As of December 18, 2023

Information on di support GmbH’s compliance with the obligation to provide information when collecting personal data from the data subject pursuant to Art. 13 of Regulation (EU) 2016/679 – General Data Protection Regulation (“GDPR”)

– Data protection information on the use of the pixolo app –

The pixolo app (“pixolo” or “app”) offers you the opportunity to design photos directly on your mobile device (cell phone, tablet, etc.) in a time-saving manner and to print them out directly and contactlessly at one of our contractual partners in your area or to order photo products online.

pixolo GmbH and the associated contractual partners respect your privacy and undertake to protect it in accordance with the applicable data protection law. In the following information, you will be informed about what types of personal data are processed in the context of your use of the app, for what purposes and how they are protected. In addition, you will be informed in particular about your legal rights as a data subject and how you can exercise them. We recommend that you read the data protection information carefully.

Brief summary of the directive

We collect and process three basic types of personal data in the pixolo app:

Photos – to provide the printing service.

• Usage data – to check how users use the app, collect information about errors and improve the app.
• GPS location – to show the nearest store on the map where the user can print their photos.

We collect the above-mentioned personal data via the following services:

• Google Firebase, Crashlytics, Facebook Ads Conversion Tracking (Facebook Pixel)
• Personal data: Usage data, geographical position.
• Google Maps and Apple Maps widget to show you where you can print your photos

• Personal data: geographical position, usage data

Complete privacy policy

The following data protection information applies to the download, installation and use of pixolo on your end device as well as the purchase of image products/photo prints from us, insofar as we ourselves become a contractual partner of a purchase contract with you. In the further ordering process, you can also select independent contractual partners from whom you can purchase your image products. After the selection of such a contractual partner – separately marked in pixolo – pixolo will act as a service provider of the respective contractual partner, i.e. the responsibility under data protection law for the creation and purchase of the image products then lies with the independent contractual partner selected by you. Their respective data protection information will be displayed to you in the app during the ordering process and can be accessed at any time under the “Info” menu item in the app in addition to the data protection information on downloading, installing and using pixolo.

When using pixolo, personal data is processed. According to Art. 4 No. 1 GDPR, personal data means any information relating to an identified or identifiable natural person (e.g. IP addresses). If it is possible to identify a person directly from the processed information (e.g. by combining certain terminal device data), this information may also be personal data. However, for reasons of data protection, pixolo does not request or process your name, address, e-mail address or telephone number. There is also no need or possibility to create a customer photo.

Name and contact details of the controller within the meaning of Art. 4 No. 7 GDPR

pixolo GmbH, Stephanstr. 5, 60313 Frankfurt, e-mail: info@pixolo.com, Internet: www.pixolo.com

Contact details of the data protection officer

You can contact our data protection officer at any time at the above address or at datenschutz@pixolo.com.

Personal data, purposes of data processing and legal bases for (data) processing

pixolo processes personal data from a variety of sources. Certain information is already processed automatically as soon as you download or use the app. We have listed exactly which personal data is processed for you below:

Information collected when downloading from pixolo

Description, scope and purpose of data processing: When you download the app, certain required information is sent to the app store you have selected (Google

Play Store or Apple App Store) to enable the download, in particular your e-mail address stored with the respective App Store operator Google or Apple, the customer number of your user account with the App Store operator, the time of the download, the SIM card identification number (International Mobile Subscriber Identity “IMSI”) and the individual device identification number of the end device used by you (International Mobile Equipment Identity “IMEI”, as well as e.g. DeviceID for Android, U(D)ID for Apple) may be processed. This data is processed exclusively by the respective app store operator and is outside our sphere of influence and responsibility.

Information that is automatically collected during use

Description, scope and purpose of data processing: As part of your use of pixolo, we automatically collect certain data that is required for the use of the app. This includes:

• Internet Protocol (IP) address,
• Date and time of access,
• Time zone difference to Greenwich Mean Time (GMT),
• Access status/HTTP status code,
• Device, CPU and memory type of the end device you are using,
• Individual device identification number of the end device you are using (International Mobile Equipment Identity “IMEI”, and e.g. DeviceID for Android, U(D)ID for Apple),
• Operating system and version,
• App version,
• Language setting of the app,
• Location information, geodata, GPS dataAmount of data transmitted in each case.

