Privacy Policy

1. Introduction

1.1 This is the privacy policy of Storio group B.V. including the subsidiary brands operating under the names albelli, Photobox, posterXXL, Hofmann, fotoknudsen, and önskefoto (hereinafter referred to as “the Company”, “we”, “us”, and “our”). 

1.2 Storio group B.V. is a limited liability company registered under the laws of the Netherlands with its statutory seat in Amsterdam, the Netherlands and its office located 

at Stationsplein 57, 1012 AB Amsterdam.

1.3 In this privacy policy, we inform visitors to our websites and customers of our services and products (referred to collectively as 'you', 'your', and 'yours') about how we collect, handle, and protect your personal data.

1.4 This privacy policy excludes the handling of personal data concerning job applicants, employees, and contractors of the Company. Specific policies are in place for these individuals. If you are identified as belonging to any of these categories during interactions with us, we will provide you with the applicable privacy policy.

1.5 We will explain who we are, how and for what purposes we process your personal data and how you can exercise your privacy rights and give any other information that might be relevant to you.

1.6 We've done our best to provide straightforward information in this privacy policy.

If you still have questions about how we handle your personal data, just contact us using the details in paragraph 9.

1.7 This privacy policy is subject to periodic revisions, and we recommend regular consultation. By creating an account, using our services, or making a purchase, you acknowledge that you have read and agree to this privacy policy. The latest version will always be available on our website. Last updated: April 2024.

2. Who is the data controller?

2.1 Unless otherwise stated in this privacy policy or in any other specific privacy policy made available to you, the controller of your personal data is Storio group B.V. and its subsidiary company(ies) specified in the terms and conditions on the website or mentioned in the mobile app where you created your account and/or your photo product and/or placed an order. 

2.2 The subsidiary brands that comprise the Storio group include: 

2.3 All of these subsidiary brands represent a group of undertakings that form the Storio group. Personal data may be shared between these different brands. The necessary contractual arrangements and transfer mechanisms have been implemented to allow for the sharing of personal data between these brands. 

3. How and why do we process your personal data?

3.1 Creating a photo product

If you wish to create a photo product, save, and temporarily store your projects, we encourage you to create an account.To create an account, it is necessary to provide us your first and last name, email address and a password. In addition, you can voluntarily add other personal data to your account, such as, gender, date of birth or address. If you create personalised photo products with our photo editor (either on our website or by downloading our photo editor on your device) or mobile app, we process the photos that you upload via our website. 

The processing of these personal data is based on a contract - more specifically to take steps prior to entering in a contract with you - as well as a legitimate interest. After all, adding additional personal information to your account will save you time when you actually place an order, and it is also in your best interest to be able to store your projects in your own account, so that you can work on them at your own pace before ordering them. 

When you create photo products, we use your photos to provide personalised product suggestions. Please be assured, only you will receive these tailored recommendations based on your own photos.

3.2 Online version photo book, inspiration gallery 

If you wish, you can request an online version of a photo book that you have ordered. You can submit your request to us in your account. An online version of a photo book can be shared by email and through social media or embedded in a blog or website by making use of a public link that we create for you. The photo book is not indexed by search engines, such as Google, but it is available on the internet for anyone who has the link. We will process your photo book and its entire content on the basis of your consent. 

Online versions of photo books can be added to the inspiration gallery on our websites. If you add your photo book to the gallery, the photo book will be featured on our websites in the gallery as inspiration for others. We will display your first name with the photo book. We may also add tags (keywords) so that we can show photo books to (potential) customers that may be relevant to them. Please note that Photo books in the inspiration gallery will be indexed by search engines, such as Google. We may also add pages of photo books in the gallery to our commercial messages, such as newsletters and in social media ads. We ask for your consent when placing your photo book in our gallery. 

When there are other persons displayed in the online version of your photo book, we base the processing of their personal data on a legitimate interest (we refer you to paragraph 4 of this privacy policy in this regard). Please note that in case such a person objects to the display of his or her image in the online version of your photo book, we are entitled to remove the photo book from our inspiration gallery or disable the public link, immediately and without notifying you in advance.

3.3 Photo storage and organiser 

We provide a service to help you organise and store your photos. You can upload your photos through our website or mobile app to create products and access your photos. You can cancel the service anytime.The processing of your photos in this regard is based on a contract, or based on a legitimate interest in case there are other persons displayed on the photos that are stored (we refer you to paragraph 4 of this privacy policy in this regard). 

