This Privacy Policy explains how Photo-Pick ("Photo-Pick", "we", "us" and "our") collects, uses, stores, shares and otherwise processes personal data in connection with the Photo-Pick website, web application, services and related features (collectively, the "Service").
It also explains the choices and rights available to individuals whose personal data we process.
This Privacy Policy applies to visitors to our website, registered Users, Account holders, Guest Users, persons invited to Albums, persons who upload or interact with Content, and persons who otherwise communicate with Photo-Pick.
Photo-Pick provides an online service that allows Users to create, upload, store, organise, view, select, share and manage photos, videos and related Content, invite other persons to access or interact with Albums, and use related collaboration and Account features.
For processing activities for which Photo-Pick determines the purposes and means of processing, Photo-Pick acts as the data controller.
Controller: Photo-Pick
Website:
https://www.photo-pick.com
Email:
contact@photo-pick.com
In certain circumstances, Photo-Pick processes personal data on behalf of another person or organisation and acts as a data processor, service provider or equivalent role under applicable privacy law.
This Privacy Policy may be made available in multiple languages. The English-language version is the original version.
If there is any inconsistency or difference in meaning between the English-language version and a translated version, the English-language version will prevail to the extent permitted by applicable law.
This rule does not limit any mandatory rights or protections arising under applicable law.
Photo-Pick may process different categories of personal data in different legal capacities depending on the particular processing activity.
Photo-Pick generally acts as controller for personal data processed for purposes such as:
When Photo-Pick acts as controller, we determine the purposes and essential means of the relevant processing.
Users may upload, store, organise, share and otherwise process photos, videos, Album information and other material through the Service ("Content").
Content may contain personal data relating to the User, their clients, Guest Users, Album visitors, invited persons or other individuals.
Where another person or organisation determines the purposes and means of such processing and Photo-Pick processes the relevant personal data on their behalf, Photo-Pick acts as a processor, service provider or equivalent role under applicable privacy law.
Such processing may include:
Where required by applicable law, processing performed on behalf of another controller will be governed by a Data Processing Agreement or other applicable data-processing terms.
Where a User acts as controller of personal data processed through Photo-Pick, that User is responsible for ensuring that their processing complies with applicable law.
Depending on the circumstances, this may include responsibility for:
The legal classification of Photo-Pick and a User depends on the particular processing activity and applicable law.
The personal data we process depends on how a person interacts with Photo-Pick and which features of the Service are used.
We may process Account information such as:
Content processed through the Service may include:
Content may contain personal data relating to the person uploading it or to other individuals, including persons depicted in photos or videos.
When files are uploaded, we may process technical information necessary to provide the Service, including:
Photo-Pick does not extract or use GPS or location metadata from uploaded photos.
When a person creates, accesses or interacts with an Album, we may process information such as:
Some interaction information may be visible to the Album owner or other authorised participants where this is part of the relevant functionality.
A registered Account is not always required to access or interact with an Album.
Where a person accesses an Album through an invitation, shared link or other permitted access method, we may process information necessary to provide and secure that access.
This may include:
Where another User provides an email address for the purpose of sending an invitation, we receive that information from that User rather than directly from the invited person.
When the Service is accessed or used, we may automatically process information such as:
We may derive approximate geographic information, such as country or region, from an IP address.
If a paid Subscription or other paid Service is purchased, we may process:
Payments are processed by third-party payment providers. Photo-Pick does not store complete payment card numbers or card security codes in its own systems.
If you contact Photo-Pick, we may process:
We may obtain personal data:
For example, an Album owner may provide another person's email address in order to send an Album invitation or may upload Content relating to another individual.
Where applicable law requires a legal basis, Photo-Pick relies on the legal bases described below when acting as controller.
We process personal data to:
Where the GDPR or similar law applies, such processing is generally necessary for performance of a contract or to take steps at the User's request before entering into a contract.
We process transaction and Subscription information to:
Processing may be necessary for performance of a contract and, in relation to certain records, compliance with legal, tax or accounting obligations.
We process relevant information to respond to enquiries, investigate problems, provide technical support and resolve complaints.
Depending on the circumstances, processing may be based on performance of a contract or our legitimate interest in providing support and responding to communications.
We may process Account, technical, access and usage information to:
Where applicable, we rely on our legitimate interests in protecting Photo-Pick, its Users, Content and infrastructure.
