Privacy Policy

Status: 19. December 2022, Version 3.2

This Privacy Policy gives you an overview of how your personal data is processed at MyPicture.co.uk (subsequently “our website”).

Introduction

We have preceded each chapter with a short overview text. In this overview text the content of the chapter is briefly summarized. If you only want to get a quick overview of all data processing, we recommend that you only read the overview texts. If you want to familiarize yourself with the details, you can click on "Learn more" below the respective overview text. The complete contents of the chapter will then be displayed.

1. Which personal data do we process from you?
   We offer you various services which you can use in different ways. Depending on whether you contact us online, by telephone or in any other way, and which services you use, different data is generated from different sources. Many of the personal data processed by us are provided by yourself when you use our services or contact us. For example when you place an order you provide us with your name, e-mail address or postal address. We also receive technical device and access data that is automatically collected by us when you interact with our services, like information about the device you use to contact us. We collect further data through our own data analyses (e.g. in the context of market research studies). We may also receive data about you from third parties, such as payment service providers.
   
   Learn more
   
   
   1. Usage data
      When you visit our web pages, a data record of so-called usage data is temporarily stored on our web server for statistical purposes as a protocol, to improve the quality of our web pages. We use servers from Amazon Web Services (AWS) with server location in Germany. The legal basis for this is Art. 6 para. 1 lit. f GDPR.
      
      This data record consists of
      
      
      • the page from which the file was requested (a "page" is a file on a web server)
      • the name of the file
      • the date and time of the query
      • the amount of data transferred
      • the access status (file transferred, file not found)
      • the description of the type of web browser used
      • the IP address of the requesting computer
      
      
      We store the IP address transmitted by your web browser for a maximum period of 30 days, for the purpose of detecting, limiting and eliminating attacks on our websites. In order to be able to trace the origin of such attacks, it is necessary to temporarily store the IP address. After this period, we delete the IP address. The legal basis for this processing is Art. 6 para. 1 lit. f GDPR.
   
   
   
   2. Ordering photo products
      If you order a product from us, we store the following data:
      
      
      • The IP address of the requesting computer
      • the image files transmitted by you
      • the information provided by you for the processing of the order, such as your e-mail address, name, address
      
      
      We store this data regularly for 6 months, but we might store it for a little longer in case of an order complaint. The storage period of 6 months is needed for orders for possible legal defence. This is required within the framework of warranty law within the consumer-friendly period of § 477 BGB (on the basis of Directive 1999/44/EC of the European Parliament and Council of 25 May 1999) and necessary to be able to review claims asserted. A longer storage beyond this period is possible for legally binding reasons, for example for tax or accounting reasons. In the case of an order that you have initiated but not yet completed, we will store the information entered for 10 days to give you the opportunity to complete the placement of the order. The data will then be deleted accordingly.
   
   
   
   3. Customer account
      If you want to create a personal login or user account, you must first register. We collect and process the following data: Title, surname, first name, e-mail address, street, postal code, city, country, telephone number (optional) and your password. The legal basis for the processing is Art. 6 Para. 1 lit. b GDPR. We use data that you provide to us in the course of registration or your inquiries to create a customer account for you and to make it even easier for you to place orders. You can change or even delete the information in your user account at any time within the user account. The data will then be automatically removed from our system if there are no retention periods or if the data is not required in individual cases (for example, in the case of open claims to collect the receivables).
   
   
   
   4. Offline Client
      If an offline tool is available for download on our website, you can download it by clicking on the download button. This allows you to personalize a photo book offline with your pictures and then order it online. Personal data is processed by the offline client in accordance with no. 1.2 of this Privacy Policy to process your order. This processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR for the purpose of fulfilling the contract. The data is regularly stored for 6 months.
   
   
   
   5. Job applications
      We process your personal data in accordance with the applicable data protection regulations based on § 26 BDSG. We process the data that you provide us with your online application exclusively for the purpose of selecting applicants. Data processing for other purposes does not take place.
      
      You determine the scope of the data that you wish to transmit to us in the context of your online application yourself. Online applications are transferred electronically to our personnel department and processed there as quickly as possible. The transmission is encrypted. Applications are usually forwarded to the heads of the relevant departments in our company. Your data will not be passed on beyond this. Your data will be treated confidentially in our company. If your application is unsuccessful, your documents will be deleted after 6 months.
      
      In the event that we may also consider your application for other or future job advertisements, please make a corresponding note on your application. We will then process your data on the basis of Art. 6 Para. 1 lit. a GDPR.