The app also requires the following authorizations for your end device as part of the automatic collection of information:

• Internet access: This is required to save your entries on our servers;
• Access to photos/memory: This is required to transfer the photos you have selected for the creation of image products/photo printouts.

This data is automatically collected by us to ensure the functionality and stability as well as error-free operation of the app, to prevent and rectify misuse and malfunctions and to protect the information technology systems used. This also gives rise to our legitimate interests in processing the data collected automatically when using the app within the meaning of Art. 6 (1) subparagraph 1 lit. f) GDPR. The processing of the data collected automatically when using the app is technically necessary for the operation of the app.

Legal basis for data processing: The data processing of automatically collected data is justified

• due to the necessity of processing for the performance of a contract to which you are a party or for the implementation of pre-contractual measures for this purpose, which are carried out at your request as the data subject/data subject (Art. 6 para. 1 subpara. 1 lit. b) GDPR, this concerns the purchase of image products/photo prints from the contractual partner individually selected by you during the ordering process),
• due to the necessity to fulfill a legal obligation to which we as the controller are subject (Art. 6 para. 1 subpara. 1 lit. c) GDPR),
• on the basis of necessity to safeguard our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail (Art. 6 para. 1 subpara. 1 lit. f) GDPR).

Duration of data processing: The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected automatically when using the app, this is the case when the respective app session has ended.

Photos, special categories of personal data and third-party rights

Description, scope and purpose of data processing: When you order image products/photo prints, you transmit photos to our information technology systems in order to create the image products/photo prints you have requested. This requires the app to access the memory and the photos you have selected.

Legal basis for data processing: Data processing in connection with photos is justified due to the necessity of processing for the performance of a contract to which you are a party or for the implementation of pre-contractual measures for this purpose, which are carried out at your request as the data subject (Art. 6 para. 1 subpara. 1 lit. b) GDPR, this concerns the purchase of image products/photo prints from the contractual partner you have selected).

Duration of data processing: The photos are deleted immediately and completely when the app is closed after the image products have been created/printed, after a 30-day provision period has expired (when ordering photo products to enable complaints or repeat orders) or if the process is deleted prematurely by selecting the trash can symbol.

Within the photos, you may provide data that is considered particularly sensitive by law (Art. 9 GDPR) (e.g. photos of celebrations with a religious background such as weddings, communion celebrations, etc., from which conclusions can be drawn about religious or ideological beliefs; photos of events from which political opinions can be derived; photos of situations that allow conclusions to be drawn about health data, etc.). However, the app does not evaluate or use your personal data in the context of processing special categories of personal data within the meaning of Art. 9 GDPR. We have no interest in analyzing such data and process personal data solely for the purpose of creating your selected

Image products/photo prints without any reference to a possible special sensitivity of data.

The legality of the use of data and rights of third parties arising from the transmitted photos themselves – in particular images of third parties – is beyond our sphere of influence and responsibility. As a user, you yourself are responsible for ensuring that the use is legally permissible and that we only initiate data processing on the basis of lawful circumstances. The transmission of illegal, in particular unlawfully acquired or created, xenophobic, racist, ethnically offensive, pornographic, discriminatory, defamatory, obscene, threatening, intimidating, harassing, hateful or otherwise offensive content is not permitted.

Contact requests by post, e-mail, telephone or fax

Description and scope of data processing: You have the option of contacting us or our data protection officer using the contact details listed above. In this case, in addition to your individual message text, any personal data transmitted together with the message, such as your surname, first name, e-mail address, telephone and/or fax number, will be processed. The following data is also processed when the message is sent by email:

• IP address of the user;
• Date and time the message was sent.

The processing of personal data serves us solely to process the request. The other personal data processed during the sending process by e-mail is used to prevent misuse of our e-mail address and to ensure the security of our information technology systems. The provision of personal data by you in the context of contact requests and messages is neither required by law nor by contract, nor is it necessary for the use of the app. You are not obliged to provide us with personal data. However, if you do not provide contact data, it will not be possible to contact you.

