected is considered inaccurate, to facilitate faster and more appropriate accuracy assessment.

c) Right to Data Erasure

For Us to delete Your data, You need to indicate which specific personal data needs to be deleted and attach justification for this request. Please note that in all cases data deletion may not be possible.

d) Right to Restriction of Processing

If You are not sure whether We are processing data properly, You can ask us to restrict the processing of specific data. The request for restriction of data processing must indicate why, in Your opinion, this processing should be restricted.

e) Right to Object to Processing

In certain cases, You may have the right to object to processing based on Your individual considerations. In such a request, it is important to indicate Your individual circumstances for which You object to processing.

f) Withdrawal of Consent

To the extent that We process Your personal data based on Your consent, You have the right to withdraw Your consent to personal data processing at any time. In this case, We will stop processing Your personal data for the purpose for which You gave Your consent. Please note that withdrawal of consent does not give You the right to challenge the lawfulness of data processing that We carried out before the withdrawal of consent.

g) Right to Data Portability

If You want us to collect Your personal data in our possession and transfer it to another controller or send it to You, it is important to indicate which data You wish to transfer.

Submitting a Request

You can submit a request to exercise Your rights in writing:

  • in person, presenting an identity document (as You are required to identify yourself);
  • by sending a letter electronically by email and signing it with a secure electronic signature;
  • using registered mail.

We will review Your request without undue delay and provide a response on the fulfillment or non-fulfillment of the request no later than within one month from the date of receipt. If fulfilling the request takes Us longer, We have the right to extend its fulfillment by another two months, but in any case You will be informed of this within one month.

The review of the application may be rejected or a proportionate fee based on administrative costs may be charged if it is submitted manifestly unfounded or excessive, as well as in other cases provided for by regulatory acts.

We have the right not to fulfill Your request:

  • if it is formulated unclearly;
  • if we cannot identify You;
  • if we have already provided a response to such a request;
  • if the volume of requested information is disproportionate;
  • if the request is unfounded (does not relate to our company, no explanations are provided as to why the request should be fulfilled);
  • if regulatory acts establish that We are not entitled to provide You with such information or We are obliged to store specific data about You.

If You have any concerns about how We use Your personal data, You can submit a complaint to us. If You believe that we have processed Your data improperly, You have the right to also submit a complaint to a court or supervisory authority.

The Platform carries out automated data processing, for example, filtering photographs by facial similarity, so that users can more conveniently view content that relates to them or their children. This processing helps select relevant photographs, however it does not have legal consequences and does not significantly affect the rights or freedoms of users within the meaning of Article 22 of the GDPR. This is not a decision that would restrict access to the service, create legal obligations or significantly affect a person's interests.

7. Contact and Questions

If You have questions about personal data processing, please contact Us:

"IZZIPIX"
Email: [email protected]

We may from time to time make changes to this privacy policy. All changes will be published on Our website, and the date of the last change to the privacy policy will be updated at the top of the page. Additional notifications of any significant changes will be sent to Your email or brought to Your attention in another way.