2. What do we use the data for?
   We process your data in compliance with all applicable data protection laws. We abide in particular by the principles of the data protection laws for the processing of personal data. We therefore process your data only for the purposes explained to you in this Privacy Policy or for the purposes communicated to you when the data was collected.
   
   These are primarily the processing of orders and the provision, personalisation and further development as well as the security of our services. In addition, we use your data within the framework of the strict German and European data protection laws, but also for other purposes, such as product development, scientific research (especially in the areas of machine learning, artificial intelligence and deep learning) and market research, for the optimization of business processes, the design of our services to meet your needs and for personalized advertising.
   
   For reasons of data protection, we do not integrate social media plugins directly into our website. Therefore, when you call up our pages, no data is transmitted to social media services such as Facebook, Instagram, Twitter, and Pinterest.
   
   Learn more
   
   
   1. Order processing
      We store and use the personal data, you transmit to us (e-mail address, name, address, transmitted image files, IP address), in the course of an order process in accordance with Art. 6 Para. 1 lit. b GDPR, exclusively for processing your orders. In particular, we use your e-mail address for information on the status of your order, as well as for legally permitted newsletter sending in accordance with § 7 para. 3 UWG and article 13 para. 2 EU Directive 2002/58/EG, which you can cancel at any time (see point 4). We use your image files exclusively for the execution of the order, to present other products from us to you and for our own marketing analysis. Your image files are usually deleted after 3 months, unless longer storage is required due to e.g. customer service cases.
   
   
   
   2. Data transfer to third parties
      In order to offer you the best possible shopping experience in our online shop, we work together with various service providers. These service providers enable us to offer you a variety of different payment options, to set up the fastest shipping method for you and to reward you for your orders with advantages and thus create a completely satisfying shopping experience. Our technical service providers help us analyse data and make marketing decisions that reach our customers. The transmission of data to third parties is exclusively within the limits and specifications of the GDPR.
      
      
      1. Order processing
         We transfer your data within the scope of order processing in accordance with Art. 28 GDPR to service providers who support us in the operation of our websites and related processes. Our service providers are strictly bound by instructions and are contractually bound to us accordingly. We use the following service providers:
         
         Learn more
         
         
         1. Customer service
            To provide customer services in connection with orders from end consumers we use the services of: Salesforce. For more information, see Chapter 3 (below).
         
         
         
         2. Analysis of the website
            To improve and monitor our website, we use the services: Salesforce, Facebook Business Manager, Facebook Custom Audience List, Google Customer Match List, intelliAd, Google Analytics, Google AdSense, Google Adwords. For data protection information of the individual providers, please contact the respective provider directly.
         
         
         
         3. Marketing
            We work together with the following marketing partners to carry out marketing activities: Google Adwords, Google AdSense, Google Display Network, YouTube, Pinterest; Bing, Facebook, as well as Affiliate Networks (Awin, Flexoffers, Cross sell, Zanox, Affilinet, Webgains, Tradetracker, Daisycon, CJ Affiliate by Conservant, Belboon, Adcell) and their respective affiliated partners.
            
            These marketing partners check whether you have reached our site by clicking on an advertisement. This gives us the opportunity to develop targeted marketing strategies and to ensure an optimal advertising experience for you as a user. For data protection information from the various providers, please contact the respective provider directly.
         
         
         
         4. Customer communication
            For communication with our customers, especially for sending transactional e-mails in connection with orders and for sending e-mail newsletters, we use Emarsys.
         
         
         
         5. Hosting
            For hosting purposes we use the services: Amazon Elastic Cloud Computing (EC2), Amazon Elastic Load Balancer (ELB), Amazon Relational Database Services (RDS) and Amazon Simple Storage Service (S3) by Amazon Web Services (AWS), utilizing the AWS data centre in Frankfurt.
         
         
         
         6. Special offers
            After completing an order, we offer our customers the opportunity to take advantage of a special offer and save money on their next purchase in an online shop.
            
            For this purpose, we use the special offers of Sovendus GmbH. In case of an order the following therefore applies:
            
            For the selection of a regionally interesting special offer and voucher offers, we will send the pseudonymised title, year of birth, country, postal code, hash value of the e-mail address and your IP address encrypted to Sovendus GmbH, Moltkestr. 11, 76133 Karlsruhe (Sovendus) (Art. 6 para. 1 f GDPR). The pseudonymised hash value of the e-mail address is also used to take into account a possible objection to advertising by Sovendus (Art. 21 para. 3, Art. 6 para. 1 c GDPR). The IP address is used by Sovendus exclusively for data security purposes and is anonymised after seven days (Art. 6 para.1 f GDPR).
            