Legal basis for data processing: The data processing of data received in the context of contact requests is justified:

• due to the necessity of processing for the performance of a contract to which you are a party or for the implementation of pre-contractual measures for this purpose, which are carried out at your request as the data subject (Art. 6 para. 1 subpara. 1 lit. b) GDPR, this concerns the processing of your request;
• due to the necessity to safeguard our legitimate interests in the effective processing of your request or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail (Art. 6 para. 1 subpara. 1 lit. f) GDPR).

Duration of data processing: The data will be deleted when your request has been finally processed or you request us to delete it, unless contractual or legal obligations prevent deletion.

Cookies and related technologies

Description and scope of data processing: In order to make the use of the app attractive and to enable the use of certain functions, so-called “cookies”, cookie-like or cookie-replacing technologies are used as so-called “identifiers” in some areas. These are usually small text or image files that are stored locally on your end device. They consist of a specific string of characters that enable subsequent recognition. In this context, so-called “web beacons” are usually transparent graphic/image elements that allow recognition. Cookies make it possible to improve the convenience and quality of our services, e.g. by storing user settings or certain content (e.g. content of the shopping cart). Cookies, cookie-like or cookie-replacing technologies do not cause any damage to your end device and do not contain viruses. The purpose of using technically necessary cookies is to simplify the use of the app for users. Some functions of the app cannot be offered without the use of cookies. For these, it is necessary that the app is recognized after a page change within the app. Statistics and analysis cookies are used for the purpose of improving the quality of the app and its content. Analysis cookies tell us how the app is used and enable us to constantly optimize our offering.

Legal basis for data processing: If personal data is processed using technically necessary cookies, the legal basis is Art. 6 para. 1 subpara. 1 lit. f) GDPR. Our legitimate interest lies in improving the convenience and quality of our services by simplifying the use of the app. Insofar as you have declared this in the knowledge of your rights (Art. 7 para. 3, Art. 15 et seq. GDPR, see below), the legal basis for the use of analysis cookies and corresponding technologies is your express, voluntary consent to the processing of personal data concerning you for one or more specific purposes, which you can revoke at any time in the future (Art. 6 para. 1 subpara. 1 lit. a) GDPR).

Duration of data processing: Technically necessary cookies are automatically deleted when you close the app. Statistical and analysis cookies are automatically deleted after a specified period, which differs depending on the cookie and can be found in the following descriptions of the individual usage analysis tools. Cookies can also be deleted manually at any time in the security settings of your end device:

• Android: Settings 🡪 General 🡪 Application manager 🡪 pixolo
• iOS/Apple: Settings 🡪 General 🡪 iPhone/IPad storage 🡪 pixolo

Usage statistics and usage analysis

If you have given your voluntary consent within the meaning of Art. 6 para. 1 subpara. 1 lit. a) GDPR, which can be revoked at any time for the future, the following statistical and analysis tools are used in the app to the extent described below:

Firebase Crashlytics and Firebase Performance Monitoring

Description, scope and purpose of data processing: The app uses Firebase Crashlytics and Firebase Performance Monitoring. According to the operator Google, this is a usage analysis service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland, Tel. +353-1543 1000, Fax: +353-1686 5660, E-Mail: support-deutschland@google.com; hereinafter: “Google”). By using Firebase Crashlytics and Firebase Performance Monitoring, it is possible to use certain device data to determine information about how stable the app works on your device (e.g. how quickly the app starts and how quickly it loads pages) and what the causes of any technical problems are. The purpose of the data processing is to ensure and improve the technical stability and performance of the app. The use of analytical tools is only related to the technical stability and performance of the app; the controller does not process data with the aim of evaluating the user as a person or in connection with content aspects of your order of image products.