We may process technical, diagnostic and usage information to:
Where such processing is not necessary for performance of a contract, we may rely on our legitimate interests.
Where applicable law requires consent for a particular analytics or similar technology, we rely on consent.
We process contact and Account information where necessary to send communications relating to the Service, including security notices, Subscription information, payment information, support messages and important changes affecting the Service or applicable legal terms.
Depending on the communication, processing may be necessary for performance of a contract, compliance with a legal obligation or our legitimate interests in administering the Service and communicating important information to Users.
Where permitted by applicable law, Photo-Pick may use contact information to send information about its own products, features, services or offers.
Where consent is required by law, marketing communications will be sent only after the required consent has been obtained.
A User may opt out of direct marketing at any time.
We may process personal data where necessary to:
Where Photo-Pick processes personal data solely as a processor, the relevant controller determines the applicable legal basis for that processing.
Photo-Pick processes such personal data in accordance with the controller's lawful instructions, applicable contractual terms and applicable law.
Users may upload photos, videos and other Content that contains personal data relating to other individuals.
Where applicable law places responsibility on the User, the User is responsible for ensuring that they have the rights, permissions, consents or other legal basis necessary to upload, store, process and share the relevant Content.
Users must not use Photo-Pick to process personal data unlawfully.
Photos and videos may depict individuals who do not have a Photo-Pick Account and who have never interacted directly with Photo-Pick.
The User who uploads or shares such Content determines what is submitted and with whom it is shared.
Depending on its content and context, Content may contain information that is sensitive or subject to additional protection under applicable law.
Users should not upload or share such information unless they are legally entitled to do so and have satisfied any additional legal requirements applicable to the processing.
Not every individual User necessarily acts as a data controller under applicable data-protection law.
Certain data-protection requirements may not apply to processing carried out by an individual solely in the course of a personal or household activity.
Any such exemption applicable to a User does not remove Photo-Pick's own obligations under applicable privacy and data-protection law.
Photo-Pick allows Users to share Albums and Content with other persons.
Depending on the Album settings, a recipient may be able to:
The User who creates or manages an Album is responsible for selecting access and privacy settings appropriate for the intended recipients.
A shared link, invitation, password or other access mechanism may provide access to Content.
Recipients may be able to forward access information to other persons. Depending on the Album settings, a person who obtains that information may also be able to access the Album.
Users should therefore consider the nature of the Content and the selected access settings before sharing an Album or access information.
Where downloading is enabled, recipients may save Content outside Photo-Pick.
Once Content has been downloaded or otherwise transferred outside Photo-Pick, we generally cannot control how that copy is stored, used, shared or deleted.
Deleting the original Content from Photo-Pick does not delete copies previously downloaded or otherwise lawfully obtained by another person.
Where uploads are enabled, Guest Users may upload photos, videos or other supported Content to an Album.
Such Content may become part of the relevant Album and may be accessible to the Account holder and other authorised participants.
No online access-control mechanism can completely prevent an authorised recipient from copying, recording, photographing or otherwise capturing information that the recipient is able to view.
Photo-Pick uses cookies, local storage and similar technologies where necessary to operate, secure and improve the Service.
Strictly necessary technologies may be used for purposes such as:
Where permitted by applicable law, such technologies may be used without consent because they are necessary to provide or secure the requested Service.
Blocking them may cause parts of Photo-Pick to function incorrectly.
We may use browser storage or similar technologies to remember settings such as language, interface preferences and certain Service preferences.
Where consent is legally required, the relevant technology will be used only after the required consent has been obtained.
Photo-Pick uses Google Analytics 4 to understand how the Service is used and to improve its functionality and user experience.
Depending on the relevant configuration, analytics information may include:
Google Analytics may process technical identifiers, including an IP address, in order to derive approximate geographic information.
Photo-Pick uses Google Analytics for analytics and Service-improvement purposes only.
Photo-Pick does not use Google Analytics for Google Ads, advertising personalisation, remarketing, advertising audiences or other targeted or behavioural advertising.
Where applicable law requires consent for Google Analytics or another non-essential technology, the relevant technology will not be activated until the required consent has been obtained.
Where applicable law requires consent, Users may be provided with controls to accept or reject non-essential technologies and to change or withdraw previous choices.
Consent is not inferred merely from continuing to browse or use the Service.
More detailed information about individual cookies, providers, purposes and retention periods may be provided through Photo-Pick's cookie settings or a separate Cookie Policy.
