Privacy statement

Concept — parts in yellow still need to be completed or confirmed by Photonic.

Photonic makes photos with a logo, at events and with our app. In doing so we process personal data: of people who contact us, of visitors of this website and of guests who are photographed at an event. Below you read what we process, why, for how long, and what your rights are.

Photonic B.V.
Rapenburg 1, 1011 TT Amsterdam, the Netherlands
info@photonic.nl · +31 20 330 4384
Chamber of Commerce 34135991 · VAT NL817725957B01

1. When you request a quote or contact us

Through the form on this site, by email or by phone we receive your name, email address, phone number, company name and what you tell us about your event (date, times, location, number of guests, wishes).

We use this data to answer your question, to make a quote and, if you become a client, to carry out the assignment and to invoice. Legal basis: the performance of a contract, or the steps towards it at your request. We do not send you newsletters or other unsolicited commercial messages.

After you send the form, you automatically receive a confirmation by email.

Retention: requests that do not lead to an assignment we keep for [CONFIRM: 12 months] and delete after that. Data of clients we keep as long as the relationship lasts, and after that as long as the law requires (invoices: 7 years, tax retention obligation).

2. When you visit this website

Our website places no cookies and uses no advertising or analytics services of third parties. Fonts and images load from our own server.

We count visits to this website anonymously, with software on our own server. We use no cookies for this and we do not keep IP addresses.

Our web server records, like every web server, visit data in log files: IP address, time, requested page and browser type. We use this only to keep the site safe and working (for example to recognise abuse of the contact form). Legal basis: our legitimate interest in a safe website. We anonymise IP addresses after 30 days. [CONFIRM for the Caddy logs of the site itself; for the app server this is in place.]

3. When you are photographed at an event

At events we, or our client with our app, take photos of guests. Those photos are printed on a photo printer next to the photographer and/or shared digitally: the guest receives the photo with a QR code or by email.

Who is responsible depends on who organises the event:

• At an event organised by a client (brand, agency or venue), that client is the controller for the photos. Photonic then works as a processor on their instruction, and records the agreements in a data processing agreement. Questions about your photo at such an event go to the organiser; we help them with that.
• At events that Photonic carries out itself, we are the controller. Legal basis: the performance of the contract with the client and our legitimate interest in delivering the service; for sending your photo to your email address the basis is your own request.

Photos are taken at the event and stored on our own server in the Netherlands; no cloud service of a third party is involved. From photos that are accessible with a link we remove the hidden camera data (EXIF). We keep photos for 90 days after the event, unless a different period is agreed with the organiser, and then delete them permanently with a daily clean-up. Email addresses that guests enter to receive a photo we use only to send that photo; we keep them, with the sending log, for 90 days. Recorded consents we keep for 1 year after the event, so the organiser can show they were given.

If the organiser wants to share a photo on their social media, the app first asks your consent, per photo, with the name of the party you give it to. [PARKED: the exact way consent and withdrawal work in the app is still in design; adjust this paragraph when that is final.]

If you do not want to be photographed, tell the photographer or the host at the event. If you want a photo removed later, send us an email; see point 6.

4. With whom we share data

We do not sell data and share it only with parties needed to deliver our service:

• TransIP (the Netherlands) for the server that holds the website, the photos and the backups.
• Resend for sending confirmations and photo emails. Resend processes our email in a data centre in Ireland (EU); the company itself is based in the United States. [LAWYER: state whether this is a transfer outside the EU, and if so on which basis (EU-US Data Privacy Framework / standard contractual clauses).]
• Apple, for the distribution of our app through the App Store. Apple receives no photos or guest data from us.
• [ONLY IF PAYMENTS ARE LIVE: Mollie, for online payments; Mollie then receives your payment data as an independent controller.]
• Our accountant and, where the law requires it, the Dutch tax authority, for invoice data.

With processors we sign a data processing agreement. [PATRICK: check that these are signed with TransIP and Resend.] We do not pass data to other parties, unless the law obliges us to.

5. Security

We take appropriate technical and organisational measures to protect data against loss and unlawful use: encrypted connections (HTTPS), access to systems only for those who need it for their work, up-to-date software and keeping as little data as possible. If something still goes wrong with your data, we inform you and report it where required to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

6. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict processing, to receive your data in a portable form, and to object to processing based on legitimate interest. If you gave consent, you can withdraw it at any time; that does not change what happened lawfully before.

Send an email to info@photonic.nl. We respond within one month. To make sure we deal with the right person, we may ask for a confirmation; we never ask for a copy of your identity document if there is another way.

If you are not satisfied with how we handle your data, we prefer to hear it from you first. You can also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

7. Changes

We update this statement when our way of working or the law changes. The current version is always at [DOMAIN: photonic.nl/privacy — depends on open question 1] /en/privacy/, with the date of the last change.

Last changed: [date of publication]