According to Google, Firebase Crashlytics processes the following device information in particular:

• RFC-4122-UUID (standardized, individual identification number), with which we can deduplicate crashes,
• Timestamp of a crash,
• Bundle ID and the full version number of the app,
• Operating system name and the version number of the end device,
• Indicates whether the end device has been jailbroken / rooted,
• Model name of the end device, CPU architecture, RAM memory and storage space,
• the uint64 instruction pointer of each frame of each currently executing thread,
• if available at runtime, the plain text method or the function name that each statement pointer contains,
• if an exception was triggered, the plain text class name and the message value of the exception,
• if a serious signal has been triggered, its name and integer code,
• for each binary image loaded into the application, the name, the UUID, the byte size and the uint64 base address at which it was loaded into RAM,
• Indication of whether or not the app was in the background at the time of a crash,
• an integer value that indicates the rotation of the screen at the time of the crash,
• Indicates whether the device’s proximity sensor has been triggered.

According to Google, Firebase performance monitoring processes the following device information in particular:

• General device information such as model, operating system and orientation,
• RAM and memory size,
• CPU utilization,
• Carrier (based on mobile country and network code),
• Radio / network information (e.g. WiFi, LTE, 3/4/5 G),
• IP address,
• Country (based on the IP address),
• Locale / Language,
• App version,
• App foreground or background status,
• Name of the app package,
• Firebase installation IDs,
• Duration for automated traces,
• Network URLs (without URL parameters or payload content) and response codes (e.g. 403, 200), payload size in bytes and response time.

Firebase Crashlytics and Firebase Performance Monitoring can also access so-called advertising IDs. This is an individual check digit anchored in the operating system of your respective end device, which can be retrieved by analysis services on a device-specific basis and linked to user information stored in databases for the respective check digit as personal data. Since we have no interest in obtaining such information, pixolo does not access the advertising IDs of your device. To protect against unwanted advertising, you can also prevent the reading of advertising IDs in the following paths of your end device:

• Android: Settings 🡪 Google 🡪 Advertising
• iOS/Apple: Settings 🡪 Privacy 🡪 Tracking/Analysis&Improvements/ Apple advertising

It is also possible at this point to deactivate data collection for pixolo only, which you can do in the corresponding pixolo submenu.

Legal basis for data processing: Insofar as you have declared this in the knowledge of your rights (Art. 7 para. 3, Art. 15 ff. GDPR, see below), the legal basis for data processing in connection with the usage analysis of Firebase Crashlytics and Firebase Performance Monitoring is your express, voluntary consent to the processing of personal data concerning you for one or more specific purposes (Art. 6 para. 1 subpara. 1 lit. a) GDPR), which can be revoked at any time in the future. Any data transfer by Google to non-European countries, which may entail data protection risks, is also based on your consent to the processing of your personal data for one or more specific purposes (Art. 6 (1) subparagraph 1 lit. a), Art. 49 (1) subparagraph 1 lit. a) GDPR), which you have expressly declared voluntarily and which can be revoked at any time in the future in full knowledge of your rights (Art. 7 (3), Art. 15 ff. GDPR, see below). You are not obliged to provide us with personal data in the context of the

to provide usage analysis of Firebase Crashlytics and Firebase Performance Monitoring and to declare your consent for this.

Duration of data processing: According to Google, the retention period for data collected with Firebase Crashlytics is 90 days, the retention period for data collected with Firebase Performance Monitoring is 30 days for installation and IP-related data according to Google and 90 days for other data.

As Firebase Crashlytics and Firebase Performance Monitoring are third-party services, we have no influence on the processing of corresponding data by Google. The purpose and scope of further data collection and the further processing and use of the data by Google as well as your rights in this regard and setting options to protect your privacy can be found in the corresponding data protection information of the operator Google at https://firebase.google.com/support/privacy. Google also processes your personal data in the USA, which is why we have agreed with Google on the standard contractual clauses published by the European Commission to ensure an adequate level of data protection, in addition to a contract on joint data protection responsibility. According to Google, this complies with all applicable data protection laws. However, we would like to point out that the transfer of data to non-European countries can, by its very nature, always entail data protection risks.