We may send communications necessary to administer, provide or secure the Service, including:
These communications are not intended as marketing.
Users may not be able to opt out of communications that are necessary for an active Account or requested Service.
Photo-Pick may send Album invitations and notifications relating to Album access, selections, comments, uploads or other Album activity.
Where a User supplies another person's email address for an invitation, Photo-Pick uses the address to provide the requested Album-related communication and functionality.
An Album invitation does not constitute consent to receive unrelated Photo-Pick marketing.
Where permitted by applicable law, Photo-Pick may send marketing communications concerning its own products, features, services or offers.
Where consent is legally required, marketing communications will be sent only after obtaining the required consent.
Marketing communications will provide a method to unsubscribe or otherwise object to further direct marketing.
An opt-out from marketing does not prevent Photo-Pick from sending necessary service, security or transactional communications.
Photo-Pick does not disclose personal data except where necessary to provide, operate or secure the Service, where directed by a User or another controller, where permitted or required by law, or as otherwise described in this Privacy Policy.
We use third-party providers to help operate, maintain, secure and support the Service.
Depending on the services used, they may provide:
Such providers may process personal data only to the extent necessary to provide the relevant services or as otherwise permitted by applicable law.
Where Photo-Pick acts as processor, providers processing personal data on our behalf may act as subprocessors.
Where required, appropriate contractual, confidentiality, security and data-protection terms apply.
Information about material subprocessors and relevant processing locations may be made available separately or upon request where required by applicable law.
Personal data may be disclosed to Album owners or other authorised participants where this is necessary to provide the relevant Album functionality.
For example, an Album owner may be able to see selections, comments, uploaded Content or other interactions.
Information necessary to administer a payment or Subscription may be exchanged with payment providers.
Payment providers may independently process information where necessary for payment authorisation, fraud prevention, regulatory compliance, disputes, chargebacks or other obligations applicable to them.
Photo-Pick does not receive or store complete payment card numbers or card security codes.
We may disclose personal data where reasonably necessary to lawyers, accountants, auditors, insurers, tax advisers or other professional advisers, subject to applicable confidentiality requirements.
We may disclose personal data where reasonably necessary to:
If Photo-Pick is involved in a merger, acquisition, restructuring, financing, sale of assets, transfer of business or similar transaction, relevant personal data may be disclosed to parties involved in that transaction where reasonably necessary and subject to applicable law and appropriate confidentiality obligations.
Personal data may also be disclosed where you request, direct or authorise us to do so, including when you share an Album, invite another person, enable particular Album functionality or connect a third-party integration.
Photo-Pick's business model is based on providing the Service, including through paid Subscriptions. It is not based on selling personal data or monetising Content through advertising.
Photo-Pick:
Where applicable law uses the term "sharing" specifically for disclosure in connection with cross-context behavioural advertising, Photo-Pick does not share personal data for that purpose.
Disclosure to hosting providers, payment processors, analytics providers and other service providers for operation of the Service is not undertaken for their independent targeted or behavioural advertising.
Photo-Pick may use service providers and infrastructure located in different countries.
As a result, personal data may be stored, accessed, transferred to or otherwise processed outside the country in which the relevant individual is located.
Where applicable law restricts international transfers of personal data, Photo-Pick uses an appropriate legal mechanism for the relevant transfer.
For transfers of personal data protected by the GDPR, such mechanisms may include:
For transfers subject to UK data-protection law, applicable mechanisms may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses or another mechanism permitted by applicable law.
Where applicable law gives you the right to obtain information about safeguards used for an international transfer, you may contact Photo-Pick at: contact@photo-pick.com
Photo-Pick retains personal data only for as long as reasonably necessary for the purposes for which it is processed or as otherwise required or permitted by applicable law.
Retention periods depend on factors including:
Account information is generally retained while the Account remains active or while it is otherwise necessary to provide the Service.
Following Account closure or deletion, information that is no longer required will be deleted or anonymised, subject to lawful retention requirements.
Content is generally retained for as long as necessary to provide the requested Service, subject to Account status, User actions and applicable Service retention rules.
Users may delete individual Content, Albums or their Account using deletion functionality made available by Photo-Pick, where available.
Deletion from Photo-Pick's active systems may not result in simultaneous deletion from every backup, disaster-recovery or temporary technical system.
Deleted information may remain for a limited period until relevant backups or technical storage are deleted, overwritten or expire in the ordinary course of operation.
