Last updated: 2 September 2026
At FotoHook we process personal data every day: yours, if you are a photographer with an account, and that of the people who appear in the photographs. This policy explains what we do with each type of data, why we are allowed to do it, and how you can control it. It is written to be understood; if anything is unclear, write to us and we will explain it.
| Controller | APLICACIONES SAAS IBÉRICA, S.L. (Sole-Shareholder Company) — "FotoHook" |
|---|---|
| Tax ID (NIF) | B93773620 |
| Address | Avenida Cañada de los Fenicios, Aldea 5, Casa 24 — 18150 Gójar (Granada), Spain |
| Privacy contact | hola@fotohook.com |
| Data Protection Officer | Appointment is not required (art. 37 GDPR and art. 34 LOPDGDD, the Spanish Data Protection Act). Privacy enquiries are handled at the address above. |
Depending on which data we are talking about, FotoHook holds a different legal position:
In practice: if you want your photos removed from a gallery, the fastest route is through the photographer. If they do not respond, write to us and we will forward your request and help you exercise your rights.
| Purpose | Data | Legal basis | Retention | Recipients |
|---|---|---|---|---|
| Handling your request for a demo or for information | Name, email, telephone number, type of work, message, IP address and date sent | Pre-contractual measures taken at the data subject's request (art. 6.1.b GDPR). To later send you commercial information, your consent (art. 6.1.a GDPR and art. 21 LSSI) | 1 year from the last contact, unless you subscribe to the service | Our hosting and email provider |
| Creating and managing your photographer account and providing the service | Name, email, encrypted password, gallery name, logo, watermark and settings | Performance of the contract (art. 6.1.b GDPR) | While the account remains active and for a further 3 years (statute of limitations for legal claims) | Hosting provider |
| Charging the subscription and issuing invoices | Identification and tax data, amounts, plan, payment references | Performance of the contract (art. 6.1.b) and legal accounting and tax obligations (art. 6.1.c) | 6 years (art. 30 of the Spanish Commercial Code) and 4 years for tax purposes | Stripe Payments Europe, Ltd. and our accountancy firm |
| Handling your queries and support tickets | Subject, message, priority, history and associated account | Performance of the contract (art. 6.1.b) | 3 years from the closing of the ticket | Hosting provider |
| Platform security, traceability and prevention of unauthorised access | IP address, browser, action performed and date; failed login attempts | Legitimate interest in network and information security (art. 6.1.f and recital 49 GDPR) | 12 months | Hosting provider |
| Making the website work: session, cart and form protection | Session identifier and security token | Exception under art. 22.2 LSSI and legitimate interest (art. 6.1.f) | The browser session | No one |
| Recording your cookie decision | Anonymous identifier, categories accepted, policy version, browser, pseudonymised IP address and date | Obligation to be able to demonstrate consent (art. 7.1 GDPR) | 24 months | Hosting provider |
In these cases the controller is the photographer or studio who manages the gallery. They decide the retention periods and purposes; we carry out their instructions.
| Purpose | Data | Controller's legal basis | Retention |
|---|---|---|---|
| Giving you access to your private gallery | First name, surname, email, encrypted password, access code, IP address and registration date | Performance of the contract between the photographer and you (art. 6.1.b) | While the gallery remains active |
| Hosting and delivering your photographs to you | The images you appear in and their technical data | Performance of the contract and the image-use authorisation obtained by the photographer (Organic Law 1/1982) | As instructed by the photographer |
| Selling photographs and managing orders and downloads | Cart, orders, amounts, authorised downloads | Performance of the contract (art. 6.1.b) | 6 years, under the photographer's accounting obligations |
| Gallery statistics for the photographer | Photos viewed, favourites, votes, IP address | The photographer's legitimate interest in understanding how their gallery is used (art. 6.1.f) | 12 months |
| School class composites ("orlas"): registration, student photo and template voting | First name, surname, email, photograph, image-use authorisation with date and IP address, vote cast | Explicit consent (art. 6.1.a) and, if under 14, that of their father, mother or guardian (art. 8 GDPR and art. 7 LOPDGDD) | 5 years, or until consent is withdrawn |
The class composite ("orla") module is designed for schools, so we are especially strict here:
We do not sell or share personal data. Only the providers we need to deliver the service have access to it, each under a signed data processing agreement (art. 28 GDPR):
| Provider | What for | Where |
|---|---|---|
| Dinahosting, S.L. | Hosting of the website, database and email | Spain (EU) |
| Stripe Payments Europe, Ltd. | Charging subscriptions and, if activated by the photographer, the sale of photos | Ireland (EU), with access from the United States by Stripe, Inc. |
| Redsys Servicios de Procesamiento, S.L. | The photographer's bank payment gateway, when used | Spain (EU) |
| Google Ireland Ltd. / Google LLC | Email through which we receive demo request notices; protection of the contact form against spam (reCAPTCHA v3); aggregated measurement of website usage (Google Analytics 4) and, if you accept the external content cookies, playback of YouTube help videos | Ireland (EU) and the United States |
| Aplicaciones SaaS Ibérica, S.L. (in-house CRM) | Sales management of demo requests received through the form | Spain (EU) |
We may also disclose data to law enforcement authorities, the courts or public administrations where there is a legal obligation to do so.
All platform information is hosted on servers located in Spain. Transfers outside the European Economic Area only occur in two cases: Stripe, Inc.'s access to payment data, and the use of Google for email, for anti-spam protection of the contact form (reCAPTCHA v3), for website usage analytics and, if you accept them, for the help videos. Both providers are certified under the EU-US Data Privacy Framework and also apply the standard contractual clauses approved by the European Commission. You can request a copy of those safeguards by writing to hola@fotohook.com.
We do not build profiles or make automated decisions that produce legal effects concerning you. Nor do we apply facial recognition or any technique that turns your photograph into biometric data.
You can exercise the following rights at any time:
How to exercise them: write to hola@fotohook.com stating which right you wish to exercise and attaching a copy of your ID document, or any other means that allows us to verify your identity. You can also do so by post to the address in section 1. It is free of charge.
Timeframe: we will respond within one month of receiving your request, extendable by a further two months if the request is complex, in which case we will let you know.
If your request relates to photographs or galleries belonging to a specific photographer, we will forward it to them, as the controller, and let you know that we have done so.
Complaint: if you consider that we have not properly handled your request, you can lodge a complaint with the Spanish Data Protection Agency, the AEPD (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid. We would appreciate the chance to resolve it first.
We apply technical and organisational measures appropriate to the risk (art. 32 GDPR): encryption of communications with HTTPS/TLS, passwords stored using irreversible hash functions, CSRF protection for forms, login attempt limits, role-based access control, and photographs stored outside the server's public directory, so they are only served to authorised users. If a security breach occurs that poses a risk to your rights, we will notify you and report it to the AEPD within 72 hours.
The use of cookies and similar technologies is explained in detail in the Cookie policy, where you can also change your decision at any time.
If we amend this policy, we will update the date shown at the top and, when the change is significant, we will notify you by email or through a notice on the platform before it takes effect.