Privacy Policy
Last updated: 17 October 2026
1. Data Controller
Responsible under the General Data Protection Regulation (GDPR):
Sören Eberhardt-Biermann
Schweriner Str. 15
19306 Neustadt-Glewe
Germany
Email: info@fotospiel.app Website: /en/
2. General Information
We process personal data in compliance with the GDPR and the German Federal Data Protection Act (BDSG).
Use of the Fotospiel App generally requires only the personal data needed to host a photo event and provide its booked photo and optional short-video features.
We are the controller for the website, host accounts, billing, our own communications, and service security. Organizers determine the purposes and participants of their events. Where the GDPR applies to an event, its organizer is responsible for the lawfulness of event recordings and for informing guests and depicted persons. Where we process this content on an organizer's instructions, we act as a processor; this requires an agreement under Art. 28 GDPR. Our agreement with the hosting provider does not replace that agreement between the organizer and Fotospiel. Questions may be sent to info@fotospiel.app.
3. Types of Data Processed
- Organizer data: name, email address, payment information (via PayPal), event details (title, date, tasks, photos and, if enabled, short videos)
- Guest data: uploaded photos and, if enabled for the event, short videos including their visual and audio recordings, display name (optional), likes/reactions
- Technical data: IP address, browser type, timestamp, device information, pseudonymous session identifier (session_id), and checkout/coupon abuse signals (e.g., device/browser characteristics, coupon/transaction metadata)
- Communication data: messages sent via contact form or email
4. Purpose and Legal Basis of Processing
| Purpose | Legal Basis | Description |
|---|---|---|
| Providing the app to organizers who enter into a contract | Art. 6(1)(b) GDPR | Performance of the booked contract |
| Storing, technically preparing, and displaying event media on an organizer's behalf | Processing on instructions under Art. 28 GDPR; the organizer acting as controller determines the legal basis for guests and depicted persons | Art. 6(1)(b) GDPR for the host contract does not provide a blanket legal basis for recordings of third parties. Videos are converted to the open WebM format with VP9 video and Opus audio and supplied with preview images |
| Payment processing and invoicing | Art. 6(1)(b), (c) GDPR | Use of PayPal services |
| Fraud and abuse prevention (checkout/coupons) | Art. 6(1)(f) GDPR | Protecting against fraud, abuse, and improper coupon redemptions |
| Web analytics via Matomo (own EU instance) | Art. 6(1)(f) GDPR | Anonymous statistical analysis of the marketing frontend |
| Server logs and security | Art. 6(1)(f) GDPR | Ensuring system security |
| Responding to inquiries | Art. 6(1)(f) or (b) GDPR | Communication with users |
5. Hosting and Data Processing
Our servers are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
A data processing agreement pursuant to Art. 28 GDPR is in place.
Our own hosting infrastructure, including email delivery and error tracking, is operated at Hetzner using self-hosted systems. Processing within this infrastructure takes place in the EU; the separate payment-processing disclosures remain applicable.
When short videos are enabled, the standard configuration accepts open WebM source files only. Direct recording in the browser may capture video and, after permission is granted, audio. Files are automatically checked and technically converted to WebM with VP9 video and Opus audio. The audio track is neither transcribed nor analyzed for content. The temporary source file is deleted after successful processing or when the technical retention period expires; only the normalized video and its preview images are subsequently delivered.
6. Payment Processing
Payments are handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
We store the data needed to assign, bill, and document payments, including order and transaction identifiers, amount, currency, payment status, and invoice details. We do not store full credit card numbers or card security codes; these are processed by the payment provider.
During checkout and coupon redemption, we process technical signals (e.g., IP address, device/browser characteristics, timestamps) for fraud and abuse prevention. This data may be shared with PayPal.
The legal bases are Art. 6(1)(b) GDPR for payment processing, (c) for statutory billing and recordkeeping obligations, and (f) for necessary fraud and abuse prevention.
Privacy policies:
7. Web Analytics with Matomo
We use Matomo through our own instance operated within the EU (https://piwik.sebfoto.de) for anonymous analysis of the marketing frontend.
Analytics are active by default and run without cookies; Matomo analytics cookies are not set.
