Privacy Policy

[LEGAL REVIEW] This privacy policy is a placeholder draft and must be reviewed by a lawyer and adapted to the actual processing activities, service providers and retention periods before go-live.

1. Controller

Vorster Consulting GmbH, Musterstraße 1, 12345 Musterstadt, Germany · datenschutz@pickudu.com. [LEGAL REVIEW]

2. What data we process

• Purchase & account data: name, billing address, e-mail, order history, payment status (no full payment details – these go directly to the payment provider). Legal basis: performance of contract, Art. 6(1)(b) GDPR; retention under tax law pursuant to § 147 AO (German Fiscal Code).
• Uploaded media: photos that you or your guests upload as part of an event. They are stored for the duration of the booked package and deleted afterwards. Legal basis: Art. 6(1)(b) GDPR.
• Contact requests: the data in your message, stored as long as needed to handle your request. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Server logs: IP address, timestamp, requested URL, user agent – kept briefly for security and error analysis. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

3. Hosting and storage location

Our application and the uploaded media are hosted on servers within the European Union. Photos are stored in an EU bucket on Google Cloud Storage (region within the EU). Data processing agreements pursuant to Art. 28 GDPR are in place with our processors. Transfers to third countries only take place if the legal requirements are met. [LEGAL REVIEW]

4. Cookies and local storage

We only use technically necessary cookies (e.g. session and shopping cart). Your cookie preferences are stored in your browser's local storage. External media is only loaded after your consent. There is no tracking and no third-party analytics. Legal basis for necessary storage: § 25(2) TTDSG; otherwise your consent under Art. 6(1)(a) GDPR, revocable at any time via "Cookie settings" in the footer.

5. Recipients

Order data is shared with service providers only where necessary for the performance of the contract: payment providers and our hosting provider (EU data center). We do not sell personal data.

6. Storage period

We store personal data only as long as necessary for the stated purposes or as required by statutory retention periods. Uploaded media is deleted after the event package expires.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw any consent you have given with effect for the future. To do so, contact datenschutz@pickudu.com. You also have the right to lodge a complaint with a data protection supervisory authority.