Privacy Policy

Last updated: May 8, 2026.

INTRODUCTION

This privacy notice explains how Paparazzi S.à r.l.-S (“ Paparazzi ”, “ we ”, “ us ”, “ our ”) processes personal data when you:

visit our Website or any website of ours that links to this privacy notice;
download and use our mobile application (“Paparazzi”) or any other application of ours that links to this privacy notice;
engage with us in other related ways, including any marketing or events.

We act as the Data Controller under the General Data Protection Regulation (“GDPR”).

If you do not agree with this privacy notice, please refrain from using our services.

For any questions, contact: privacy@paparazzi.global.

DATA CONTROLLER
PERSONAL DATA WE PROCESS
PURPOSES AND LEGAL BASES FOR PROCESSING
SHARING PERSONAL DATA
INTERNATIONAL TRANSFERS (OUTSIDE THE EU/EEA)
RETENTION PERIODS
YOUR RIGHTS
COOKIES & TRACKING TECHNOLOGIES
CONTROLS FOR DO-NOT-TRACK FEATURES
AUTOMATED SYSTEMS
DATA SECURITY
CHANGES TO THIS NOTICE
CONTACT

1. DATA CONTROLLER

Company: Paparazzi S.à r.l.-S

Registered address: 33, Rue Evy Friedrich, L1552 Luxembourg

Legal representative: Mr. Simone ETERNO

Data Protection Officer (“DPO”): not appointed (not legally required under GDPR, art. 37).

2. PERSONAL DATA WE PROCESS

DATA YOU PROVIDE

We collect personal information that you voluntarily provide to us when you register on the services, express an interest in obtaining information about us or our products and services, when you participate in activities on the services or otherwise when you contact us.

The personal information that we collect depends on the context of your interactions with us and the services, the choices you make and the products and features you use.

The personal information we collect may include the following:

identification data: name, surname;
contact data: email address, phone number;
payment data (tokenized): last 4 digits, brand, expiry date, cardholder name:
- we do not access or store full card numbers;
- all full payment information is processed exclusively by Stripe (pcidss level 1);
- Stripe acts as an independent data controller for payment processing;
account data: login credentials, preferences;
social login data: public profile information from Meta (Facebook Login), X or other thirdparty providers (as authorized through your settings);
- you may withdraw consent at any time by disconnecting social login.

If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

Geolocation information: we may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services.
If you wish to change our access or permissions, you may do so in your device's settings.
Push notifications : we may request to send you push notifications regarding your account or certain features of the application(s).
If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, accurate and you must notify us of any changes to such personal information.

AUTOMATICALLY COLLECTED DATA

Like many businesses, we also collect information through cookies and similar technologies. The information we collect includes:

Log and usage data: log and usage data is service-related, diagnostic, usage and performance information our servers automatically collect when you access or use our services and which we record in log files.
Depending on how you interact with us, this log data may include your IP address, device information, browser type and settings and information about your activity in the services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps") and hardware settings).
Device data: we collect device data such as information about your computer, phone, tablet or other device you use to access the services.
Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system and system configuration information.
Location data: we collect location data such as information about your device's location, which can be either precise or imprecise.
How much information we collect depends on the type and settings of the device you use to access the services.
For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address).
You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device.
However, if you choose to opt out, you may not be able to use certain aspects of the services.
Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

3. PURPOSES AND LEGAL BASES FOR PROCESSING

Under the GDPR (art. 6), we must identify a legal basis for each processing activity:

Purpose of processing Examples Legal basis (GDPR)
Account creation and authentication	Creating a user account	art. 6(1)(b) – Contract
Service provision	Facilitating bookings and communication	art. 6(1)(b) – Contract
Payments	Stripe payment processing	art. 6(1)(b) – Contract
Marketing communications	Email offers, promotions	art. 6(1)(a) – Consent
Security and fraud prevention	Detecting suspicious activity	art. 6(1)(f) – Legitimate interest
Analytics & service improvement	Traffic, performance metrics	art. 6(1)(f) – Legitimate interest
Compliance with law	Accounting, legal obligations	art. 6(1)(c) – Legal obligation
Social login functionality	Profiling data from social platforms	art. 6(1)(a) – Consent

We do not process sensitive data (GDPR, art. 9).

4. SHARING PERSONAL DATA

We may share information in specific situations described in this section and/or with the following categories of third parties.

We may share your data with third-party vendors, service providers, contractors or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work.

SERVICE PROVIDERS (PROCESSORS)

Our service providers include:

payment processors (Stripe);
ad networks;
website hosting service providers;
analytics providers (Google Analytics);
user account registration & authentication services;
sales & marketing Tools;
social networks.

