Privacy policy
Find out which personal data PhotoConsent processes, why we process it and what rights you have.
Purposes of processing personal data
PhotoConsent always strives to safeguard and protect your information. Below you can read about how your personal data is processed, the purposes of processing and your rights when your personal data is processed.
Personal data is information that can identify a natural person. Processing personal data includes, among other things, storing, accessing and transferring information for a specified purpose.
PhotoConsent helps photographers and others who process photographs (referred to below as “PhotoConsent’s customers”) collect consent for the processing of a subject’s personal data, including photographs of them (photographed people are referred to below as “photographic subjects”). PhotoConsent thus provides a service intended to make it easier for photographers to comply with data protection legislation. PhotoConsent also offers storage of collected consent forms.
Collected consent forms may contain the photograph to which the consent relates, or a photo used to identify the person giving consent (the photographic subject).
For photographic subjects, PhotoConsent only receives and processes the personal data contained in the consent form signed by the subject at the request of PhotoConsent’s customers. Customers may attach images of the data subject to collected consent forms. PhotoConsent cannot access or handle individual consent forms.
PhotoConsent also cannot view any images attached to consent forms stored on behalf of its customers. The processing of photographic subjects’ personal data, including photos, by PhotoConsent’s customers is agreed between the photographer and the subject, and PhotoConsent is therefore not responsible for it.
Questions and requests about photographs in which you appear must be directed to the relevant photographer, not PhotoConsent.
For PhotoConsent’s customers, only information necessary to provide PhotoConsent’s service is collected and processed.
PhotoConsent has entered into data processing agreements with the companies it uses to ensure that they also comply with the rules and principles for protecting personal data.
In exceptional cases, other legislation may require PhotoConsent to disclose information to authorities, insurance companies, banks or others with a legitimate right to access it.
Security
PhotoConsent has taken the necessary technical and administrative measures to prevent information from being accidentally or unlawfully deleted, disclosed, lost, impaired, accessed by unauthorised parties, misused or otherwise processed in violation of the law.
Categories of personal data
Information about customers and people giving consent
PhotoConsent collects contact details comprising the name, address, telephone number and email address of the individual or business wishing to use its service. Only contact details provided by PhotoConsent’s customers themselves are collected.
In some cases, PhotoConsent’s customers include photographs of data subjects in consent forms.
PhotoConsent processes customers’ payment information to provide its service.
Technical information on the website
PhotoConsent’s website processes technical information about customers’ and visitors’ devices. This includes, but is not limited to, a unique ID and technical information about your computer, tablet or mobile phone, your IP address, geographical location and the pages you click on.
PhotoConsent only stores and processes information necessary to provide its service and comply with documentation requirements imposed by authorities or others.
Recipients of personal data
To store consent forms securely and reliably for its customers, PhotoConsent uses servers provided by Scannet A/S, based in Denmark. It is therefore accepted that consent forms containing photographic subjects’ and customers’ personal data are transferred to and stored by Scannet A/S. Scannet A/S only hosts the consent forms and cannot access individual personal data within them.
Customers’ contact details and other personal data are not disclosed outside PhotoConsent unless separately agreed with the business or individual who provided the information, or where necessary due to legitimate requirements of others, such as the authorities referred to above.
Google Analytics is used for website visitor statistics after analytics is accepted. This is separate from storage of customers’ consent forms. See Cookies and Google Analytics on the website.
Read more about data processing agreements, sub-processors and audits on the compliance page.
Retention of information
Personal data belonging to PhotoConsent’s customers is retained for as long as the customer uses the service. If the customer no longer wishes to use the service or breaches their obligations under the agreement, PhotoConsent retains their information for at least six months unless the customer exercises their right to request deletion. An inactive customer’s information is deleted no later than one year after they become inactive.
Personal data belonging to photographic subjects contained in consent forms stored by PhotoConsent is retained for as long as the customer is active and the subject’s consent remains valid.
Access to your information
If you know or believe that PhotoConsent processes personal data about you, you have a number of rights in relation to that processing. These rights are listed below.
As a photographic subject, please note that PhotoConsent cannot access the information in consent forms stored for its customers. You therefore cannot obtain access, object, or request rectification or deletion of that information by contacting PhotoConsent. Instead, contact the photographer or other party to whom you gave consent.
To exercise your rights, please email gdpr@photoconsent.dk.
When you contact us, PhotoConsent will first verify that you are the person to whom the information or images relate before you can exercise your rights.
Requests will be handled within a reasonable time and no later than four weeks after receipt. If processing your request will take longer, you will be informed.
Right of access
You have the right to request access to the personal data PhotoConsent stores and processes about you.
Please note that PhotoConsent cannot access individual consent forms or images within them. Nor can PhotoConsent access the images to which consents relate. Although PhotoConsent will accommodate access requests as far as technically possible, access to individual consent forms or any photos within them cannot be provided.
Right to object
You have the right to object if you disagree with PhotoConsent’s processing of personal data. This may be because you believe the processing is inconsistent with the purposes described in this privacy policy or in a consent given.
PhotoConsent will assess whether your objection is justified in each individual case.
Right to rectification
You have the right to have inaccurate information corrected. This applies to factually incorrect information and incomplete information where relevant to the processing.
Right to request erasure
You have the right to request deletion of your information. This applies where the information is no longer necessary for the purposes, where you withdraw consent, including when you stop using PhotoConsent’s service, or where the processing is unlawful.
PhotoConsent does not delete customer information immediately; see “Retention of information” above, for example for inactive customers. If you want immediate deletion, contact PhotoConsent and request it.
This right is not absolute, as some data cannot be deleted due to other legislation or where the purpose entitles PhotoConsent to retain personal data and images. If processing was based on a legitimate interest rather than consent, an assessment will first be made of whether that interest outweighs your request for deletion.
Right to data portability
You have the right to receive your information in a machine-readable format. Only information PhotoConsent can access can be provided. PhotoConsent cannot provide information within consent forms or any images within them.
Right to withdraw consent
You may withdraw consent to the processing of your data at any time.
PhotoConsent’s customers must contact PhotoConsent and formally withdraw their consent. Withdrawing consent to data processing entails terminating PhotoConsent’s service.
Photographic subjects must contact the photographer with whom the consent form was agreed. If a photographic subject believes that no valid consent has been given for PhotoConsent to process their information, they must contact PhotoConsent and demonstrate that the processing is unlawful.
PhotoConsent is only entitled to retain information needed as documentation for authorities, insurance companies, banks or others with a legitimate right to access it.
The statements above about the customer relationship are reproduced from the original policy. Withdrawing consent to Google Analytics on the website does not terminate the service. See the website cookies section.
Have a request?
Write to us and explain which information or processing your request concerns.
Right to complain
You are always welcome to contact PhotoConsent with questions or complaints about the processing of your personal data. You also have the right to complain to the Danish Data Protection Agency, which supervises compliance with data protection legislation. You can send a complaint to dt@datatilsynet.dk. Read more at the Danish Data Protection Agency.
Contact
PhotoConsent ApS
Minkemarkvej 12
4300 Holbæk
Danish company registration no.: 29414122
info@photoconsent.dk
+45 5168 5500
Personal data requests: gdpr@photoconsent.dk.