If you wish to join our
team of artists, please send your CV to:
info@photo2post.com
Image Retouch srl
Via G. Washington 13
Milano 20146
CF E P. IVA 12107710969
Contact: info@photo2post.com
INFORMATION ON THE PROCESSING OF PERSONAL DATA
pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”)
In its capacity as the owner of the website www.photo2post.com (the “Site”), the Photo2Post application (the “Application”) and the data processed for them, PHOTO2POST S.r.l. informs every user of the Site and the Application (hereinafter, the “Data Subject”) that the data provided when accessing the Site and the Application and interacting with them will be processed in accordance with the provisions outlined below.
1. Data controller
The data controller is PHOTO2POST S.r.l. (VAT number 12107710969) based in Milan (MI), via Washington 13, 20146, and registered with the Companies Register of MILANO MONZA BRIANZA LODI under number MI-2641118, email: privacy@photo2post.com (hereinafter the “Controller”).
2. Nature of the data processed
Personal data of the Data Subjects is processed, where personal data refers to any information relating to a natural person, identified or identifiable, even indirectly, by reference to any other information (the “Data”).
PHOTO2POST S.r.l., through the Site and the Application, also collects and records the user’s browsing Data, which allows access to the Site and the Application as well as navigation on them and is used in aggregated and anonymous form for statistical purposes and to verify the correct functioning of the Site and the Application.
In particular, the Data that may be collected include the following:
Contact data: first name, last name, tax code, physical address and email, phone number, mobile number.
Other Data: images of the Data Subject and, if they choose to provide them, place and date of birth.
Economic information about transactions: such as payment methods, information related to purchases made, orders, returns, etc.
Use of the Site and the Application: methods of access and use of the Site and the Application, sending and reading of communications including information collected through cookies (at the following link https://photo2post.com/privacy-policy you can find our Cookie Policy).
3. Purposes of processing and legal basis of processing
The processing carried out using manual, computer and telematic tools with logic strictly related to the purposes and, in any case, in a manner that ensures the security and confidentiality of the Data themselves in compliance with current regulations is aimed at:
1. access and navigation on the Site and the Application, particularly in reserved areas thereof and the establishment and execution of contractual relations and consequent obligations;
2. promotion and sale of the Controller’s services via email, letters, phone, fax, SMS, MMS, internet and other automated and non-automated communication systems;
3. sending newsletters related to the activities carried out by photographers/retouchers;
4. fulfilling obligations provided by law, regulations, European legislation or by an order of the Authority;
5. exercising the rights of the Controller, e.g. the right of defence in court.
4. Legal basis of processing
The processing of the Data for the purpose referred to in art. iii lett. a) above is necessary for the execution of a contract to which the data subject is a party or for the execution of pre-contractual measures pursuant to art. 6 (1) (b) of the GDPR.
The processing of the Data for the purposes referred to in art. iii lett. b) and c) above finds its legal basis in the consent to the processing of one’s Data given by the Data Subject pursuant to art. 6 (1) (a) of the GDPR.
The processing of the Data for the purpose referred to in art. iii lett. d) → legal obligation (art. 6(1)(c))
The processing of the Data for the purpose referred to in art. iii lett. e) → legitimate interest (art. 6(1)(f))
5. Data retention period
The retention of the provided Data will occur for the time necessary to fulfil the purposes described above as well as to comply with legal obligations imposed for the same purposes.
For completeness, we provide below the retention times in relation to the different purposes listed above:
for access and navigation on the Site and the Application: the Data processed for this purpose will be retained for no longer than 5 years from the last activity and/or access to our Site and the Application;
for the establishment and execution of contractual relations and consequent obligations: the Data processed to comply with any contractual obligation will be kept for the duration of the contract and in any case no longer than 10 years for tax and accounting purposes;
for sending the newsletter for informative and promotional purposes: the Data processed for marketing purposes will be kept for 24 months from the date on which the last consent for this purpose was given, except for opposition to receive further communications.
At the end of the Data processing period, the Data will be deleted or rendered permanently anonymous.
6. Communication
The Data processed by the Controller will not be disseminated, meaning it will not be disclosed to unspecified subjects.
The Data may, however, be communicated to employees of the Controller and to some external subjects who collaborate with it, within the limits of the purposes indicated in this privacy notice. Finally, they may be communicated to subjects entitled to access it by virtue of laws, regulations, and norms.
