PRIVACY POLICY

Our Privacy policy can be found in our Privacy policy statement

Last revised on 2023/12/18

Introduction

This privacy policy has been created to inform you, as a visitor to our website or user of our services, about how we use your personal data and the legal basis on which we do so. Personal data is information relating to an identified or identifiable individual (hereinafter referred to as "personal data" or "personal information").

Please read this Privacy Policy carefully as it sets out your rights and obligations with respect to smartphoto. Please note that this Privacy Policy may be revised from time to time. The date of the last revision is indicated at the top of the document.

Responsible for the processing of your personal data is smartphoto group NV (hereinafter referred to as "smartphoto" or “we”), the parent company of smartphoto AG, having its registered office at Kwatrechtsteenweg 160, 9230 Wetteren, Belgium, and registered with the K.B.O. (Central Database for Enterprises) under number 0405.706.755.

1. Summary Privacy Policy
2. General Privacy Policy
3. For information about the collection and processing of personal data when using our websites, particularly in connection with cookies and similar technologies, please also see our Cookie Policy.

SUMMARY PRIVACY POLICY

What Personal Data do we collect from you?

1. Data related to your use of the website without registration, such as the IP address and your preferences, the choice of language, choice of region or country, choice of items in the shopping cart.
2. Data related to your smartphoto account: email address, password, first and last name, preferences, other data provided by you, orders made, personal events in the calendar functionality.
3. Data related to the order and delivery of products: first and last name, email address, address, payment and billing data.
4. Data related to the newsletter: email address: first and last name, email address and content of your communication.
5. Data related to the use of images and texts.
6. Information related to your preferences regarding the use of cookies and similar technologies.

For what purpose do we collect and process your Personal Data?

We collect your Personal Data primarily to provide the services of smartphoto (hereinafter "smartphoto services"), as well as to provide you with the best possible experience on the smartphoto website and application.
We also collect and process your Personal Data to keep you informed of news, offers and promotions from smartphoto.

What legal basis do we use to process your Personal Data?

We process your Personal Data based on the following legal bases:

• Execution of the agreement;
• Your (explicit) consent;
• The legitimate interest of smartphoto.

Who has access to your Personal Data?

Your Personal Data will never be made available to other parties. Only a limited number of employees within smartphoto that need access to your data for delivering our services, will actually have access to your data.

How long do we store your Personal Data?

We do not retain your Personal Data any longer than is necessary to fulfil the purpose for which it was collected. If you do not want your data to be kept during these retention periods, you can apply your right to erasure.

What are your rights?

For any processing of your Personal Data, you can exercise the following rights by sending an email to dpo.ch@smartphoto.com.

• Right of access: you have the right to request a copy of your Personal Data that the company stores and processes;
• Right of rectification (adjustment): you have the right to have your data adjusted if it turns out to be incorrect;
• Right of objection to processing: you can ask us at any time to, for example, stop direct marketing communication;
• Right of withdrawal of your consent: you have the right to stop a previously granted permission for processing;
• Right to submit a complaint with the Data Protection Authority (GBA): you have the right to file a complaint if you suspect that your Personal Data is not being handled correctly by smartphoto.

You can also exercise the following rights with limited commitment, depending on the legal basis of processing and legal retention periods:

• Right to erasure: you may ask the company to erase your Personal Data;
• Right of restriction of processing: you may ask to limit the processing of your Personal Data;
• Right of data transfer: you have the right to request your personal data in a structured and machine-readable format, or in another standard format so that it is readable by another controller.

GENERAL PRIVACY STATEMENT

Table of contents

Article 1 – GENERAL

The collection and processing of Personal Data is subject to strict conditions. Smartphoto acts in accordance with:

• The new Swiss Federal Act on Data Protection (Data Protection Act, FADP; RO 2022 491) of 1 September 2023;
• The European Regulation 2016/679 of 27 April 2016 concerning the protection of Personal Data;
• and/or all (future) Belgian laws implementing this Regulation.

This privacy policy applies to the use of your personal information in connection with our smartphoto services, i.e. services related to visiting the smartphoto website, managing your personal images and ordering smartphoto products. You are not required to provide us with any personal information. However, we may not be able to provide you with the requested services if you choose not to provide us with such personal information.

Article 2 – PERSONAL DATA COLLECTED

2.1 Personal Data you provide to us

Article 3 – PURPOSES OF PROCESSING

Smartphoto primarily collects and processes your data to be able to offer you the smartphoto website and the associated services.
Furthermore, we only use your Personal Data for the following purposes:

3.1 General purposes

3.2 Direct marketing

If smartphoto obtains your personal data in connection with the sale of smartphoto products or the provision of smartphoto services, we may use your contact details to send you promotional material about similar products and/or services. This is done on the basis of our legitimate interest.

If we have not obtained your personal data in connection with the sale of smartphoto products or the provision of smartphoto services, we may use your contact details for promotional purposes only if you have given your prior consent.

Smartphoto may share your personal information with its processors for the purpose of direct marketing of smartphoto and its products and/or services. However, we will only send you other promotional material if you have given your prior consent.

You may at any time object to receiving promotional material without giving reasons. You may do so by clicking on the "unsubscribe" button at the bottom of any promotional email or by sending an email to contact.en@smartphoto.ch.

3.3 Transfer to third parties

Smartphoto will never pass on your personal data to third parties without your consent, with the exception of:

• companies that are directly or indirectly connected with smartphoto for the performance of the requested services (such as delivery of the ordered goods);
• third parties in the context of managing your file. Your data may be passed on to and processed by software and cloud providers, financial partners, suppliers or any other third party that plays a role in your file. The current list can be obtained on simple request by email.
• companies with whom smartphoto has entered into a partnership such as a voucher partner network or a review platform.