Google Maps

Description, scope and purpose of data processing: The app uses the Google Maps service provided by Google. This enables us to make it easier for you to search for and find contractual partners for the production of image products/photo prints in your area by displaying them in interactive maps directly in the app. If you have consented to the transfer of data to Google by clicking on the corresponding button on the map symbol, Google will receive the information that you have accessed the corresponding section of the app. In addition, the data mentioned above under “Information that is automatically collected during use” may be transmitted to Google and GPS data may be accessed if the access authorization on your device is activated accordingly. This takes place regardless of whether you are logged in to a Google user account at the same time or whether no login exists or no user account exists. If you are logged in to Google, your data can be assigned to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button on the map icon. You can also deactivate all personalization within a Google account under the “My Account” section or activate a time limit for the storage period (e.g. automatic deletion after three months). pixolo only uses the map function of Google Maps to locate the contractual partner you have selected. The app does not use any additional functions such as search functions, navigation/route creation, traffic information, satellite view, street view, etc. and does not process any corresponding data in these contexts.

Legal basis for data processing: Insofar as you have declared this in the knowledge of your rights (Art. 7 para. 3, Art. 15 et seq. GDPR, see below), the legal basis for data processing in connection with Google Maps is your express, voluntary consent to the processing of personal data concerning you for one or more specific purposes, which you can revoke at any time in the future (Art. 6 para. 1 subpara. 1 lit. a) GDPR). Any data transfer by Google to non-European countries, which may entail data protection risks, is also based on your consent to the processing of personal data concerning you for one or more specific purposes (Art. 6 (1) subparagraph 1 lit. a), Art. 49 (1) subparagraph 1 lit. a) GDPR), which you have expressly and voluntarily declared in the knowledge of your rights (Art. 7 (3), Art. 15 ff. GDPR, see below) and which can be revoked at any time in the future. You are not obliged to use Google Maps and give your consent for this.

Duration of data processing: All personal data collected by pixolo in connection with the use of Google Maps is only stored by the app until the end of the respective app session. The storage duration of any data processed by Google is not visible to us.

To protect against unwanted advertising, you can also prevent the reading of advertising IDs in the following paths of your end device:

• Android: Settings 🡪 Google 🡪 Advertising
• iOS/Apple: Settings 🡪 Privacy 🡪 Tracking/Analysis&Improvements/ Apple advertising

It is also possible at this point to deactivate data collection for pixolo only, which you can do in the corresponding pixolo submenu.

As Google Maps is a third-party service, we have no influence on the processing of corresponding data by Google. The purpose and scope of further data collection and the further processing and use of the data by Google as well as your rights in this regard and setting options to protect your privacy can be found in the corresponding data protection information of the operator Google at https://policies.google.com/privacy?hl=de. Google also processes your personal data in the USA, which is why we have agreed with Google on the standard contractual clauses published by the European Commission to ensure an adequate level of data protection, in addition to a contract on joint data protection responsibility. According to Google, this complies with all applicable data protection laws. However, we would like to point out that the transfer of data to non-European countries can, by its very nature, always entail data protection risks.

Apple Analytics

Description, scope and purpose of data processing: The app uses Apple Analytics, a web analytics service provided by Apple Inc. (One Apple Park Way, Cupertino, CA 95014, USA, Tel. +1-408-996-1010), whose data controller for users from the European Economic Area is, according to the operator, Apple Inc.

Apple Distribution International Ltd (Hollyhill Industrial Estate, Hollyhill Cork, Ireland, Tel.: +353-214284000, Fax: +353-214284000, E-Mail: ip-hostmaster@group.apple.com; hereinafter: “Apple”). This makes it possible to statistically analyze the use of the app. However, this is only done in the form of general usage reports, which do not allow any statements to be made about individual users. During use, we are only able to view the following parameters, which do not allow us to make any references to individual users or orders:

• the total number of installations of the app,
• the percentage distribution of the app’s origins (e.g. search in the Apple App Store or search via websites),
• the total number of calls to the app,
• the total number of views of the product pages,
• the percentage distribution of the app according to Apple end devices,
• the percentage distribution of active users within a certain period of time (e.g. usage of the app per month),
• the total number of errors and program crashes,
• the conversation rate as a percentage ratio of users to user actions such as downloads or orders and
• the total number of orders.