IP addresses are anonymized in Matomo before storage. Only the anonymized IP address is used for geolocation.
We do not send user IDs, names, or email addresses. Marketing events contain only the categories defined by the website, technical status values, and statistical values.
No data is shared with additional third parties.
In the guest areas of the app, a pseudonymous session identifier (session_id) is used and stored in a technically necessary cookie or in the browser’s local storage to associate uploads, likes, and tasks with a device or session. The identifier itself contains no name or email address. As it is linked to uploads, reactions, and tasks, we treat it as personal data.
Analytics can be disabled at any time via the “Privacy settings” link in the footer.
Legal basis is Art. 6(1)(f) GDPR; you may object to processing for analytics purposes at any time with future effect.
8. Cookies and Local Storage
Only technically necessary cookies are used. Matomo does not set analytics cookies in the marketing frontend. Matomo analytics run without cookies and do not use user IDs. Storage and access strictly necessary to provide a digital service expressly requested by the user are covered by Section 25(2)(2) TDDDG. Subsequent processing of personal data is separately governed by the GDPR legal bases described in this policy.
The guest feature temporarily stores selected media and upload metadata in the browser (in particular IndexedDB) so that uploads can resume after connection failures. Files that have not yet synchronized may remain on the device. You can remove local data through your browser settings; this also removes uploads that have not yet been transferred. Please take this into account when using shared devices.
Analytics can be disabled at any time via the privacy settings.
9. Data Retention Periods
Online withdrawal function
When you use the online withdrawal function, we process the name provided, order or contract number, confirmation email address, date and time of receipt, and technically necessary security and log data. This is used to receive, assign, acknowledge, process and document the declaration and our statutory obligations. The legal bases are Art. 6(1)(b) and (c) GDPR. Data is retained in accordance with applicable commercial, tax and civil-law recordkeeping requirements and then deleted unless claims require longer retention.
| Data Type | Retention Period | Reason |
|---|---|---|
| Photos and short videos, including audio tracks and preview images | Deleted within 30 days after the booked storage period ends | Automatic deletion including associated archive copies and technical derivatives; temporary video source files are deleted after processing or expiry of the technical retention period |
| User accounts (hosts) | Deleted after 24 months of inactivity | Contract completed |
| Invoices and accounting vouchers | Generally 8 years from the end of the year of issue; other records follow their applicable statutory retention period | Commercial and tax recordkeeping; ongoing proceedings may require longer retention |
| Server logs | 7 days | IT security |
| Contact messages | Max. 6 months | After processing completed |
Individual records are retained longer only where required by law or necessary to establish, exercise, or defend legal claims. Such retention holds are limited to that purpose and released when their grounds no longer apply.
10. Data Disclosure
Data is only shared with:
- Payment providers (PayPal)
- Hosting provider (Hetzner)
- Public authorities when legally required
Our own hosting infrastructure is located in the EU. PayPal processes payment data as an independent controller and may also process it outside the European Economic Area, particularly in the United States. PayPal explains the transfer mechanisms it uses, including Binding Corporate Rules, in its privacy notice and Binding Corporate Rules. These also explain how to obtain information and copies of the safeguards.
11. Data Subject Rights
You have the following rights under GDPR:
- Right of access (Art. 15)
- Right to rectification (Art. 16)
- Right to erasure (Art. 17)
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20)
- Right to object (Art. 21)
Requests may be sent to: info@fotospiel.app
If you believe that processing violates the GDPR, you may lodge a complaint with a data protection supervisory authority under Art. 77 GDPR, particularly in the country of your habitual residence, workplace, or the alleged infringement. The authority for our registered location is the State Commissioner for Data Protection and Freedom of Information Mecklenburg-Vorpommern, Werderstraße 74a, 19055 Schwerin, Germany, info@datenschutz-mv.de: contact and complaints.
12. Withdrawal of Consent
If processing is based on consent, you may withdraw it at any time with future effect. This does not affect the lawfulness of processing carried out before withdrawal.
13. Data Security
We apply appropriate technical and organizational measures to secure your data, including encryption, access controls, and backups.
14. Changes to this Privacy Policy
We may update this Privacy Policy to reflect legal or functional changes.
The current version is always available at /en/privacy.