            In addition, we transmit the order number, order value with currency, session ID, coupon code and time stamp to Sovendus in pseudonymised form for billing purposes (Art. 6 para.1 f GDPR). If Sovendus has not registered a prior objection under your email address a voucher banner is displayed after your purchase. If you click on such voucher banner, we will send the title, name and your e-mail address to Sovendus in encrypted form in preparation for the voucher (Art. 6 para. 1 b, f GDPR).When you click on a special offer, we also send your name, address and e-mail address to Sovendus in encrypted form in preparation for the personalised request for the benefit offer (Art. 6 para. 1 b, f GDPR).
            
            For further information on the processing of your data by Sovendus, please refer to the online privacy policy at https://www.sovendus.com/de/datenschutz/.
      
      
      
      2. Picanova Group of Companies
         This website is operated by United Arts GmbH, a subsidiary of the Picanova Group. The Picanova Group operates several web shops and sells photo products all over the world. Many systems and technologies are shared within the Picanova Group. This enables us to offer you a cheaper, better, safer, more consistent and more interesting service. For this reason, those companies and departments within the Picanova Group are given access to your data when required to fulfil our contractual and legal obligations or to perform their respective functions within the Picanova Group.
         
         When processing your order, we ensure that only the relevant departments and companies of Picanova Group have access to your data.
      
      
      
      3. Shipping companies
         Depending on the format and delivery country of your parcel, shipping is carried out with the shipping service providers Deutsche Post, DHL, GEL, GLS, Hermes, UPS, the freight forwarding companies Möller Spedition, MBS or with Amazon. For this purpose, your name and address will be transmitted to the respective shipping companies. If, as is the case with Freight forwarding orders, it is necessary to transmit your telephone number and/or e-mail address, we will also transmit this data to the shipping company or forwarding agent. The data processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR in the context of the fulfilment of the contract. If your shipment is shipped with a shipping company, you agree that we may also provide your e-mail address to the shipping company so that they can send you information about the status of the shipment and scheduled delivery. The data processing is carried out in accordance with Art. 6 Par. 1 lit. a DSGVO. Decline data transfer
      
      
      
      4. Payment provider
         If you have chosen the credit card payment method or an online payment method (e.g. PayPal), you can proceed to complete the order with the respected payment service provider (for a credit card payments: wirecard or adyen). After entering your access data, you can request payment via the service provider. In order to process the payment, we will forward the payment amount and your personal data to the selected payment service provider.
      
      
      
      5. Customer surveys
         To conduct customer surveys, we use the service of the provider Qualtrics LLC, 333 W River Park Drive, Provo, Utah 84604, USA. By using the Qualtrics service, we can communicate with our customers on questions about, for example, their order, customer service cases or our offer. The legal basis for this transfer is Art. 6 para. 1 lit. f, a GDPR. For questions regarding data protection at Qualtrics, please consult their privacy policy, which can be reached here: https://www.qualtrics.com/support/de/survey-platform/getting-started/data-protection-privacy/. The use of the Qualtrics service enables us to further adapt our offer to the needs and requirements of our customers.
      
      
      
   
   
   3. Data transfer to third countries
      In the case of the EU countries, the EU Commission has established an adequate level of data protection in accordance with Art. 45 (1) GDPR. In some cases, we also transfer personal data to third countries outside the EU. In each case, we ensure an appropriate level of data protection
      
      In the case of data transfers to the USA, an adequate level of data protection follows from the corresponding participation of the service providers in the EU-US Privacy Shield Agreement (Art. 45 para. 1 GDPR).
   
   
   
   4. Tracking tools (Google Analytics and intelliAd)
      For the demand-oriented design of our website we create pseudonymous user profiles with the help of Google Analytics and intelliAd. We explain the functionality of both tools using Google Analytics as an example. Google Analytics uses cookies that are stored on your end device and can be read by us. In this way we are able to recognize returning visitors and count them as such. The data processing is based on Art. 6 para. 1 lit. f GDPR or § 15 para. 3 TMG and in the interest of finding out how often our web pages have been accessed by different users.
      
      Learn more
      
      The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, since we have activated IP anonymisation on this website, your IP address will first be shortened by Google within the member states of the European Union. Only in exceptional cases will the full IP address be transferred to a Google server in the USA (an appropriate level of data protection is provided by Google's participation in the Privacy Shield in accordance with Art. 45 para. 1 GDPR) and only be shortened there. We have made an agreement with Google Inc. (USA) for commissioned data processing in accordance with Art. 28 GDPR. According to this, Google may use all information only strictly for the purpose of evaluating the use of our website for us and compiling reports on website activity.
      