The information generated by Apple Analytics about your use of the app is usually transferred to an Apple server in the USA and stored there. When you create a user account with Apple (“Apple ID”), Apple obtains a corresponding declaration of consent for the processing of personal data.

Legal basis for data processing: Insofar as you have declared this in the knowledge of your rights (Art. 7 para. 3, Art. 15 et seq. GDPR, see below), the legal basis for data processing in connection with the statistical analysis of Apple Analytics is your express, voluntary consent to the processing of personal data concerning you for one or more specific purposes (Art. 6 para. 1 subpara. 1 lit. a) GDPR), which can be revoked at any time in the future. Any data transfer by Apple to non-European countries, which may entail data protection risks, is also based on your consent to the processing of personal data concerning you for one or more specific purposes (Art. 6 para. 1 subpara. 1 lit. a), Art. 49 para. 1 subpara. 1 lit. a) GDPR), which you have expressly declared voluntarily in the knowledge of your rights (Art. 7 para. 3, Art. 15 ff. GDPR, see below) and which can be revoked at any time in the future. You are not obliged to provide us with personal data as part of the Apple Analytics usage analysis and to declare your consent to this.

Duration of data processing: Data collected in connection with the statistical analysis of Apple Analytics can be viewed by us for the entire duration of the APP installation in the form of total figures. The storage duration of any data processed by Apple is not visible to us.

You can revoke your consent to the statistical use of your data by Apple at any time as follows or generally deactivate the collection of data:

• Settings 🡪 Data protection 🡪 Tracking/Analysis & improvements/Apple advertising

It is also possible at this point to deactivate data collection for pixolo only, which you can do in the corresponding pixolo submenu.

As Apple Analytics is a third-party service, we have no influence on the processing of such data by Apple. The purpose and scope of further data collection and the further processing and use of the data by Apple as well as your rights in this regard and setting options to protect your privacy can be found in the corresponding data protection information of the operator Apple at https://www.apple.com/de/legal/privacy/. Apple also processes your personal data in the USA, which is why we have agreed with Apple on the standard contractual clauses published by the European Commission to ensure an adequate level of data protection, in addition to a contract on joint data protection responsibility. According to Apple, this complies with all applicable data protection laws. However, we would like to point out that data transfer to non-European countries can, by its very nature, always involve data protection risks.

Apple Maps

Description, scope and purpose of data processing: The app uses Apple Maps, a service provided by Apple. This enables us to make it easier for you to search for and find contractual partners for the production of image products/photo prints in your area by displaying them in interactive maps directly in the app. If you have consented to the transfer of data to Apple by clicking on the corresponding button on the map icon, the further course of use is based on the “Maps” application installed on your device. pixolo uses only the map function of Apple Maps to locate the contractual partner you have selected. The app does not use any additional functions such as search functions, navigation/route creation, traffic information, satellite view, street view, etc. and does not process any corresponding data in these contexts. According to the operator Apple, even if corresponding data is collected – which is not intended by pixolo – no links are made to your Apple ID, but only references to randomly generated attributes (so-called “identifiers”) are created, which, according to the operator Apple, have no connection to your Apple ID.

Legal basis for data processing: Insofar as you have declared this in the knowledge of your rights (Art. 7 para. 3, Art. 15 et seq. GDPR, see below), the legal basis for data processing in connection with Apple Maps is your express, voluntary consent to the processing of personal data concerning you for one or more specific purposes (Art. 6 para. 1 subpara. 1 lit. a) GDPR), which can be revoked at any time in the future. Any data transfer by Apple to non-European countries, which may entail data protection risks, is also carried out on the basis of your express, voluntary consent, which you are aware of your rights (Art. 7 para. 3, Art. 15 ff. GDPR, see below) and which can be revoked at any time for the future.

Consent to the processing of your personal data for one or more specific purposes (Art. 6 para. 1 subpara. 1 lit. a), Art. 49 para. 1 subpara. 1 lit. a) GDPR). You are not obliged to use Apple Maps and to give your consent for this.

