Legal notice & privacy

Legal notice

Responsible for this website and the Picolate app.

This translation is provided for convenience — the German version is legally binding.

Provider

Represented by the managing director: Christian Unbehaun
VAT ID: DE264865277

Contact

Email: info@picolate.com
Phone: +49 3643 5443750

Responsible for content pursuant to § 18 (2) MStV

Christian Unbehaun, address as above.

Liability for content and links

The contents of this site were created with the greatest care. However, we cannot guarantee their accuracy, completeness or timeliness. External links were checked at the time of linking; the operators of linked pages are solely responsible for their content.

Privacy

What happens to your data when you visit this website and use the Picolate app.

7. The Picolate app

Picolate is built so your party stays private:

• Shots are uploaded to the gallery on our server in Germany (EU) — this is an integral part of the feature. The gallery can only be reached through a link that cannot be guessed and cannot be found publicly; the host can additionally require a PIN. It is deleted automatically 7 or 30 days after the event ends, depending on the chosen design. On the selfie booth device, the captures remain until the host deletes them; the host is responsible for copies stored there and for any copies they export.
• Test captures: Before buying, you can use “Try it out” to take up to three test captures with a watermark. Like event captures, they are uploaded to our gallery server in Germany (EU), into a test gallery that can only be reached through a link that cannot be guessed (without a PIN). As soon as you start an event, the app deletes the test gallery — if there is no internet connection at that moment, it does so later. If you don’t start an event, the test gallery is deleted automatically no later than 31 days after the first upload. The legal basis is providing the test function you use (Art. 6(1)(b) GDPR).
• When shots are uploaded, a gallery is opened or the app makes a request, our gallery server processes the IP address for technical reasons. It logs it together with the date and time, the address requested, browser type and operating system to keep the service secure and stable, and deletes these logs after 15 days at the latest (Art. 6(1)(f) GDPR). The server and storage are hosted by Hetzner Online GmbH in Germany, which acts as our processor (Art. 28 GDPR).
• When a gallery is opened, our server sets a technically necessary access cookie on the guest’s device. It contains no personal data, serves only to keep access to that one gallery open, and expires with the retention period of the captures. No consent is required for this (Section 25(2) No. 2 TDDDG).
• From the gallery, each guest decides for themselves where to download or forward their shot.
• To improve Picolate, we count on our server how often an event gallery is opened. We store neither IP addresses nor browser data; the gallery link is only recorded as a shortened, pseudonymous checksum from which neither the link nor individual guests can be reconstructed. These counts are deleted automatically after 90 days (Art. 6(1)(f) GDPR).
• Purchased events: So that you can start a purchased event on a later day or on a new device, and so that each single purchase unlocks only one event, the app sends the purchase receipt signed by Apple to our gallery service in Germany (EU) — when you buy, when it looks for a purchase that is already paid for but not yet started, and when the event is started. The receipt contains the details Apple records for the purchase, such as transaction number, product, purchase date, App Store country, price and currency, and identifiers Apple assigns to the purchase, plus the event identifier the app attaches to it — but not your name or email address. We check that the receipt is genuine and then store only a checksum of the transaction number together with the time of the start; we discard all other details immediately. On the first gallery upload of a purchased event, we also store a checksum of the event identifier with the time, because this upload also counts as the start. For events without a single purchase, for example with Picolate Plus, no such entries are created. As long as a purchase has not been started, its entry is kept — a purchase does not expire. After the start, we delete the entries after 90 days. The legal basis is the performance of the contract for your purchase (Art. 6(1)(b) GDPR) and our legitimate interest in preventing a purchase from being used more than once (Art. 6(1)(f) GDPR).
• To help us improve Picolate, the app records pseudonymous usage statistics — such as which setup steps are reached, whether a capture succeeds and whether a purchase is completed (with product, price and transaction number). For this, the app generates a random identifier on first launch; it is neither Apple’s advertising ID nor an identifier of your device, and we never combine it with names, email addresses or accounts. The contents of your captures and free-text entries such as the occasion name are never transmitted. This data is held on our server in Germany (EU), is not shared with third parties and is deleted after 90 days (Art. 6(1)(f) GDPR).

8. Your rights

You have the right to access, rectification, erasure and restriction of the processing of your data, as well as to data portability (Art. 15–20 GDPR). You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Right to object: Where processing is based on our legitimate interest (Art. 6(1)(f) GDPR), you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). An email to info@picolate.com is enough.

Fair use

The cloud gallery is meant for use at real events. The number and size of captures are not strictly limited. In the case of automated or abusive use outside real events — such as sustained mass uploads or downloads — we may set technical limits on storage and traffic for the affected event to keep the service stable for everyone.