The data passed on to third parties are adequately secured by appropriate measures such as encryption and pseudonymisation, so that your privacy is safeguarded at all times, and by concluding processing agreements where necessary.
Smartphoto will make reasonable efforts to inform you in advance of the fact that smartphoto discloses your personal data to the above-mentioned parties, but you also acknowledge that this is not technically or commercially feasible in all circumstances.

• As such, we would like to inform you that we import your contact details into Facebook and or Instagram in order to send you our ads from our Facebook and or Instagram page. If you no longer want this, you can opt out.
• Smartphoto's use and transfer of information through Facebook Graph APIs (Application Programming Interfaces) and/or Instagram Graph APIs comply with the terms of use of Facebook/Instagram.
• Smartphoto's use and transfer of information received from Google APIs to other apps will comply with the Google API Services User Data Policy, including the Limited Use requirements.

3.4 Legal requirements

Smartphoto may have to disclose your Personal Data as a result of a court order or to comply with other mandatory laws or regulations. Smartphoto will make reasonable efforts to inform you accordingly in advance, unless this is subject to legal restrictions.

Article 4 - DURATION OF THE PROCESSING

The Personal Data is stored and processed by us for the period for which we are legally obliged to do so or for as long as this is necessary to fulfil the purposes of the processing, or for the contractual relationship between you and smartphoto.

You have the option at any time to stop using the smartphoto services and/or delete your account on the smartphoto website. If you delete your account, you will be given the choice to save or delete some data. If you wish to delete your data, this means that you exercise your right to erasure. If you do not exercise your right to erasure, your Personal Data will be retained for the following periods:

Article 5 – YOUR RIGHTS

5.1 Right of access and inspection

You have the right to access your Personal Data at any time, as well as to be informed about the use we make of your Personal Data.

5.2 Right of rectification, deletion and restriction

It is up to you to decide whether or not to provide us with certain personal information. You may also change the information in your user account on the smartphoto website at any time. You are also free to ask us to amend your personal data at any time.

You may also request that the processing of your data be restricted if you believe that your personal data is incorrect. You also have the right to ask smartphoto to delete your data if it cannot be made anonymous.

Please note, however, that if you do not provide certain personal information or request that it be deleted, we may not be able to provide you with our services or provide them in the best possible manner.

5.3 Right to object

You also have a right to object to the processing of your Personal Data for serious and legitimate reasons. Although smartphoto will not use your Personal Data for direct marketing purposes without your prior consent, you also have the right to object to the use of your Personal Data for direct marketing purposes. In this case, no specific justification will be requested.

5.4 Right of free data portability

You have the right to obtain your Personal Data processed by us in a structured, standard and machine-readable format and/or to transfer it to other data controllers.

5.5 Right of withdrawal of consent

You have the right to withdraw your prior consent to the processing of your Personal Data, even if the processing of your Personal Data was based on your consent.

5.6 Automated decisions and profiling

You have the right to ask us not to be the subject of a decision based solely on automated processing, including profiling, which produces legal effects concerning you, or significantly affects you. This does not include data processing to debt collection agencies, which receive personal data during an order placement for the purpose of a credit check.

5.7 Exercising your rights

You can exercise your rights by contacting us, with appropriate identification provided, by email to dpo.ch@smartphoto.com or by post to smartphoto AG, Salinenstrasse 59, 4133 Pratteln, Switzerland.

5.8 Right to submit a complaint

You have the right to submit a complaint with a competent supervisory authority if you have concerns about whether the processing of your personal data complies with the law.

• The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).
• The competent supervisory authority in the Principality of Liechtenstein is the Data Protection Authority of the Principality of Liechtenstein.
• If you come from an EU Member State, you can also submit a complaint to your national data protection authority. You can find a list of national supervisory authorities within the EU on the following web page of the European Data Protection Board.

This does not exclude the possibility of a claim in a civil court. If you would suffer damage as a result of the processing of your Personal Data, you can make a claim for compensation.

Article 6 – SECURITY AND CONFIDENTIALITY

We have developed technical, administrative and organisational security measures to prevent the destruction, loss, falsification, modification, unauthorised access or accidental disclosure to third parties of your Personal Data, as well as any unauthorised processing of this data. However, in the event that this should occur and it concerns your Personal Data, smartphoto will inform you about the breach, including a description of the potential impact and a recommendation to limit the possible negative consequences of the breach.

Smartphoto also provides a secure, user-controlled environment for using the smartphoto website and our smartphoto services. We securely store your Personal Data on our servers located within the European Economic Area. Under no circumstances can smartphoto be held liable for any direct or indirect damage resulting from incorrect or unlawful use by a third party of the Personal Data.

In addition, you bear the responsibility for maintaining privacy and security when you use the smartphoto website or our smartphoto services. For example: by preventing all unauthorised access to the smartphoto services on your behalf. You are solely responsible for the use of the smartphoto website or our smartphoto services on your devices, your IP address and identification data, as well as for their confidentiality.

Article 7 – COOKIES AND SIMILAR TECHNOLOGIES

For information about the collection and processing of personal data when using our websites, particularly in connection with cookies and similar technologies, please also see our Cookie Policy.

Article 8 – APPLICABLE LAW AND COMPETENT COURT

This General Data Protection Policy shall be governed, interpreted and implemented in accordance with Swiss law, which shall apply exclusively. Any disputes that may arise from the interpretation or application of this Privacy Policy shall be subject to the exclusive jurisdiction of the courts competent for the company responsible for data processing. In the event of a conflict between the German and English versions of the Privacy Policy, the German version shall prevail.