Duration of data processing: All personal data collected by pixolo in connection with the use of Apple Maps is only stored by the app until the end of the respective app session. The storage duration of any data processed by Apple is not visible to us.

To protect against unwanted advertising, you can also prevent the reading of advertising IDs in the following paths of your end device:

• Settings 🡪 Privacy 🡪 Tracking/Analysis&Improvements/ Apple advertising

It is also possible at this point to deactivate data collection for pixolo only, which you can do in the corresponding pixolo submenu.

As Apple Maps is a third-party service, we have no influence on the processing of corresponding data by Google. The purpose and scope of further data collection and the further processing and use of the data by Google as well as your rights in this regard and setting options to protect your privacy can be found in the corresponding data protection information of the operator Apple at https://maps.apple.com/imagecollection/privacy/de/de/privacy.pdf and https://www.apple.com/de/privacy/features/. Apple also processes your personal data in the USA, which is why we have agreed with Apple on the standard contractual clauses published by the European Commission to ensure an adequate level of data protection, in addition to a contract on joint data protection responsibility. According to Apple, this complies with all applicable data protection laws. However, we would like to point out that data transfer to non-European countries can, by its very nature, always involve data protection risks.

Disclosure and transfer of data

Your personal data will be forwarded to our affiliated companies and subsidiaries as well as our service partners who are required to process the contractual relationship and who have been commissioned by us to process personal data in accordance with instructions within the framework of order processing contracts (e.g. IT service providers, software operators, etc.). If it is necessary to investigate illegal or improper use of the app or for legal prosecution, personal data may also be forwarded to law enforcement authorities or other authorities and, if necessary, to injured third parties or legal advisors. However, this only happens if there are indications of unlawful or abusive behavior. Disclosure may also take place if this serves to enforce terms of use or other legal claims. We are also legally obliged to provide information to certain public authorities on request. These are law enforcement authorities, authorities that prosecute administrative offenses subject to fines and tax authorities. Within the scope of

In the course of our corporate development, the structure of our company may also change by changing its legal form or by founding, buying or selling subsidiaries, parts of the company or components. In such transactions, customer information may be passed on together with the part of the company to be transferred. In this case, we have a legitimate interest in adapting our corporate form to the economic and legal circumstances as required. Whenever personal data is passed on to third parties to the extent described above, we ensure that this is done in accordance with the applicable data protection law and will also request this from the respective data recipient. Data will only be passed on to other third parties if we have received your voluntary consent, which can be revoked at any time in the future.

Our service partners include the following processors used by us in the context of app operation:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Tel. +353-1543 1000, Fax: +353-1686 5660, E-Mail: support-deutschland@google.com;
• Apple Inc (One Apple Park Way, Cupertino, CA 95014, USA, Tel. +1-408-996-1010).
• ORWO Net GmbH Röntgenstraße 3, 06766 Bitterfeld-Wolfen, Tel: +49 3494 369 777, kundenservice@orwo.de
• PHOTOBOOK.AI PTE. LTD. (Unit A2, 5001 Beach Road, Golden Mile Complex, #04-03, Singapore 199588, hello@photobook.ai)

Legal basis for the data transfer: The data transfer is justified:

• due to the necessity of processing for the performance of a contract to which you are a party or for the implementation of pre-contractual measures for this purpose, which are carried out at your request as the data subject/data subject (Art. 6 para. 1 subpara. 1 lit. b) GDPR, this concerns the purchase of image products/photo prints from the contractual partner individually selected by you during the ordering process,
• due to the necessity to fulfill a legal obligation to which we as the controller are subject (Art. 6 para. 1 subpara. 1 lit. c) GDPR),
• on the basis of necessity to safeguard our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail (Art. 6 para. 1 subpara. 1 lit. f) GDPR),
• where applicable: on the basis of your express, voluntary consent to the processing of your personal data for one or more specific purposes, which you may withdraw at any time with future effect (Article 6(1)(1)(a) GDPR).