The Data will only be processed by subjects expressly authorized by the Controller or by companies acting as Data Processors on behalf of the Controller, who have signed a specific contract that precisely governs the processing entrusted to them and the obligations regarding data protection.
The list of Data Processors is available at the Controller.
Additionally, the collected Data may be communicated to public or private entities for the fulfilment of obligations provided by law.
7. Discretion or obligation to provide Data and consequences of failing to provide Data
The provision of Data is not mandatory; however, failure to provide the same will result in Data Subjects being unable to access the reserved area and benefit from the services of the Site and the Application.
Therefore, the provision of the Data requested at the time of activating the Services is necessary for the purposes of points iii. lett. a) and d) as it is strictly functional to the performance of the requested Services and compliance with legal obligations. Any refusal to provide the Data will result in the inability for the Controller to provide the requested Services and/or fulfill legal obligations.
The provision of Data for the purpose referred to in point iii lett. b) and c) is optional. However, failure to provide consent will result in the inability to receive the newsletter and/or other promotional material. It is possible to unsubscribe from the newsletter at any time and at no cost.
Regarding the purpose referred to in point iii lett. e), the processing is based on the legitimate interest of the Controller to protect itself in any competent forum.
The processing of data resulting from the use of profiling cookies occurs only with prior consent via a specific banner. For more details, please refer to the Cookie Policy.
8. Withdrawal of consent
The Data Subject has the right to withdraw their consent at any time without affecting the lawfulness of the processing based on the consent given prior to the withdrawal.
9. Rights of the Data Subject
In relation to the Data subject to the processing referred to in this privacy notice, the Data Subject is recognized at any time the right to:
Access: the Data Subject has the right to obtain from the data controller confirmation of whether or not processing of Data concerning them is ongoing and, in such case, to obtain access to the Data and the information of which art. 15 of the GDPR is applicable; in such case, the data controller provides a copy of the Data being processed. In case of further copies requested by the Data Subject, the data controller reserves the right to charge a reasonable fee based on administrative costs.
Rectification and integration (art. 16 GDPR): the Data Subject has the right to obtain from the data controller the rectification of inaccurate Data concerning them without undue delay. Taking into account the purposes of the processing, the Data Subject has the right to obtain the integration of incomplete Data, also by providing a supplementary statement.
Deletion: the Data Subject has the right to obtain from the data controller the deletion of Data concerning them without undue delay, and the data controller has the obligation to delete the Data without undue delay if one of the reasons referred to in art. 17 of the GDPR applies;
Limitation: the Data Subject has the right to obtain from the data controller the limitation of processing when one of the hypotheses referred to in art. 18 of the GDPR applies. If the processing is limited, the Data will be processed, except for storage, only with the consent of the Data Subject or for the assessment, exercise, or defence of a right in a judicial proceeding or to protect the rights of another natural or legal person or for reasons of significant public interest of the Union or a Member State.
Objection to processing (art. 21 GDPR): the Data subject has the right to object at any time, for reasons related to their particular situation, to the processing of Data concerning them under article 6 (1) (f) of the GDPR; in such case, the data controller refrains from further processing the Data unless they demonstrate the existence of compelling legitimate grounds for proceeding with the processing that override the interests, rights, and freedoms of the Data Subject or for the assessment, exercise, or defence of a right in a judicial proceeding;
Withdrawal of consent (art. 7 (3) GDPR): the Data Subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of the processing based on consent before the withdrawal.
10. Methods for exercising rights
The Data Subject may exercise their rights at any time by sending:
registered mail to PHOTO2POST S.r.l. Milan (MI), via Washington 13, 20146;
an email to privacy@photo2post.com
11. Complaint
The Data Subject also has the right to lodge a complaint with a supervisory authority. For Italy, the supervisory authority is the Guarantor for the Protection of Personal Data whose contact details are available on the website www.garanteprivacy.it
12. Updates to the Privacy Policy
This Privacy Policy is subject to occasional revisions. Should changes to processing occur, PHOTO2POST S.r.l. will inform the Data Subject accordingly. Where required by existing law, the Data Subject will have the opportunity to grant their consent to any new processing. In the event of refusal, the data of the Data Subjects will not be processed according to the changes outlined in the Privacy Policy.