      You can object to this processing at any time. Please use one of the following options:
      
      

      • You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of this website.
      • You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link (http://tools.google.com/dlpage/gaoptout?hl=enl).
      • To opt out of intelliAd please click here: https://login.intelliad.com/optout.php

      
      
      
   
   
   5. Retargeting
      In order to offer you advertising on other websites that is tailored to your interests, we use retargeting technologies from Adobe Media Optimizer AMO in conjunction with Google, Facebook and Bing.
      
      Learn more
      
      
      1. Retargeting technologies
         The data processing is carried out on the basis of Art. 6 para. 1 letter f GDPR. In the following, the functionality of these tools is explained using Google as an example and applies accordingly to all retargeting technologies.
         
         When you visit our websites, recognition features of your browser or terminal device are called up, your IP address is evaluated, or a recognition feature is saved as a small text file (e.g. so-called third-party cookie) on your terminal device. Your usage behaviour is recorded when you visit various websites. The features are designed pseudonymously. If you are logged in with your Google Account, these features can be directly assigned to your profile. Google can link and store your visits to our websites with your characteristics in order to display targeted advertising on other websites. In this way Google can also determine the previous visit to our website. Your device and browser will be recognized by Google, for example when you visit a page that displays advertising on behalf of Google.
         
         How does a conversion tool work?
         Below you will find more detailed information about conversion tools.
         
         Google Conversion Tool:
         This website also uses the Google Conversion Tool for pseudonymous internal analysis of the effectiveness of ads displayed. If you come to our website from another website by clicking on one of our ads (text ads, banner ads), the banner ad there will place a cookie in your browser program. If the banner ad was an advertising campaign commissioned by Google, Google sets the corresponding cookie when you click on the banner ad. Neither our conversion partner nor we can see which other websites you have visited. We do not collect or receive any information that can be used to identify users personally. The information collected by means of conversion tracking is used solely to compile statistics on the success and use of our campaigns. These cookies lose their validity after 30 days. The legal basis for this use of cookie technology is Art. 6 para. 1 lit. f GDPR.
         
         If you do not wish to take part in this analysis, you can deactivate the setting of cookies via browser settings or declare your objection here: http://optout.networkadvertising.org/?C=1#!/.
         
         The information that you arrived on our website as an anonymous site visitor via a Picanova advertising banner is read from your cookie and processed anonymously by us and our respective conversion partner (e.g. Google). Personal information about you will not be passed on.
         
         Bing Conversion Tool:
         This website also uses the Bing Conversion Tracking analysis service of Microsoft Corporation (One Microsoft Way Redmond, WA 98052-6399) to measure the success of further advertising measures. Microsoft sets a cookie on your computer when you access our website via a Picanova ad from the Microsoft advertising network. These cookies lose their validity after 30 days and are not used for personal identification. By means of Bing Conversion Tracking, we and Microsoft can recognize that someone has clicked on our advertisement within the Microsoft advertising network and thus been redirected to our site. However, we cannot see what other sites you have visited. The information collected by Bing Conversion Tracking is used solely to compile statistics about the success and usage of our advertising campaigns. However, we do not collect or receive any information that personally identifies users. The legal basis for this use of cookie technology is article 6 paragraph 1 f GDPR.
         
         If you do not wish to participate in Bing Conversion Tracking, you can refuse the necessary setting of a cookie - for example, by changing your browser settings to generally disable the automatic setting of cookies. To do this, you only need to click on the following link here: https://about.ads.microsoft.com/en-gb/resources/policies/opt-out-of-the-microsoft-advertising-optimization-program and confirm your objection on the page that can be reached via this link.
         
         You can find further information and setting options for advertising measures by Microsoft here: https://about.ads.microsoft.com/en-gb/resources/policies/privacy-and-data-protection-policies
         
         The information that you as an anonymous site visitor reached our website via our advertising banner is read from your cookie and processed anonymously by us and Microsoft. Personal information about you will not be passed on.
      
      
      
      2. Remarketing
         We can provide our web pages with keywords that contain statements about the content of the web page, such as products offered. For this we use Google Tag Manager, Visual Website Optimizer (VWO) and Adobe Media Optimizer (AMO), Google Adwords. In the following we will explain how this works using the Google Tag Manager as an example. Google receives these keywords, which contain neither personal nor sensitive information. When you visit a page with certain keywords related to products, Google stores this and assigns it to your pseudonymous recognition features. This link allows Google to see if you are viewing any of our advertisements, and if so, which ones.
         