Data retained only in backups or similar isolated systems will not normally be restored to active use except where reasonably necessary for disaster recovery, security, legal compliance or another legitimate technical purpose.
Photo-Pick may apply inactivity and retention rules to Albums, Content or Accounts that remain inactive for an extended period.
Relevant factors may include:
Where appropriate, Photo-Pick may notify the Account holder before permanently deleting inactive Content and may provide an opportunity to preserve the relevant Content.
Photo-Pick is not required to delete an inactive Account merely because it contains no Albums or Content and may retain such an Account in accordance with applicable data-protection and retention requirements.
Certain transaction, billing, accounting or other records may be retained after a Subscription or Account has ended where necessary to comply with applicable legal obligations or protect legal rights.
Technical, access, diagnostic and security logs are retained for a limited period appropriate to security, troubleshooting, Service reliability, fraud prevention and other legitimate operational purposes.
Support communications may be retained for a reasonable period where necessary to resolve requests, maintain appropriate support history, resolve disputes or protect legal rights.
If a person opts out of marketing communications, we may retain limited information necessary to record and continue to respect that opt-out.
In certain circumstances, normal deletion may be suspended where information must be preserved because of a legal obligation, binding legal process, ongoing dispute or investigation, reasonably anticipated legal claim or another lawful requirement.
Photo-Pick implements appropriate technical and organisational measures designed to protect personal data and Content against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful processing.
Depending on the relevant system and risks, such measures may include:
Access to personal data is limited to persons and service providers who require access for legitimate operational, support, security, technical or legal purposes.
No method of electronic transmission, storage or information-security system can be guaranteed to be completely secure.
Photo-Pick maintains processes designed to identify, investigate, contain and respond to suspected security incidents involving personal data.
Where Photo-Pick acts as controller, Photo-Pick will notify competent authorities and affected individuals where and within the periods required by applicable law.
Where Photo-Pick acts as processor, Photo-Pick will notify the relevant controller without undue delay where required by applicable law and applicable contractual obligations.
If you believe that your Account or personal data may have been compromised, please contact: contact@photo-pick.com
Depending on applicable law and the circumstances of processing, you may have rights including:
These rights are subject to the conditions, limitations and exceptions provided by applicable law.
You may have the right to obtain confirmation as to whether Photo-Pick processes personal data concerning you and, where applicable, to receive access to such data and information about the processing.
You may request correction of inaccurate personal data and, where applicable, completion of incomplete personal data.
You may request deletion where applicable law provides such a right.
The right to deletion is not absolute. Information may be retained where continued processing is permitted or required by law, including where necessary for legal obligations, security, fraud prevention or the establishment, exercise or defence of legal claims.
Photo-Pick cannot generally delete copies already downloaded or otherwise lawfully retained outside Photo-Pick by another person.
You may have the right to request restriction of certain processing in circumstances provided by applicable law.
Where applicable, you may have the right to receive certain personal data you provided in a structured, commonly used and machine-readable format and, where applicable, transmit that data to another controller.
Where processing is based on legitimate interests, you may have the right to object to that processing on grounds relating to your particular situation.
You may object to the processing of personal data for direct marketing purposes at any time.
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Where applicable, you may lodge a complaint with a competent data-protection supervisory authority.
Under the GDPR, this may include a supervisory authority in the country of your habitual residence, place of work or place of the alleged infringement.
Privacy requests may be submitted to: contact@photo-pick.com
Please provide sufficient information for Photo-Pick to understand the request and identify the relevant data.
We may request information reasonably necessary to verify identity and prevent unauthorised access, disclosure or deletion.
Photo-Pick responds within the period required by applicable law.
Where the GDPR applies, requests are generally answered without undue delay and within one month, subject to extensions permitted by law in appropriate circumstances.
If a request concerns personal data contained in Content controlled by another person or organisation, that controller may be primarily responsible for responding to the request.
Photo-Pick may refer or forward the request to the relevant controller and provide assistance as required by applicable law and applicable contractual obligations.
Where the GDPR, UK GDPR or related data-protection law applies, individuals may have the rights described above together with any additional rights provided by the relevant law.
Where the California Consumer Privacy Act ("CCPA") or another applicable U.S. state privacy law applies to Photo-Pick and to your personal information, you may have additional rights such as access, correction, deletion, portability and rights relating to qualifying sale, sharing, targeted advertising or profiling.
