GDPR — Your Rights

Last updated: 2026-04-20

If you are a resident of the European Economic Area (EEA), the United Kingdom, or Switzerland — or a resident of a country with equivalent legislation — the General Data Protection Regulation (GDPR) gives you the rights summarised below. This page explains how Fotiqo honours them.

Data Controller

Fotiqo acts as the data controller for account data (staff + photographers) and as a data processor for end-guest data that Venues upload to the platform. Contact details for the controller:

• Email: dpo@fotiqo.com
• Postal address: [to be added pending counsel review — registered office + street address]
• Data Protection Officer: to be formally appointed; interim contact via dpo@fotiqo.com

Your rights (Art. 15 – 22)

Request format

For any request above, please include:

• The specific right you are invoking (e.g. “Art. 17”).
• The email address and / or phone number tied to your Fotiqo account (so we can locate your data).
• A brief description of the scope — everything, a specific gallery, a specific date range, etc.

To protect you against impersonation, we may ask for proof of identity before acting on a request (Art. 12(6)).

Legal bases for processing

• Contract (Art. 6(1)(b)) — delivering the galleries, orders, and kiosk experience you've paid for.
• Consent (Art. 6(1)(a) / Art. 9(2)(a)) — analytics cookies, marketing messages, optional face-ID matching (special-category biometric data).
• Legal obligation (Art. 6(1)(c)) — tax records, anti-money-laundering, lawful requests from regulators.
• Legitimate interests (Art. 6(1)(f)) — preventing fraud, securing the platform, and sending transactional messages that you reasonably expect to receive (receipts, gallery links).

International data transfers

Where personal data moves outside the EEA, Fotiqo relies on the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2 or 3 depending on the counterparty), supplemented where needed by Supplementary Measures (encryption in transit and at rest, pseudonymisation, access-logged audit trails).

Retention

• Galleries & photos: 90 days after last access (customers) or until the Venue's contract ends (tenants). Extended only where the Venue enables Digital Pass or archival features.
• Customer contact (email, WhatsApp, room number): retained for the duration of the Venue relationship plus up to 24 months for transactional follow-up and “sweep-up” offers. Deleted on request.
• Face vectors: ephemeral for one-time matching (deleted within seconds of the match). For Digital Pass holders, retained for the duration of the pass and deleted within 24 hours of pass expiry. See the Privacy Policy for detail.
• Financial & tax records: 6 – 10 years, as required by the tax regime of the controller's jurisdiction.
• Audit logs: 24 months (tamper-evident hash chain).

Subprocessors

We engage the subprocessors below to operate the service. Each has signed a written contract meeting GDPR Art. 28(3) requirements, and each appears in our Data Processing Agreement. We notify tenants 30 days before adding or replacing a subprocessor.

Lodging a complaint — Italian Garante

If you believe we have mishandled your personal data, you have the right to lodge a complaint with your local supervisory authority. Fotiqo is accountable to the Italian supervisory authority:

Residents of other EEA countries may instead file with their own national supervisory authority (a directory is maintained by the European Data Protection Board).

Contact

Any question about this page or about how Fotiqo processes your data — including a data subject request under any of the articles above — can be addressed to dpo@fotiqo.com. See also our Privacy Policy, Cookie Policy, and Data Processing Agreement.