Data processing (DPA)
| Who | Responsible for | |
|---|---|---|
| Controller | The photographer | Deciding which photos are uploaded, who gets access and for how long; informing clients; labels on access passwords. |
| Processor | picsme | Storing and showing the photos and access data only on the photographer’s instructions, as given through the product. |
| Subprocessors | Providers that host and deliver the service | Categories: Subprocessors. The full list on request; a new subprocessor is announced in advance. |
Subject of processing
Section titled “Subject of processing”- Data: photos uploaded by the photographer; labels of access passwords; per-access counters (opens, downloads) and the client’s selection of photos. No client accounts, names or emails.
- Purpose: delivering galleries to the photographer’s clients.
- Duration: while the gallery exists. Deleted data disappears from the service immediately, photo files within a day, database backups within 30 days.
- Location: servers in a data centre in the EU (France); encrypted database backups in the EU. See Where photos are stored.
Security measures (summary)
Section titled “Security measures (summary)”Encrypted connections (TLS all the way to the server); unpredictable gallery addresses and passwords; limits on password guessing; isolated containers with no open ports; encrypted backups; logs without IP addresses (except the address of a rejected burst of sign-in attempts, kept briefly in a local security log), passwords or request contents, size-limited and overwritten automatically. Files on the server’s disk are not encrypted at rest.