Data transfers to third countries

Personal data can also be transferred to areas outside the European Economic Area and processed there. However, this is only possible if the European Commission has confirmed the adequacy of the level of data protection in a

third country (Art. 45 GDPR), we have provided suitable guarantees within the meaning of Art. 46 GDPR (binding internal data protection regulations approved by the competent supervisory authority pursuant to Art. 46 para. 2 lit. b), Art. 47 GDPR; use of standard data protection clauses of the European Commission or the competent supervisory authority pursuant to Art. 46 para. 2 lit. c) and lit. d) GDPR within the meaning of the decision of the European Commission of February 5, 2010 (2010/87/EU), OJ EU 2010 No. L 39 pp. 5 et seq, p. 10 ff. on standard contractual clauses for processors; codes of conduct approved by the competent supervisory authority and approved certification mechanisms pursuant to Art. 46 para. 2 lit. e) and lit. f) GDPR; individually negotiated contractual clauses approved by the competent supervisory authority pursuant to Art. 46 para. 3 lit. a) GDPR after carrying out a consistency mechanism within the meaning of Art. 63 GDPR) or one of the exceptions listed in Art. 49 GDPR is applicable (in particular explicit, voluntary consent that can be revoked at any time for the future pursuant to Art. 49 (1) subparagraph 1 lit. a) GDPR; necessity for the performance of the contract in the interest of the data subject pursuant to Art. 49 (1) subparagraph 1 lit. b) and lit. c) GDPR). In this context, it is also ensured that your data is processed securely and in accordance with the applicable data protection law at all times, even if residual data protection risks cannot always be completely ruled out when transferring data to third countries.

Duration of data processing

We delete your personal data as soon as it is no longer required for the purposes for which we have processed it in accordance with the above paragraphs. With the exception of personal data that is continuously processed for the technical operation of the app, personal data in connection with contact requests and personal data in the context of usage statistics and usage analysis, the processing duration of which is described in more detail above, we only store your personal data until the app is closed after the image products have been created/printed, after a 48-hour provision period has expired or if the process is deleted prematurely by selecting the trash can symbol (depending on which event occurs first).

Your rights as a data subject

You have the following legally guaranteed rights, which you can assert by contacting us (pixolo GmbH) as the controller using the contact details provided above:

Right to information:

In accordance with Art. 15 GDPR, you have the right to request information about your personal data processed by us; in particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing, revocation and objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us and the existence of a right to data portability.

of automated decision-making including profiling and, where applicable, meaningful information on the details thereof.

Right to rectification:

In accordance with Art. 16 GDPR, you have the right to demand the immediate correction of incorrect or incomplete personal data stored by us.

Right to erasure (“right to be forgotten”):

In accordance with Art. 17 GDPR, you have the right to request the deletion of your personal data stored by us, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims.

Right to restriction:

In accordance with Art. 18 GDPR, you have the right to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to delete it and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR.

Right to data portability:

In accordance with Art. 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller.

Right of appeal:

In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our registered office.

Right of withdrawal:

You have the right to revoke your declarations of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Please send your revocation to us as the controller using the contact details provided above.

Right of objection

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on your particular situation.

Art. 6 para. 1 subpara. 1 lit. f) GDPR, to file an objection in accordance with Art. 21 GDPR. We will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing serves the establishment, exercise or defense of legal claims. Please address your objection to us as the controller using the contact details provided above.

Existence of automated decision-making including profiling

No automated decision-making or profiling takes place in the context of ordering image products/photo prints in the app. However, the above-mentioned service providers for statistics and usage analysis may still use personal data to create user profiles. However, we have no interest in this and do not use such information as part of the ordering process.

Data security

We use the widespread SSL (Secure Socket Layer) method in conjunction with the highest encryption level supported by your systems on your end device within the app operation. pixolo does not store any unencrypted data on your end device if it may be exposed to access by third parties (e.g. on SD cards). We also use suitable technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

Changes to this data protection notice

We always keep our data protection information up to date. We therefore reserve the right to amend it from time to time and to update it to reflect changes in the collection, processing or use of your data. Please check our data protection information regularly and take note of any changes. The current version of the privacy policy is always available under the menu item “Data protection” within the app.