Last updated: 11 June 2025
In its capacity as the owner of the website www.photo2post.com (the “Site”), the Photo2Post application (the “Application”) and the data processed for them, PHOTO2POST S.r.l. informs every user of the Site and the Application (hereinafter, the “Data Subject”) that the data provided when accessing the Site and the Application and interacting with them will be processed in accordance with the provisions outlined below.
1. Data controller
The data controller is PHOTO2POST S.r.l. (VAT number 12107710969) based in Milan (MI), via Washington 13, 20146, and registered with the Companies Register of MILANO MONZA BRIANZA LODI under number MI-2641118, email: privacy@photo2post.com (hereinafter the “Controller”).
2. Nature of the data processed
Personal data of the Data Subjects is processed, where personal data refers to any information relating to a natural person, identified or identifiable, even indirectly, by reference to any other information (the “Data”).
PHOTO2POST S.r.l., through the Site and the Application, also collects and records the user’s browsing Data, which allows access to the Site and the Application as well as navigation on them and is used in aggregated and anonymous form for statistical purposes and to verify the correct functioning of the Site and the Application.
In particular, the Data that may be collected include the following:
Contact data: first name, last name, tax code, physical address and email, phone number, mobile number.
Other Data: images of the Data Subject and, if they choose to provide them, place and date of birth.
Economic information about transactions: such as payment methods, information related to purchases made, orders, returns, etc.
Use of the Site and the Application: methods of access and use of the Site and the Application, sending and reading of communications including information collected through cookies (at the following link https://photo2post.com/privacy-policy you can find our Cookie Policy).
3. Purposes of processing and legal basis of processing
The processing carried out using manual, computer and telematic tools with logic strictly related to the purposes and, in any case, in a manner that ensures the security and confidentiality of the Data themselves in compliance with current regulations is aimed at:
1. access and navigation on the Site and the Application, particularly in reserved areas thereof and the establishment and execution of contractual relations and consequent obligations;
2. promotion and sale of the Controller’s services via email, letters, phone, fax, SMS, MMS, internet and other automated and non-automated communication systems;
3. sending newsletters related to the activities carried out by photographers/retouchers;
4. fulfilling obligations provided by law, regulations, European legislation or by an order of the Authority;
5. exercising the rights of the Controller, e.g. the right of defence in court.
4. Legal basis of processing
The processing of the Data for the purpose referred to in art. iii lett. a) above is necessary for the execution of a contract to which the data subject is a party or for the execution of pre-contractual measures pursuant to art. 6 (1) (b) of the GDPR.
The processing of the Data for the purposes referred to in art. iii lett. b) and c) above finds its legal basis in the consent to the processing of one’s Data given by the Data Subject pursuant to art. 6 (1) (a) of the GDPR.
The processing of the Data for the purpose referred to in art. iii lett. d) → legal obligation (art. 6(1)(c))
The processing of the Data for the purpose referred to in art. iii lett. e) → legitimate interest (art. 6(1)(f))
5. Data retention period
The retention of the provided Data will occur for the time necessary to fulfil the purposes described above as well as to comply with legal obligations imposed for the same purposes.
For completeness, we provide below the retention times in relation to the different purposes listed above:
for access and navigation on the Site and the Application: the Data processed for this purpose will be retained for no longer than 5 years from the last activity and/or access to our Site and the Application;
for the establishment and execution of contractual relations and consequent obligations: the Data processed to comply with any contractual obligation will be kept for the duration of the contract and in any case no longer than 10 years for tax and accounting purposes;
for sending the newsletter for informative and promotional purposes: the Data processed for marketing purposes will be kept for 24 months from the date on which the last consent for this purpose was given, except for opposition to receive further communications.
At the end of the Data processing period, the Data will be deleted or rendered permanently anonymous.
6. Communication
The Data processed by the Controller will not be disseminated, meaning it will not be disclosed to unspecified subjects.
The Data may, however, be communicated to employees of the Controller and to some external subjects who collaborate with it, within the limits of the purposes indicated in this privacy notice. Finally, they may be communicated to subjects entitled to access it by virtue of laws, regulations, and norms.
