Privacy Policy
Last updated: 4 November 2026 - Version 2026-11-04.1 - English translation. Italian original prevails in case of conflict.
Privacy notice pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.
1. Data controller
Pix Service Creative Studios (PixService di Antonio Paolicelli)
P.IVA / VAT: IT01257360774
Registered office: Via Onofrio Tataranni 38, 75100 Matera (MT), Italy
Email: privacy@pixservice.it
General assistance: info@pixservice.it
No DPO has been designated (not mandatory for our activity volume).
2. Data we process
| Category | Examples |
|---|---|
| Contact data | Email, name, phone |
| Postal address | Street, city, ZIP, province (only for shipping) |
| Biometric images | Face photo for ID purposes |
| Payment data | Card data — handled directly by Stripe, never stored on our servers |
| Technical data | IP address, access logs (retained 30 days) |
| Reviews | Stars, text, name and city chosen by the customer, only if they decide to leave a review |
Face photos are "biometric data" pursuant to Art. 9 GDPR (special category). Processing happens exclusively for the service requested by the data subject (Art. 9.2.b combined with explicit consent collected at checkout).
3. Purposes and legal bases
- Contract performance (Art. 6.1.b): photo processing, payment, printing, pickup or shipping.
- Legal obligation (Art. 6.1.c): retention of accounting and tax documents.
- Legitimate interest (Art. 6.1.f): technical logs for security, fraud prevention, anti-abuse. After delivery we send one single email asking for feedback on the service: just ignore it, we send no more. If the payment of an order is not completed, we send one single email to resume it with the photo already uploaded; if ignored, the photo is deleted within the times in section 4.
- Consent (Art. 6.1.a) to publish a review: it appears on pixpass.it only after we have read it, with the name and city written by the customer, and is removed on request (see your rights in section 7).
- Consent (Art. 6.1.a + 9.2.a): processing of biometric data and, optionally, marketing communications and Meta (Pixel) marketing cookies, see the Cookie policy. Cookie consent can be withdrawn via "Cookie preferences" at the bottom of any page.
4. Retention periods
| Data | Retention |
|---|---|
| Digital photo file (download) | 24 hours after first download (max 7 days from payment if never downloaded) |
| Printed photo file (pickup/shipping orders) | 90 days from order completion |
| Photo files of unpaid or cancelled orders | Up to 7 days after cancellation, so that an order paid but not recorded because of a technical error can be recovered; then deleted automatically |
| Order metadata (DB) | 10 years for tax obligations |
| Stripe webhook log | 30 days |
| Application error logs | 30 days |
| Customer IP address | 30 days, then anonymized |
| Reviews | Until the customer asks for deletion |
5. Recipients and external processors
Data may be communicated to the following processors appointed under Art. 28 GDPR:
- Stripe Payments Europe Ltd (Ireland) — payment processing. Stripe DPA. Transfer to USA covered by Data Privacy Framework + Standard Contractual Clauses.
- Cloudflare, Inc. (USA) — optional automatic background removal, activated only at the user's request (or, in our shop, by our staff). The photo is processed by Cloudflare's network and returned immediately without its background: our service at Cloudflare neither stores nor logs it. Cloudflare DPA. Transfer to USA covered by Data Privacy Framework + Standard Contractual Clauses.
- Photoroom SAS (Paris, France) — automatic background removal, used only as a fallback when the main service does not respond. The provider states that images received through its API are neither stored nor used to improve its models. Processing takes place on infrastructure in the United States, with the appropriate safeguards under the GDPR described in the provider's privacy policy.
- Aruba S.p.A. (Italy) — web hosting, SMTP email server, MySQL database.
Meta Platforms Ireland Ltd (Ireland) — only if you accept marketing cookies: browsing data collected by the Meta Pixel, as joint controllers for collection and transmission. Photos and order data are never sent to Meta. Details in the Cookie policy.
6. Non-EU transfers
To Stripe Payments (USA) and, only with marketing-cookie consent, to Meta (USA), protected by Data Privacy Framework + EU Standard Contractual Clauses. If you use background removal, the photo may be processed outside the EU by Cloudflare (USA, Data Privacy Framework + SCC) and, only if the main service does not respond, by Photoroom (infrastructure in the USA, appropriate safeguards under the GDPR). No other extra-EU transfers.
7. Your rights
Pursuant to Articles 15-22 GDPR you have the right to:
- Access (Art. 15): obtain confirmation that processing is taking place and a copy of your data.
- Rectification (Art. 16): correct inaccurate or incomplete data.
- Erasure (Art. 17, "right to be forgotten"): request deletion, subject to legal retention obligations.
- Restriction (Art. 18): restrict processing in specific circumstances.
- Portability (Art. 20): receive your data in a structured, machine-readable format.
- Objection (Art. 21): object to processing based on legitimate interest or carried out for marketing purposes.
- Withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.
Exercise these rights by writing to privacy@pixservice.it. Reply within 30 days (extendable to 60 in complex cases).
You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or your local supervisory authority.
8. Automated decision-making
The service does not perform automated decision-making or profiling producing legal effects. The automatic photo quality checks (brightness, sharpness, background) are informative only.
9. Provision of data
Providing the data requested at checkout is necessary in order to deliver the service. Failure to provide it makes it impossible to complete the order.
10. Security measures
Adequate technical and organizational measures (Art. 32 GDPR): HTTPS/TLS 1.2+, bcrypt admin passwords, pseudonymized order tokens, rate limiting, automatic backups, time-based file deletion.
11. Children's data
The service is intended for adults. Orders including ID photos of minors, for example within the Family Package, must be placed exclusively by the parent holding parental responsibility or by the legal guardian, who provides consent to the processing of the minor's biometric data pursuant to Art. 8 GDPR and Art. 2-quinquies of Italian Legislative Decree 196/2003.
The same retention periods, purposes and security measures described in the previous sections apply to minors' data. No profiling is carried out and no disclosure to third parties takes place other than those listed in section 5.
The parent or guardian may exercise the rights under Articles 15-22 GDPR on behalf of the minor at any time by writing to privacy@pixservice.it.
12. Changes
Changes to this notice will be published here with updated date and version.
PixPass - Pix Service Creative Studios - Matera, Italy