Privacy policy

Privacy Policy

Last updated: 30.10.2026

1. General Information

"IZZIPIX" LTD (registration number: HE434168) (hereinafter - the "Photographer") is a professional photography company acting as the seller of photography services and products. The Photographer offers its services to natural persons who wish to obtain high-quality photographs and is responsible for accepting payments from Buyers. To deliver, manage and sell photographs, the Photographer uses the IZZIPIX LTD platform (hereinafter - the "Platform") - a technical operator that provides the infrastructure connecting the Photographer with customers and enables photographs to be purchased and ordered, including remotely.

Buyer - a natural person who uses the Platform to purchase photographs from the Photographer.

Photographer - "IZZIPIX" LTD, the seller who provides photographs and accepts payments via the Platform.

Producer - a legal entity (photo lab or print shop) with which the Photographer has concluded a contract for printing photographs and manufacturing photo products. The Producer is chosen by the Photographer and may differ from one photo session to another. The Producer accesses photographs and order data via the Platform only to the extent necessary to manufacture and dispatch the ordered products.

Platform - IZZIPIX LTD, a technical operator that provides the infrastructure and facilitates interaction between the Buyer, the Photographer and the Producer. The Platform does not act as a seller and does not accept payments in its own name.

(hereinafter jointly referred to as "Platform Users": the Buyer, the Photographer and Producers.)

This privacy policy applies to all Platform Users who use the Platform's services, including making payments and receiving photographs.

The Platform processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the "General Data Protection Regulation" or "GDPR") and other legal acts.

About the Photographer (Seller)

  • Company: "IZZIPIX" LTD
  • Registration number: HE434168
  • Registered address: Romanou 2-601, Nicosia, 1070, Cyprus
  • Email: info@izzipix.com
  • Website: https://b2b.izzipix.com/

About the Platform (Technical Operator)

  • Company: IZZIPIX LTD
  • Registration number: HE434168
  • Registered address: Romanou 2-601, Nicosia, 1070, Cyprus
  • Email: info@izzipix.com

2. Special Conditions/Exceptions

In accordance with Recital 14 of the General Data Protection Regulation, the regulation does not apply to the processing of personal data concerning legal persons, in particular undertakings established as legal persons, including their name, legal form and contact details. In addition, where the data of self-employed persons is directly related to their commercial activity, it may in certain cases be regarded as data of a legal entity. Accordingly, this privacy policy does not apply to cooperation partners such as the Photographer to the extent that their data is processed in connection with their commercial activity (where they are not data subjects).

The Platform is intended for use by adults.

Photo sessions involving minors require the consent of their parents or legal guardians. The partnership agreement with the Photographer obliges the Photographer to obtain such consent for photographing minors and processing their personal data, including making their personal data available for processing by the Platform in accordance with this policy.

It is assumed that consent to photographing and processing personal data has been obtained from the parents or legal guardians of all minors taking part in the photo session, so that the Platform can fulfil its contractual obligations.

The Platform acknowledges that the Photographer gives the parents or legal guardians of minors access to the Platform's cloud storage where the Photographer has photographed those minors and uploaded the photographs to the Platform's cloud storage.

The Platform provides the Photographer with the technical means to store photographs and grant access to them, but does not create, select or review the content of uploaded photographs. Responsibility for the content of the photographs, their lawfulness and for obtaining the necessary consents of the persons depicted lies with the Photographer who uploaded them. If the Platform becomes aware of photographs that infringe the law or the rights of third parties, it will take measures to restrict access to them or remove them. Such photographs can be reported to the Platform's email address given in section 7.

Purposes and Legal Bases for Processing Personal Data

To ensure the operation of the Platform, it may be necessary to process your personal data as described below. Providing personal data is necessary to use the Platform's services. If the required data is not provided, the Platform cannot provide the relevant services.

Personal access to the Photographer's online shop

The Buyer does not create an account themselves. For each child who took part in the photo session, the Photographer creates a personal profile in their online shop and gives the Buyer (the child's parent or legal guardian) personal access details - for example, an access code on a paper card or a personal link. Through the profile the Buyer views their child's photographs and places orders.

  • Categories of personal data: the child's first name and surname, class or group name; the Buyer's first name and surname; the Buyer's email address and phone number (if provided); personal profile access details.
  • Legal basis: Performance of a contract (GDPR 6(1)(b)).

Payment processing

The Photographer is the seller of photography services and products and accepts payments from Buyers. To process payments, the Platform, acting as a technical operator, uses the payment processing services Stripe, Ecommpay or Przelewy24 on behalf of the Photographer, depending on the geographical region selected by the Photographer and the availability of these payment systems in that region.