         Google Display advertising network:
         We also use Google's remarketing technologies on our website. Cookies are used by us to recognize your computer on other websites that participate in the Google Display advertising network, based on the logged data (visit to our website including date and time, preferred language, browser type, operating system) and to present you with ads tailored to your presumed interests. The legal basis for this use of cookie technology is Art. 6 para. 1 f GDPR. You can view, remove or add the categories according to which interest-based advertising is displayed to you throughout the Google Display advertising network using this technology by using Google's Ads Preferences Manager. This tool also allows you to opt-out of the use of interest-based advertising cookies across the Google Display advertising network altogether by downloading and installing the browser plugin to disable the advertising preferences cookie.
         
         You can also learn more about personalised advertising on Google by visiting https://policies.google.com/privacy?hl=en-GB.
         
         As soon as you use the same browser program to visit other websites on the Internet whose operators have integrated advertising spaces of the Google Display advertising network, the information from the cookie is automatically read by this website operator and used to display content that is presumably of interest to you in the advertising banner. This information is not stored by the other website operators beyond this temporary anonymous evaluation.
         
         Facebook conversion technology:
         We use the service "Facebook Remarketing" on our internet pages. Through the Facebook remarketing technology, users who have visited our internet pages can be addressed again through targeted advertising on Facebook internet pages. However, we do not collect or receive any information about which Facebook users are actually shown targeted advertising. It is also not possible for us to identify individual users. The legal basis for this data processing is Art. 6 para. 1 lit. f GDPR. All you have to do is click on the following link https://www.facebook.com/policies/cookies/ and confirm your objection on the page that can be reached via this link.
         
         More detailed information about the purposes and scope of the collection and processing of your personal data by Facebook, as well as the setting options for protecting your privacy on Facebook, can be found in the Facebook Privacy Policy. You can deactivate your account via the Digital Advertising Alliance in the USA, the Digital Advertising Alliance of Canada in Canada or the European Interactive Digital Advertising Alliance in Europe or via the settings of your end device so that no interest-based online advertisements from Facebook and other participating companies are displayed.
         
         The Facebook Conversion Pixel allows us and Facebook to recognize that someone has clicked on our Facebook Ads and has been redirected to our site. The information generated by the cookie and/or graphics about your use of this website is transferred to a Facebook server in the United States and stored there. Facebook uses the information obtained in this way to evaluate your usage behaviour with regard to Facebook ads. Facebook may also transfer this information to third parties if required by law or if third parties process this data on behalf of Facebook. Facebook hereby declares that your IP address from Facebook will not be associated with other data stored by Facebook
      
      
      
      3. Cross Device Remarketing
         Google can technically link the pseudonymous features of e.g. your end devices such as tablet, smartphone and email mailbox (cross device marketing). The prerequisite is that you have agreed to this data processing in the past. This enables Google to carry out advertising campaigns in a targeted manner via different end devices. We use this to be able to evaluate our marketing strategies. The legal basis for this data processing is Art. 6 para. 1 lit. f GDPR.
         
         Your data is transferred to Google and stored in the USA. According to Art. 45 para. 1 GDPR an adequate level of data protection is provided by Google's participation in the Privacy Shield. We have an Agreement with Google Inc. (USA) for order processing in accordance with Art. 28 GDPR. According to this, Google may use all information for the sole purpose of evaluating your use of the website and compiling reports on website activity for us. You can object to this at any time in accordance with Art. 21 GDPR. Please click on the following link: https://support.google.com/ads/answer/7395996?hl=en-GB
      
      
      
      4. Customer Matching
         For our marketing campaigns, we use conversion-based customer lists for the purpose of customer matching. In doing so, we pass certain customer data (e.g., email addresses) from our customer lists to Google for optimized customer targeting within the Google network. The data is sent to Google encrypted. Actual email addresses are not transmitted. Google neither stores the data nor uses it for other Google products, regardless of whether there is a match or not.
      
      
      
      5. Google Signal
         We use Google Signal. When you visit our website, Google Analytics collects, among other things, your location, search history, and demographic data (visitor data). This data can be used for personalized advertising with the help of Google Signal. If you have a Google account, the visitor data from Google Signal will be linked to your Google account and used for personalized advertising messages. The data is also used to create anonymized statistics on the user behavior of our users.
      