3.4 Social media and online storage services 

When using our services to create photo products, you have the option to grant us access to your accounts on select third-party social media platforms such as Facebook, Instagram, and Google Photos, or to allow access to photos stored on your device. If you choose to connect your Google Photos account, data transfer occurs through Google APIs. Our use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policies, including the Limited Use requirements. By providing access, you acknowledge that we will use your photos to enable you to create photo products through our services in accordance with this privacy policy.

3.5 Mobile app

We provide a mobile app for iOS and Android devices, which can be found in the Apple App Store and Google Play Store. The application can be used to create our photo products on your phone, tablet or laptop. To see in which country you are located, and therefore would most likely want to order our photo products, we will either use your country settings (when using an iOS device) or your IP address or country settings (when using an Android device). 

To login to the application, you will need to enter your account details. Apart from these details, we will also process the photos you upload to the application and use to create your photo products. The processing of these personal data is based on a contract as well as a legitimate interest. More information in this regard can be found under the paragraph “creating a photo product”. 

Once you would like to purchase a product, it may be necessary to provide us with more personal data in order to process your payment and ship the product to the desired address. In this case you will be directed to our website. More information in this regard can be found under the paragraph ‘’Pay, order and deliver your photo product’. 

If you would like to delete your account, please use the ‘delete my account’ button on our website or in the account section of the app. If you also wish to delete locally stored data in our app, such as photo thumbnails and account data, please do so by deleting the app from your iOS or Android device.

3.6 Order, pay and deliver your photo product

We process your personal data to generate, print and deliver your photo product. This includes the photos you have uploaded, your order details, your contact details and billing- and delivery address. We base the processing of these personal data on the performance of the contract we have with you. 

Payments are processed by a payment service provider under contract with us. The payment service provider responsible for the payment uses your payment details and may only use your personal data for processing the order and not for other purposes. 

In case you want to send your photo product to another person or third party and provide us with their contact and address details, we will base this processing on a legitimate interest. More information in this regard can be found under paragraph 4.

3.7 Contacting our customer service

We may also process your personal data for the purpose of providing customer service, i.e. to deal with any questions or complaints you might have. This includes keeping and recording all relevant information related to your question or complaint, whether submitted by phone, chat or email. This may include your name, contact details, order number and financial information. If your contact request relates to an order you have previously placed with us, this processing is based on the performance of the contract we have with you. In other cases, we base the processing of your personal data on a legitimate interest, which includes our and your interest in handling your question or other request as well and as quickly as possible. 

We may record the phone calls you have with our customer service department for training purposes. This includes all information exchanged during the call and at least your name and contact information. We do this based on our legitimate interest in ensuring that our service standards remain high.

3.8 Customer relations and marketing

To ensure that our products and services meet the needs of our customers, we perform analytics on the use of our website and the sale of our goods and services. To do this, we may process data about your order history, contact with customer service, your name, your contact information and information collected from our website. We also carry out automated analysis of any feedback you choose to provide to us for the purposes of product improvement.

We may also send you marketing messages through various communication channels, such as email or text messaging, from which you may opt out at any time. Furthermore, we use segment-based marketing and social media marketing, such as Facebook and Instagram. We perform these activities based on a legitimate interest, which includes ensuring that our products and services meet the needs of our customers, and consent, when that may be necessary. 

We would like to continue to inform you about discounts, special promotions and news. We do this in the form of a newsletter. You will receive this newsletter if you have  registered for it, or if you have placed an order with us. If you no longer wish to receive the newsletter, you can unsubscribe by clicking 'unsubscribe' at the bottom of the newsletter. 

In exceptional circumstances, we may need to contact you about important matters concerning our services. This could be through various means such as phone, email, or text message, using the contact details you've provided to us. Please note that these messages are strictly for service updates and are not marketing communications, therefore opting out is not possible.

3.9 Personalised Advertising & Interest-based Advertising

We engage with advertising entities, third-party advertising enterprises (such as Google) and social media organisations, with the purpose of presenting advertisements across the internet.
These entities may use your data and cookies and similar technological tools, to collect data pertaining to your interactions throughout time across our services, communications, and other online platforms. This data is then utilised to present online advertisements that are tailored to your potential interests, this includes personalised ads. You can read more on Google’s Privacy Policies and how they protect your data (here).

3.10 Smart technology

To ensure that our products and website(s) meet the expectations of our customers, we use different kinds of algorithms for the automatic creation of products, by analysing photos uploaded to our systems for this purpose. By automatically creating products for customers, we can reduce the time required to create products from months to minutes. We also use techniques to analyse project titles as entered by our clients to better understand their needs. The processing of personal data for these purposes is based on a contract - more specifically to take steps prior to entering in a contract with you - as well as a legitimate interest. 