  • Categories of personal data: Bank account number, payment information, etc.
  • Legal basis: Performance of a contract / Legal obligation (GDPR 6(1)(b), 6(1)(c)).

User support and complaint handling

Users may submit questions or complaints relating to the operation of the Platform, payments, etc.

  • Categories of personal data: First name, surname, email, content of the complaint.
  • Legal basis: Performance of a contract / Legitimate interests (GDPR 6(1)(b), 6(1)(f)).
  • Legitimate interests:
    • to ensure a high level of service and resolve issues effectively;
    • to protect the legitimate interests of the Platform, for example by investigating user complaints about possible rule violations or fraud;
    • to analyse complaint history in order to improve services and prevent recurring problems.

Communication

The Platform may contact you by email or by other means to provide service-related information, for example: information on security and legal matters, information about Platform updates and order status.

  • Categories of personal data: First name, surname, email, content of correspondence.
  • Legal basis: Performance of a contract / Legitimate interests (GDPR 6(1)(b), 6(1)(f)).
  • Legitimate interests:
    • to ensure effective communication with users on important aspects of the service;
    • to maintain a high level of service by ensuring timely and accurate exchange of information.

Delivery

To ensure the delivery of ordered goods.

  • Categories of personal data: First name, surname, address or contact phone number, depending on the delivery method (courier delivery or parcel locker).
  • Legal basis: Performance of a contract (GDPR 6(1)(b)).

Order deadline reminders

If the Buyer has provided an email address and/or phone number, the Platform may, on behalf of the Photographer, send them a reminder by email and/or SMS of the deadline by which photographs can be ordered. The Platform and the Photographer do not send advertising or marketing messages.

  • Categories of personal data: Email, phone number.
  • Legal basis: Performance of a contract (GDPR 6(1)(b)).

Security and fraud prevention

Technical data is analysed to prevent unauthorised access.

  • Categories of personal data: IP address, device data, browser information.
  • Legal basis: Legitimate interests (GDPR 6(1)(f)).
  • Legitimate interests:
    • to protect Platform and user data from unauthorised access and cyberattacks;
    • to detect suspicious or unusual activity that may indicate unauthorised access to a profile or fraud;
    • to ensure compliance with the Platform's internal security standards and prevent misuse of the Platform;
    • to investigate and prevent possible breaches of the Platform's terms of use.

Technical operation of the Platform

Strictly necessary cookies are used to ensure the basic functions of the Platform, such as maintaining an authenticated user session. These cookies are used only, for example, to keep the user logged in so that they can move around the Platform without re-authenticating on each page. The Platform does not use analytics, personalisation or marketing cookies that would require the user's prior consent.

  • Categories of personal data: Strictly necessary cookies.
  • Legal basis: The Platform's legitimate interests in ensuring secure and uninterrupted technical operation (GDPR 6(1)(f)).

3. Data Sources

The Platform obtains personal data from various sources depending on how the Platform and services are used.

The Platform may obtain your personal data in the following ways:

From you as the data subject:

  • The Platform obtains your personal data directly from you when you register your child for a photo session, place an order, submit requests or contact the Platform in any other way.

Generated while using the Platform:

  • The operation of the Platform generates data such as services used, as well as technical data (for example, browser data, cookies).

Obtained from other users:

  • If you are a Buyer, your photographs may be uploaded by the Photographer in order to provide the service.

Obtained from payment service providers:

  • The Platform may receive payment status information from payment processors (Stripe, Ecommpay or Przelewy24) to ensure that transactions are processed and legal requirements are met.

Obtained from third parties and institutions:

  • For example, public authorities may provide information about possible rule violations or unauthorised use of the Platform.

Public and private registers:

  • In certain cases the Platform may verify users' form of business, etc., for example using public registers or open databases.

4. Data Recipients

The Platform may transfer your personal data to other recipients to provide the Platform's services, fulfil contractual obligations, comply with legal acts or in other necessary cases. The Platform ensures that only the information necessary for the specific purpose of processing is transferred and that recipients apply appropriate data protection measures.

Personal data may be transferred to the following recipients:

a) Cooperation partners (including data processors)

Third parties that help ensure the operation of the Platform, for example:

  • producers ensuring the printing of products, and postal/courier service providers;
  • IT system maintenance and technical support providers that help ensure the security and functionality of the Platform;
  • payment service providers (Stripe, Ecommpay or Przelewy24) that process payments on behalf of the Photographer and carry out money transfers.

b) Public authorities and law enforcement

Where necessary to comply with requirements set by legal acts or to exercise the Platform's rights, for example:

  • tax and financial supervisory authorities, where necessary to ensure compliance;
  • law enforcement authorities, where there is a legal obligation or legal basis for transferring information;
  • courts or other public institutions where necessary.