      
      
      6. Innkeepr
         a) On our website, we use the web analysis service Innkeepr to analyze and regularly improve the usage of our site. The statistics obtained allow us to enhance our offerings and make them more interesting for you as users. The legal basis for using Innkeepr is Article 6, Paragraph 1, Letter f of the General Data Protection Regulation (GDPR).
         
         b) Innkeepr uses cookies, which are stored on your computer and enable an analysis of your usage of our website. The information collected in this way is stored exclusively on EU servers. We use Innkeepr without collecting IP addresses or hardware specifications. There is no direct personal reference to the data we collect.
         
         c) You can prevent the storage of cookies by adjusting your browser settings accordingly. However, we would like to point out that in this case, you may not be able to fully utilize all the functions of this website. The data is stored in the localStorage under tjs_userData and tjs_sessionData. The lifespan of the data is theoretically unlimited because there is no personal reference to delete.
   
   
   
   6. Marketing Tools
      To better customize our website to your needs we use Visual Website Optimizer (VWO), Adobe Media Optimizer (AMO) and Google Tag Manager, Google Attribution, Usabilla.
      
      Learn more
      
      Google Tag Manager
      The Google Tag Manager manages tags (code elements on the website) that are used to measure traffic and visitor behaviour, capture the impact of online advertising and social channels, use remarketing and targeting, and test and optimize the website.
      
      Google Attribution
      Google Attribution offers us the possibility to evaluate the data of Google Analytics and Google Adwords bundled in one tool.
      
      Feedback Service Usabilla
      On this website, we use the service "Usabilla for Websites" provided by Usabilla B.V. (Rokin 16, 1012 KR Amsterdam, Netherlands, hereinafter referred to as "Usabilla"). Usabilla collects feedback from website visitors to enable us to analyse and improve the use of our website and any errors that may occur. If a user uses the feedback button displayed on the website or uses another type of feedback option, cookies are set on his or her computer and the user's browser establishes a direct connection to the server of Usabilla. Usabilla collects information such as the type of device and operating system and stores it in a user profile. In addition, so-called custom variables are processed, which help us to further optimise the website and can provide us with more background information. Information such as the origin of the traffic (did you reach our website via a search engine or by entering the URL?) or the number of items in the shopping cart is processed. We process your data exclusively in anonymised form, so that no personal reference can be made. Further data such as the e-mail address and information in the feedback free text field, which can be used to establish a personal reference, are only collected if you provide them actively and voluntarily. The cookie is only set when the user clicks on the corresponding button. The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. f GDPR, as we have a legitimate interest in analysing any errors that occur and thus improving our website. If you decide to provide us with personal data, we will store it for a period of 6 months and then delete it in accordance with data protection regulations. You can then object to the collection by deleting and blocking the cookie from your browser. However, this only applies until you click on a feedback button again. You can find further information here https://usabilla.com/privacy.
   
   
   
   7. Google Image Tagging
      Following the order process, the transmitted image file in reduced graphic resolution is automatically analysed by the "Google Image Tagging" service. By means of this image analysis, the main areas of interest of our customers are evaluated and provided with keywords (so-called "tags"). These abstracted "tags" are used exclusively for internal company purposes and to enable interest-specific direct marketing measures (e.g. topic-related e-mail newsletters) for current offers for our products. The legal basis for this is Art. 6 para. 1 f GDPR.
   
   
   
   8. Social Media Plugins
      For reasons of data protection, we do not integrate social media plugins directly into our website. Therefore, when you visit our pages, no data is transmitted to social media services such as Facebook, Instagram, Twitter, and Pinterest. A profile creation by third parties is therefore excluded. The integration of pages only serves the purpose of forwarding to our accounts.
      
      You still have the possibility to share selected pages with a click on Facebook, Twitter, Pinterest or Google+ buttons and you can also see how often they have been shared in the past.
   
   
   
   9. Facebook Fanpage
      We operate an official Facebook page under the URL https://support.trustedshops.com/gb/lp/GDPR. At no time do we collect, store or process personal data of our users on this site. Furthermore, no other data processing is carried out or initiated by us. The data you enter on our Facebook page, such as comments, videos or pictures, will at no time be used or processed by us for other purposes
      
      Facebook uses so-called web tracking methods on this page. Please be aware that it cannot be ruled out that Facebook may use your profile data, for example to evaluate your habits, personal relationships, preferences, etc. We have no influence on the processing of your data by Facebook. For more information, please refer to the Facebook Privacy Policy.



3. What data does Customer Service process?
   To provide you with the best possible customer service, we work with the Tool Salesforce. Salesforce automatically extracts the data from your order so that our customer service representative can work with you immediately to solve your problem.
   