Photo-Pick does not currently sell personal data or share personal data for cross-context behavioural advertising.
Photo-Pick will not discriminate against a person for exercising privacy rights where such discrimination is prohibited by applicable law.
Where Brazil's Lei Geral de Proteção de Dados Pessoais ("LGPD") or another applicable privacy law applies, Photo-Pick will honour the rights provided by that law to the extent applicable to Photo-Pick and the relevant processing.
The absence of a particular country or jurisdiction from this Privacy Policy does not limit rights that apply under mandatory local law.
Photo-Pick is a general-purpose service and is not specifically directed to children.
Users must satisfy applicable minimum-age and legal-capacity requirements, including any requirements contained in the Photo-Pick Terms and Conditions or applicable law.
Photo-Pick does not knowingly seek to collect personal data directly from children in circumstances where parental or guardian authorisation is legally required and has not been obtained.
If Photo-Pick becomes aware that personal data has been collected directly from a child in violation of applicable law, Photo-Pick may take appropriate steps, including restricting the relevant Account, obtaining legally required authorisation, limiting processing or deleting information where required or appropriate.
Content may include photos or videos depicting children even where the child does not have a Photo-Pick Account and does not interact directly with the Service.
Where required by applicable law, the person uploading or sharing such Content is responsible for having the rights, permissions, consents or other legal basis necessary to do so.
Photo-Pick does not require Users to identify the age of persons depicted in photos or videos as part of the ordinary functionality of the Service.
Photo-Pick is not directed to children under 13.
Where the U.S. Children's Online Privacy Protection Act ("COPPA") applies to personal information knowingly collected online directly from a child under 13, Photo-Pick will comply with the applicable requirements.
Parents or legal guardians who believe that a child's personal data has been provided to Photo-Pick unlawfully may contact: contact@photo-pick.com
Photo-Pick does not currently use personal data to make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect an individual.
Automated systems may nevertheless be used for ordinary technical operation, security and maintenance of the Service, including:
These activities are not intended to make legally or similarly significant decisions about individuals.
Photo-Pick does not use Content to create advertising profiles.
The Service may contain links to or integrations with third-party websites, applications or services.
Where a third party independently determines how personal data is processed, that processing is governed by the third party's own privacy practices and is not covered by this Privacy Policy.
If a User chooses to connect a third-party integration, Photo-Pick may exchange information with that service to the extent necessary to provide the requested functionality.
Disconnecting an integration does not necessarily delete information already transferred to and lawfully retained by the third party.
Where applicable law requires Photo-Pick to recognise and honour a legally valid Global Privacy Control ("GPC") or similar privacy-preference signal, Photo-Pick will comply with that requirement.
Because Photo-Pick does not currently sell personal data or share personal data for cross-context behavioural advertising, there is currently no such sale or advertising-related sharing for a GPC signal to opt out of.
Some browsers transmit a legacy "Do Not Track" ("DNT") signal.
Because there is no universally adopted standard governing these signals, Photo-Pick does not currently treat legacy DNT signals as a separate privacy preference unless applicable law requires otherwise.
This does not affect consent choices or privacy rights available through Photo-Pick or under applicable law.
Photo-Pick may update this Privacy Policy from time to time to reflect changes to:
Minor, editorial or non-material changes may become effective when the updated version is published.
If a change materially affects how personal data is collected, used, disclosed or otherwise processed, Photo-Pick will provide additional notice where required by applicable law or where appropriate in light of the significance of the change.
Depending on the circumstances, notice may be provided through the Service, by email, through a notice on the Photo-Pick website or by another appropriate method.
Where new consent is legally required, an update to this Privacy Policy does not itself constitute such consent.
Continued use of Photo-Pick does not waive privacy rights or replace consent where consent is required by applicable law.
Questions concerning this Privacy Policy, Photo-Pick's privacy practices or the processing of personal data, as well as requests to exercise applicable privacy rights, may be directed to:
Photo-Pick
Website:
https://www.photo-pick.com
Email:
contact@photo-pick.com
Where applicable law requires Photo-Pick to appoint a Data Protection Officer, EU representative, UK representative or another privacy representative, the relevant contact information will be made available as required by law.
Where a privacy request concerns personal data that Photo-Pick processes solely on behalf of another controller, Photo-Pick may refer the request to that controller and assist with the request as required by applicable law and applicable contractual obligations.
Last Updated: 23 September 2026