The Data will only be processed by subjects expressly authorized by the Controller or by companies acting as Data Processors on behalf of the Controller, who have signed a specific contract that precisely governs the processing entrusted to them and the obligations regarding data protection.
The list of Data Processors is available at the Controller.
Additionally, the collected Data may be communicated to public or private entities for the fulfilment of obligations provided by law.
7. Discretion or obligation to provide Data and consequences of failing to provide Data
The provision of Data is not mandatory; however, failure to provide the same will result in Data Subjects being unable to access the reserved area and benefit from the services of the Site and the Application.
Therefore, the provision of the Data requested at the time of activating the Services is necessary for the purposes of points iii. lett. a) and d) as it is strictly functional to the performance of the requested Services and compliance with legal obligations. Any refusal to provide the Data will result in the inability for the Controller to provide the requested Services and/or fulfill legal obligations.
The provision of Data for the purpose referred to in point iii lett. b) and c) is optional. However, failure to provide consent will result in the inability to receive the newsletter and/or other promotional material. It is possible to unsubscribe from the newsletter at any time and at no cost.
Regarding the purpose referred to in point iii lett. e), the processing is based on the legitimate interest of the Controller to protect itself in any competent forum.
The processing of data resulting from the use of profiling cookies occurs only with prior consent via a specific banner. For more details, please refer to the Cookie Policy.
8. Withdrawal of consent
The Data Subject has the right to withdraw their consent at any time without affecting the lawfulness of the processing based on the consent given prior to the withdrawal.
9. Rights of the Data Subject
In relation to the Data subject to the processing referred to in this privacy notice, the Data Subject is recognized at any time the right to:
Access: the Data Subject has the right to obtain from the data controller confirmation of whether or not processing of Data concerning them is ongoing and, in such case, to obtain access to the Data and the information of which art. 15 of the GDPR is applicable; in such case, the data controller provides a copy of the Data being processed. In case of further copies requested by the Data Subject, the data controller reserves the right to charge a reasonable fee based on administrative costs.
Rectification and integration (art. 16 GDPR): the Data Subject has the right to obtain from the data controller the rectification of inaccurate Data concerning them without undue delay. Taking into account the purposes of the processing, the Data Subject has the right to obtain the integration of incomplete Data, also by providing a supplementary statement.
Deletion: the Data Subject has the right to obtain from the data controller the deletion of Data concerning them without undue delay, and the data controller has the obligation to delete the Data without undue delay if one of the reasons referred to in art. 17 of the GDPR applies;
Limitation: the Data Subject has the right to obtain from the data controller the limitation of processing when one of the hypotheses referred to in art. 18 of the GDPR applies. If the processing is limited, the Data will be processed, except for storage, only with the consent of the Data Subject or for the assessment, exercise, or defence of a right in a judicial proceeding or to protect the rights of another natural or legal person or for reasons of significant public interest of the Union or a Member State.
Objection to processing (art. 21 GDPR): the Data subject has the right to object at any time, for reasons related to their particular situation, to the processing of Data concerning them under article 6 (1) (f) of the GDPR; in such case, the data controller refrains from further processing the Data unless they demonstrate the existence of compelling legitimate grounds for proceeding with the processing that override the interests, rights, and freedoms of the Data Subject or for the assessment, exercise, or defence of a right in a judicial proceeding;
Withdrawal of consent (art. 7 (3) GDPR): the Data Subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of the processing based on consent before the withdrawal.
10. Methods for exercising rights
The Data Subject may exercise their rights at any time by sending:
registered mail to PHOTO2POST S.r.l. Milan (MI), via Washington 13, 20146;
an email to privacy@photo2post.com
11. Complaint
The Data Subject also has the right to lodge a complaint with a supervisory authority. For Italy, the supervisory authority is the Guarantor for the Protection of Personal Data whose contact details are available on the website www.garanteprivacy.it
12. Updates to the Privacy Policy
This Privacy Policy is subject to occasional revisions. Should changes to processing occur, PHOTO2POST S.r.l. will inform the Data Subject accordingly. Where required by existing law, the Data Subject will have the opportunity to grant their consent to any new processing. In the event of refusal, the data of the Data Subjects will not be processed according to the changes outlined in the Privacy Policy.
Last updated: 11 June 2025
PRIVACY POLICY
PRIVACY POLICY