   The following data is stored as part of the data processing in Salesforce:
   
   
   • Your name, the address you provided
   • Your e-mail address and the IP address of the requesting computer
   • the image files transmitted by you
   
   
   Learn more
   
   The data is stored in Salesforce for 6 months. In case of a complaint, longer a storage time is possible.
   
   We need the storage period of 6 months in case of an order, for possible legal defence, this is required and necessary in the context of warranty law within the consumer-friendly period of § 477 BGB (based on the Directive 1999/44/EC of the European Parliament and Council of 25 May 1999) in order to be able to verify claims made.
   
   A longer storage beyond this period is possible for legally compelling reasons, for example tax or accounting reasons.



4. Newsletter and advertising
   On our website, we offer you the possibility to subscribe to our newsletter, which is independent of an order for photo products. In addition, we also inform our customers about our products within the framework of legal requirements.
   
   Learn more
   
   If you would like to subscribe to our newsletter (which is possible at any time even without ordering), we need and store your e-mail address and your name If you have given us separate consent for us to inform you by e-mail about our own products and services, they will be processed in accordance with Art. 6 para. 1 lit. a) GDPR. Your consent can be revoked at any time (e.g. via the link to unsubscribe from the newsletter, which you will find in every newsletter e-mail), without this affecting the legality of the processing carried out to date. If your consent is revoked, we will stop the corresponding data processing. The data processing is legal until revoked.
   
   If you are our customer, we may send you direct advertising for our own products on the basis of the regulations of Art. 6 Para. 1 letter f GDPR in connection with § 7 Para. 3 UWG. In this case you also have the right to object to the use of your e-mail address for advertising purposes by us at any time. For this purpose, it is sufficient either to click on the unsubscribe link within a newsletter or to send us a short e-mail with your unsubscribe or deregistration request to our data protection team (you will find the e-mail address of our data protection team at the end of this document). You will not incur any costs for unsubscribing (except for any transmission costs according to the basic rates).



5. How is your data protected?
   The protection of your data is of great importance to us. We have taken technical and organisational measures to protect your data as comprehensively as possible from unwanted access.
   
   Learn more
   
   We use an encryption procedure on our pages. Your information is transferred from your computer to our server and vice versa via the Internet using TLS encryption. You can recognise this by the fact that the lock symbol in the status bar of your browser is closed and the address line begins with https://.



6. What data protection rights (rights of data subjects) do I have as a user?
   Respecting your rights is of particular concern to us. As our customer, you have the right to revoke the use of your data at any time for the future. In addition, you have a right to information, the right to correction and deletion of your data, the right to restrict data processing, the right to data transferability, the right to objection, as well as a right to appeal to a data protection supervisory authority.
   
   To exercise these rights of data subjects, you can contact our data protection coordinators at any time. The contact details can be found at the end of this document. You can also contact our data protection coordinator.
   
   Learn more
   
   
   1. Right to information (Art. 15 GDPR):
      You have the right to request confirmation as to whether personal data concerning you is processed; if this is the case, you have a right of access to this personal data and to the information specified in Article 15 of the GDPR.
   
   
   
   2. Right to correction and deletion (Art. 16 and 17 GDPR):
      You have the right to immediately request the correction of incorrect personal data concerning you and if necessary, the completion of incomplete personal data. Users also have the right to request that personal data concerning them be deleted immediately if one of the reasons specified in Art. 17 GDPR applies, e.g. if the data is no longer required for the purposes pursued.
   
   
   
   3. Right to restrict processing (Art. 18 GDPR):
      You have the right to request a restriction on processing, if one of the conditions set out in Article 18 GDPR is met, e.g. if you have lodged an objection to processing, for the duration of any examination.
   
   
   
   4. Right to data transferability (Art. 20 GDPR):
      In certain cases, which are detailed in Article 20 GDPR, you have the right to receive personal data concerning you in a structured, common and machine-readable format or to request the transmission of this data to a third party.
   
   
   
   5. Right of objection (Art. 21 GDPR):
      If the data is collected on the basis of Art. 6 para. 1 lit. f) (data processing to protect legitimate interests), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data, unless there are demonstrably compelling reasons worthy of protection for the processing that outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.
   
   
   
   6. Right of appeal to a supervisory authority (Art. 77 GDPR):
      According to Art. 77 GDPR, you have the right of appeal to a regulatory authority if you believe that the processing of data concerning you violates data protection regulations. The right of appeal may be exercised before a supervisory authority in the member state where you are staying, working or suspected your rights are infringed.