3.11 Cookies

We collect information through the use of cookies. Cookies are small files of information that store and can retrieve information about your visit to this website, such as how you entered our site, how you navigated through the site and what information you found interesting. You can find more information about our use of cookies in our Cookie Policy. 

3.12 Compliance with legal requirements 

We may process personal data, such as your name, contact details and financial information, to comply with laws and regulations. This may be the case, for example, when we have to comply with obligations related to taxes or business operations. To comply with relevant laws and regulations, we may under specific circumstances also need to disclose your personal data to governmental or supervisory authorities.

4. Personal data of other individuals you provide to us

4.1 When you make use of our services, you may provide us with the personal data of other individuals than yourself. This situation occurs when you upload or order photos in which others than yourself are visible. These photos may be considered personal data. Another example concerns the situation where you enter the contact and address details of other individuals during the order process, because you want to have a photo product delivered directly to someone else. 

4.2 When you provide us with the personal data of other individuals, we base the processing of their personal data on a legitimate interest. These interests include, amongst others, your interest to be able to quickly and conveniently create a photo product on which not only yourself, but also your friends, family, acquaintances and others are visible, and our business interest in providing these services to our customers. We hereby have taken into account that in most cases it will be practically impossible, or at least very difficult, for us to identify the specific individuals in the photos and we do not process your photos for that purpose either. 

However, we strongly advise against sharing personal data of individuals who may not consent. Please ensure they are informed, familiarise themselves with our privacy policy, and grant consent before sharing their photos and other personal information with us.

5. To whom will your personal data be disclosed

5.1 Our employees have the authority to access personal data only to the extent necessary for the relevant purpose and to do their jobs. They are all required to keep the data confidential.

5.2 We will not disclose any of your personal data to third parties, other than to our subsidiaries and/or affiliated companies and data processors (including deliverers and payment service providers) under contract with us, such as:

• Payment service providers;

• Manufacturers, wholesalers and retailers;

• Delivery and courier services;

• Advertising and marketing services companies, including Google, for Google Ads personalisation; and

• Cloud storage and software providers.

5.3 Without your consent we will not share your personal data with any other third parties, unless:

• we are legally obliged or entitled to do so (for example, pursuant to a court order or for the purposes of prevention or detection of crime or fraud);

• we are in negotiations with a third party for the sale or purchase of any of our business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;

• the Company and its subsidiaries, or substantially all of its assets, is acquired by a third party, in which case personal data held by the Company and its subsidiaries about its customers will be one of the transferred assets; or

• we wish to enforce or protect our rights, property and safety, or the rights, property and safety of our customers, or others.

5.4 Some of the aforementioned parties are located in countries outside the European Economic Area. Where appropriate, we will ensure that appropriate safeguards are in place, such as the conclusion of EU Standard Contractual Clauses.

6. How your personal data are secured

Since the protection of your personal data is important to us, we have taken appropriate technical, physical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access and all other forms of unlawful processing (including, but not limited to, unnecessary collection) or further.

7. How long will your personal data be retained?

7.1 We will retain your personal data for as long as necessary to fulfill the purposes outlined in this privacy policy, which may include legal, accounting, or reporting obligations. Please refer to our Terms and Conditions for further details on photo storage and other retention periods. Please note that we may be required by law to retain your data for specific periods

7.2 To decide how long to keep your personal data, we consider statutory retention periods, our legal position, the reasons for collecting and processing your data, and the nature and sensitivity of the data involved.

8. How can you exercise your privacy rights?

8.1 Under the EU General Data Protection Regulation (GDPR) you have a number of rights you can exercise over your personal data. Your rights are:

• the right to receive a copy of your personal data;

• the right to receive certain personal data in an electronic format;

• the right to have personal data corrected if it is inaccurate. You can correct most of your data by logging into your account;

• the right to ask us to stop processing or object to processing under certain circumstances;

• the right to ask us to erase personal data in certain circumstances;

• the right to withdraw consent at any time when that is the legal basis for our processing. Please be aware that the withdrawal of consent does not affect the lawfulness of our processing based on consent before it was withdrawn.

8.2 If you wish to exercise any of these rights, please contact us by using the contact details below. Please remember that we may ask you to provide us with additional information to verify your identity before we can fulfill your request.

9. How can you contact us?

9.1 If you have any questions or complaints about this privacy policy or the way we handle your personal data, please read our FAQ first. If your question is not listed there or you have any additional questions or complaints, please contact our customer service first. 

9.2 You also have the right to lodge a complaint with your local supervisory authority about the way we handle your personal data. You can contact your local data protection authority by using the contact details on their website. Should you have a complaint, we kindly urge you to contact our data protection officer first by sending an email to  dpo@storiogroup.com.