The Platform's data centres where your personal data is stored are located in the European Union (EU) and the European Economic Area (EEA).

5. Retention of Personal Data

The Platform stores personal data under the following conditions:

  • Regulatory requirements: personal data is stored for as long as necessary to fulfil obligations set by legal acts, such as accounting requirements and legal obligations.
  • Consent: where personal data is processed on the basis of your consent, it is stored until consent is withdrawn or until the data is no longer needed for the relevant purpose.
  • Legitimate interests: data is stored for as long as necessary to achieve the specific purpose of processing and to protect the legitimate interests of the Platform or third parties, for example to resolve disputes, observe limitation periods or defend legal claims.

The Platform stores your data for the following periods:

  • Photographs for download are stored for 6 months.

After the retention period expires, the Platform ensures the secure deletion, archiving or anonymisation of the data so that it can no longer be linked to you.

6. Rights of the Data Subject

As a data subject, you have the following rights under the General Data Protection Regulation:

a) Right of access to your data

When exercising your right of access, you need to specify the period of time and the data you wish to receive from the Platform. You have the right to ask the Platform what data about you is stored, why it is processed, how it was obtained and to whom it was transferred, how long it will be stored, and to receive a copy of your data. The request will be fulfilled faster if the period is as short as possible and the request is as specific as possible. It will be easier for the Platform to respond if the purpose of your access request is known.

b) Right to rectification

If you need to clarify or correct your personal data held by the Platform, you must clearly indicate which data needs clarification and what the current information is. If the data was not obtained from you, please attach a justification of why the information being corrected is considered inaccurate, to allow a faster and more appropriate assessment of accuracy.

c) Right to erasure

For the Platform to delete your data, you must indicate which specific personal data is to be deleted and attach a justification for the request. Please note that deletion may not be possible in all cases.

d) Right to restriction of processing

If you are unsure whether the Platform is processing data properly, you may ask the Platform to restrict the processing of specific data. A request for restriction must state why, in your opinion, the processing should be restricted.

e) Right to object

In certain cases you may have the right to object to processing on grounds relating to your particular situation. In such a request it is important to state the particular circumstances on which your objection is based.

f) Withdrawal of consent

To the extent that the Platform processes your personal data on the basis of your consent, you have the right to withdraw your consent at any time. In that case the Platform will stop processing your personal data for the purpose for which you gave consent. Please note that withdrawal of consent does not affect the lawfulness of processing carried out by the Platform before the withdrawal.

g) Right to data portability

If you wish the Platform to collect your personal data in its possession and transfer it to another controller or send it to you, it is important to specify which data you wish to transfer.

Submitting a request

You may submit a request to exercise your rights in writing:

  • in person, presenting an identity document (as you are required to identify yourself);
  • by email, signed with a qualified electronic signature;
  • by registered post.

The Platform will consider your request without undue delay and will respond regarding its fulfilment or refusal no later than one month from the date of receipt. If fulfilling the request takes longer, the Platform may extend the period by a further two months, but you will in any case be informed of this within one month.

A request may be refused, or a reasonable fee based on administrative costs may be charged, if it is manifestly unfounded or excessive, as well as in other cases provided for by legal acts.

The Platform may refuse to fulfil your request:

  • if it is unclear;
  • if the Platform cannot identify you;
  • if the Platform has already responded to such a request;
  • if the scope of the requested information is disproportionate;
  • if the request is unfounded (does not concern the Platform, or no explanation is given as to why it should be fulfilled);
  • if legal acts provide that the Platform is not entitled to provide such information or is obliged to retain certain data about you.

If you have any concerns about how the Platform uses your personal data, you may submit a complaint to the Platform. If you believe that the Platform has processed your data improperly, you also have the right to lodge a complaint with a court or a supervisory authority.

7. Contacts and Questions

If you have questions about the processing of personal data, please contact the Platform:

  • Company: IZZIPIX LTD
  • Registration number: HE434168
  • Registered address: Romanou 2-601, Nicosia, 1070, Cyprus
  • Email: info@izzipix.com

The Platform may amend this privacy policy from time to time. All changes will be published on the Platform's website, and the date of the last change will be updated at the top of the page. Additional notices of any material changes will be sent to your email address or communicated to you in another way.