7. Note on cookies
   We use cookies on our websites. Cookies are small text files that can be stored and read out on your end device. A distinction is made between session cookies, which are deleted as soon as you close your browser, and permanent cookies, which are stored beyond the individual session. Cookies can contain data that enable recognition of the device used. However, in some cases cookies only contain information on certain settings that cannot be related to a specific person.
   
   Learn more
   
   We use first party and third-party cookies as session and permanent cookies on our websites. The processing is based on Art. 6 para. 1 lit. f GDPR and in the interest of optimizing or enabling user guidance and adapting the presentation of our website.
   
   The following tools set cookies on our website and collect personal data. In particular the IP address and user ID:
   
   

   • Emarsys (as an e-mail marketing partner, stores the data only for the duration of your visit),
   • Facebook Ads (for the evaluation of social media marketing projects, stores the data for a maximum of 2 years)
   • Twitter Connect (to connect to our social media accounts, stores the data for a maximum of 30 days)
   • Instagram (link to connect to our social media accounts, stores the data until it is manually deleted)
   • Pinterest (link to connect to our social media accounts, stores the data for a maximum of 30 days)
   • Google+ platform (link to connect to our social media accounts, stores the data for a maximum of 2 years)
   • Facebook Connect (to connect to our social media accounts, stores the data for a maximum of 5 years),
   • Google Analytics (stores only an anonymised IP address for web analysis, for a maximum of 2 years),
   • intelliAd (for web analysis, stores the data for a maximum of 100 days)
   • Google Certified (as a tool for customer reviews, stores the data for a maximum of 2 years),
   • Trusted Shops (as a tool for customer reviews), (automatic deletion after 90 days)https://support.trustedshops.com/gb/lp/GDPR
   • eKomi (as a tool for customer reviews)
   • Sovendus (as advertising partner for discounts, anonymizes the data after 7 days and deletes them after 2 years),
   • Rocket Fuel/Sizmek (as advertising partner),
   • Adobe Media Optimizer: Bid management tool (2 years)
   • Usabilla: Customer Feedback Tool (Session)
   • Pinterest: Social Media Marketing 1 year
   • Pingdom: Visitor Insights (session, 30 days)
   • First Party Cookies (for functionality of the website)
   • 1st Party Cookie with hashed e-mail (for Pinterest) 1 year
   • 1st Party Cookie with Emarsys ID (for Emarsys) Session
   • Attentive Mobile (Comprehensive personalized text messaging solution partner. For compliance reasons, generally the information is stored indefinitely until client request deletion). https://www.attentivemobile.com/privacy/
   • Outbrain (Native web advertising partner. Collects personal data of readers interacting with Outbrain widget on publisher sites in order to provide personalized recommendations. No particular end user interaction "i.e. impressions or clicks" associated with a UUID shall be maintained for more than 13 months.) https://www.outbrain.com/legal/privacy#cookies

   
   
   You can set your browser to inform you about the placement of cookies. This makes the use of cookies transparent for you. You can also delete cookies at any time using the appropriate browser setting and prevent the placing of new cookies (opt-out). Please note that our web pages may not be correctly displayed and that some functions may no longer be available for technical reasons.
   
   

   This cookie policy has been created and updated by CookieFirst.com.



8. Contact-person for data protection, data protection officer, changes to the data protection declaration
   In the course of the further development of our websites, apps and clients, the implementation of new technologies, the improvement of our service for you and in order to take into account legal and regulatory changes, updates to this data protection declaration may become necessary. Therefore, the date of the last update of the Privacy Policy is shown at the beginning of this document.
   
   
   If you have any questions about data protection in our company or if you would like to send us a data subject inquiry, you can contact our data protection coordinators at any time. The easiest way to contact them is by e-mail at data-protection-officer@unitedartsgmbh.com.
   
   
   Please note: The e-mail address of our data protection coordinator and our data protection officer is not intended for technical customer service. Please therefore always contact our customer service for service requests.
   
   Learn more
   
   Controller in the sense of Art. 4 No. 7 GDPR for the data protection on this website is:
   United Arts GmbH
   Data protection coordination
   Hohenzollernring 25
   50672 Cologne (Köln) / Germany
   Phone: +44 20 34992781*
   E-mail: data-protection-officer@unitedartsgmbh.com
   
   (*Costs per minute correspond to the tariff of your landline or mobile phone provider for a national call))
   
   In addition to our data protection coordinators, you are also free to contact our data protection officer directly with your data protection queries:
   data protection süd GmbH
   Wörthstraße 15
   97082 Würzburg
   E-Mail: office@datenschutz-sued.de