BUSINESS TRANSFERS

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business to another company.

OTHER USERS (PUBLIC INTERACTIONS)

When you share personal information (for example, by posting comments, contributions or other content to the services) or otherwise interact with public areas of the services, such personal information may be viewed by all users and may be publicly made available outside the services in perpetuity.

If you interact with other users of our services and register for our services through a social network (such as Facebook), your contacts on the social network will see your name, profile photo and descriptions of your activity.

Similarly, other users will be able to view descriptions of your activity, communicate with you within our services and view your profile.

5. INTERNATIONAL TRANSFERS (OUTSIDE THE EU/EEA)

We are connected to Google Analytics to gather information on the website traffic.

Besides google, no other information will be transferred outside the EU/EEA.

6. RETENTION PERIODS

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements).

No purpose in this notice will require us to keep your personal information for longer than the period in which users have an account with us.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

7. YOUR RIGHTS

You may exercise the following rights:

access (GDPR, art. 15);
rectification (GDPR, art. 16);
erasure / “right to be forgotten” (GDPR, art. 17);
restriction (GDPR, art. 18);
data portability (GDPR, art. 20);
objection to processing (GDPR, art. 21);
withdraw consent anytime (GDPR, art. 7)
- however, please note that this will not affect the lawfulness of the processing before its withdrawal nor will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent;
not to be subject to automated decision-making (GDPR, art. 22).

To exercise your rights: privacy@paparazzi.global. We will consider and act upon any request in accordance with applicable data protection laws.

You also have the right to lodge a complaint with:

Commission Nationale pour la Protection des Données ( “ CNPD ” )
L-4370 Belvaux, 15, Boulevard du Jazz
www.cnpd.lu
any other competent EU or UK supervisory authority
if you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1 Switzerland - 3003 Berne
www.edoeb.admin.ch

Concerning our marketing and promotional communications, you can withdraw your consent at any time by clicking on the unsubscribe link in the emails that we send or by contacting us using the details provided in this section.

You will then be removed from the marketing lists.

However, we may still communicate with you to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests or for other non-marketing purposes.

If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases.

However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

8. COOKIES & TRACKING TECHNOLOGIES

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our services.

Some online tracking technologies help us maintain the security of our services and your account, prevent crashes, fix bugs, save your preferences and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests or to send abandoned shopping cart reminders (depending on your communication preferences).

The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our services or on other websites.

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

Most web browsers are set to accept cookies by default.

If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies.

If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services.

We may share your information with Google Analytics to track and analyze the use of the services.

The Google Analytics Advertising Features that we may use include:

remarketing with Google Analytics;
Google display network impressions reporting ;
Google Analytics demographics and interests reporting.

To opt out of being tracked by Google Analytics across the services, visit https://tools.google.com/dlpage/gaoptout.

You can opt out of Google Analytics advertising features through Ads Settings and Ad Settings for mobile apps.

Other opt out means include http://optout.networkadvertising.org/ and http://www.networkadvertising.org/mobile-choice.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized.

As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

10. AUTOMATED SYSTEMS

We use a limited recommendation algorithm that highlights popular or highly rated photography services within specific geographic areas.

This functionality is based on marketplace activity metrics (e.g., bookings, ratings, location).

We do not use scoring (besides client reviews) or moderation systems.

11. DATA SECURITY

We implement appropriate technical and organizational measures to protect personal data and ensure its confidentiality, integrity and availability.

These measures include:

Encrypted transmission: all data exchanged with our platform is protected using HTTPS/TLS to prevent interception or unauthorized access.
Encryption at rest: databases, file storage and backups hosted on AWS are encrypted using AWSmanaged encryption mechanisms.
Access control: user access within the platform is restricted through rolebased permissions.
Administrative and server access is tightly controlled via AWS Identity & Access Management (IAM).
Secure authentication: passwords are hashed and sessions are securely managed.
Application security: the platform is developed following OWASP best practices, including input validation, protection against SQL injection, XSS, CSRF and secure session handling.
Infrastructure security: hosting is provided by AWS EC2, with network protections such as AWS Security Groups, firewalls and DDoS protection (AWS Shield).
Backups & recovery: encrypted automated backups are maintained to ensure data recovery in case of incidents.
Monitoring & logging: server and application activity is logged and monitored to support security incident detection and response.

We regularly review and update our security measures to maintain a high level of protection for personal data.

12. CHANGES TO THIS NOTICE

We may update this privacy notice from time to time.

The updated version will be indicated by an updated "revised" date at the top of this privacy notice.

If we make material changes to this privacy notice, we may notify you either by prominently posting notice of such changes or by directly sending you a notification.

We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

13. CONTACT