Privacy Policy
Last updated: 16 September 2026 - Version 2026-09-16.2 - English translation. Italian original prevails in case of conflict.
Privacy notice pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.
1. Data controller
Pix Service Creative Studios (PixService di Antonio Paolicelli)
P.IVA / VAT: IT01257360774
Registered office: Via Onofrio Tataranni 38, 75100 Matera (MT), Italy
Email: privacy@pixservice.it
General assistance: info@pixservice.it
No DPO has been designated (not mandatory for our activity volume).
2. Data we process
| Category | Examples |
|---|---|
| Contact data | Email, name, phone |
| Postal address | Street, city, ZIP, province (only for shipping) |
| Biometric images | Face photo for ID purposes |
| Payment data | Card data — handled directly by Stripe, never stored on our servers |
| Technical data | IP address, access logs (retained 30 days) |
Face photos are "biometric data" pursuant to Art. 9 GDPR (special category). Processing happens exclusively for the service requested by the data subject (Art. 9.2.b combined with explicit consent collected at checkout).
3. Purposes and legal bases
- Contract performance (Art. 6.1.b): photo processing, payment, printing, pickup or shipping.
- Legal obligation (Art. 6.1.c): retention of accounting and tax documents.
- Legitimate interest (Art. 6.1.f): technical logs for security, fraud prevention, anti-abuse.
- Consent (Art. 6.1.a + 9.2.a): processing of biometric data and, optionally, marketing communications and Meta (Pixel) marketing cookies, see the Cookie policy. Cookie consent can be withdrawn via "Cookie preferences" at the bottom of any page.
4. Retention periods
| Data | Retention |
|---|---|
| Digital photo file (download) | 24 hours after first download (max 7 days from payment if never downloaded) |
| Printed photo file (pickup/shipping orders) | 90 days from order completion |
| Photo files of unpaid or cancelled orders | Up to 7 days after cancellation, so that an order paid but not recorded because of a technical error can be recovered; then deleted automatically |
| Order metadata (DB) | 10 years for tax obligations |
| Stripe webhook log | 30 days |
| Application error logs | 30 days |
| Customer IP address | 30 days, then anonymized |
5. Recipients and external processors
Data may be communicated to the following processors appointed under Art. 28 GDPR:
- Stripe Payments Europe Ltd (Ireland) — payment processing. Stripe DPA. Transfer to USA covered by Data Privacy Framework + Standard Contractual Clauses.
- remove.bg — Kaleido AI GmbH (Vienna, Austria — EU) — optional automatic background removal, activated only at the user's request. According to the provider's privacy policy, uploaded images and processed results are retained for a maximum of 60 minutes, the time needed to complete processing, and deleted afterwards. Processing takes place entirely within the European Union.
- Aruba S.p.A. (Italy) — web hosting, SMTP email server, MySQL database.
Meta Platforms Ireland Ltd (Ireland) — only if you accept marketing cookies: browsing data collected by the Meta Pixel, as joint controllers for collection and transmission. Photos and order data are never sent to Meta. Details in the Cookie policy.
6. Non-EU transfers
To Stripe Payments (USA) and, only with marketing-cookie consent, to Meta (USA), protected by Data Privacy Framework + EU Standard Contractual Clauses. No other extra-EU transfers.
7. Your rights
Pursuant to Articles 15-22 GDPR you have the right to:
- Access (Art. 15): obtain confirmation that processing is taking place and a copy of your data.
- Rectification (Art. 16): correct inaccurate or incomplete data.
- Erasure (Art. 17, "right to be forgotten"): request deletion, subject to legal retention obligations.
- Restriction (Art. 18): restrict processing in specific circumstances.
- Portability (Art. 20): receive your data in a structured, machine-readable format.
- Objection (Art. 21): object to processing based on legitimate interest or carried out for marketing purposes.
- Withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.
Exercise these rights by writing to privacy@pixservice.it. Reply within 30 days (extendable to 60 in complex cases).
You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or your local supervisory authority.
8. Automated decision-making
The service does not perform automated decision-making or profiling producing legal effects. The automatic photo quality checks (brightness, sharpness, background) are informative only.
9. Provision of data
Providing the data requested at checkout is necessary in order to deliver the service. Failure to provide it makes it impossible to complete the order.
10. Security measures
Adequate technical and organizational measures (Art. 32 GDPR): HTTPS/TLS 1.2+, bcrypt admin passwords, pseudonymized order tokens, rate limiting, automatic backups, time-based file deletion.
11. Children's data
The service is intended for adults. Orders including ID photos of minors, for example within the Family Package, must be placed exclusively by the parent holding parental responsibility or by the legal guardian, who provides consent to the processing of the minor's biometric data pursuant to Art. 8 GDPR and Art. 2-quinquies of Italian Legislative Decree 196/2003.
The same retention periods, purposes and security measures described in the previous sections apply to minors' data. No profiling is carried out and no disclosure to third parties takes place other than those listed in section 5.
The parent or guardian may exercise the rights under Articles 15-22 GDPR on behalf of the minor at any time by writing to privacy@pixservice.it.
12. Changes
Changes to this notice will be published here with updated date and version.
PixPass - Pix Service Creative Studios - Matera, Italy