Privacy Policy

1. Data Controller

Pannben Foto (The data controller is an individual operating in a private, non-commercial capacity)

Gothenburg, Sweden

hello at pannbenfoto dot com (remove spaces and replace at and dot with corresponding characters).

Contact can also be made through email form on pannbenfoto.com/contact/

2. Data Processor

Photohawk

CLOUDCONCUR LTD, 2 Rowanfields, Freiston, Boston, Lincolnshire PE22 0NP

support (at) photohawk dot com (remove spaces and replace at and dot with corresponding characters).

Photohawk’s Privacy Policy can be reviewed on photohawk.com.

3. Responsibilities

Pannben Foto (Data Controller) is responsible for:

• Establishing an appropriate lawful basis for taking, displaying and selling photos
• Ensuring participants are provided with suitable privacy information
• Explaining the use of facial recognition and selfie search
• Responding to data-subject requests
• Determining appropriate retention periods
• Obtaining any permissions or consents required for events and jurisdiction

Photohawk (Data Processor) is responsible for:

• Operating the Photohawk service
• Administering accounts
• Preventing fraud
• Processing payments
• Complying with legal obligations

4. What Personal Data Do We Process?

Pannben Foto processes digital photographs captured during public sporting events or events of related nature. These photos may contain identifiable individuals, clothing/gear details, and event bib numbers. Pannben Foto does not knowingly process data or photos of children or vulnerable participants without relevant consent.

Photohawk services enable facial recognition from photos. The system analyses visible facial characteristics and converts them into a numerical representation, sometimes referred to as a face vector or embedding. That representation is compared with those generated from photos from the same event galleries to identify visually similar faces. The facial recognition system is enabled to allow participants to conveniently find all photos they feature in. It is not able to or intended to identify a participant by name or search across multiple event galleries. A facial representation may constitute personal data under GDPR. When a photo is deleted, Photohawk does not retain the deleted photo or continue to persist facial-search data derived from it.

A complementary and optional feature of the service is to search for participant photos by uploading a picture (“selfie-search”). The participant’s selfie is used only for the purpose of conducting the requested search within the relevant event gallery. Neither Pannben Foto or Photohawk persist or retain the selfie after it has been used for that search.

5. Legal Basis for Processing

Photos are processed based on Legitimate Interest according to Article 6.1 (f) of the GDPR. A Legitimate Interest Assessment (LIA) is available upon request by relevant authorities.

Pannben Foto’s legitimate interest is to operate a photography service by providing participants with souvenir photos from the event. Since these events take place in public spaces and mostly within a sporting context, Pannben Foto’s assessment is that participants have a reasonable expectation of being photographed, and that this processing does not infringe upon their fundamental right to privacy.

6. Data Retention

Digital photos featuring identifiable individuals are securely stored and handled on non-networked drives and within the event galleries provided by Photohawk. Photohawk uses encryption both at rest and in transit. Photohawk also apply access controls and other technical and organisational safeguards intended to prevent unauthorised access, loss, alteration or disclosure of data.

Photos are retained indefinitely to allow participants long-term access to viewing and purchasing their photos. Factors that can lead to removal includes, but are not limited to, constraints on storage space, request for deletion, or reduced participant interest. Pannben Foto may at any point remove photos without notification. At the point of removal, photos are permanently deleted from the servers and any potential retention beyond that will only occur on non-networked physical drives.

7. Your Rights and the Right to be Forgotten (Opt-out)

Under the GDPR, you have the right to know if you appear in our photos, as well as the right to request the deletion of your data.

Where possible, participants are informed before the event by the event organiser. Furthermore, participants are informed at the event through physical signage of ongoing photography with a clear reference to Pannben Foto. Where signage has been deemed insufficient to clearly display photography zones, photos are made available only after the event organiser has made a reasonable attempt at informing participants post-event.

Participants may at any time request deletion of photos they feature in by contacting Pannben Foto stating the specific event and relevant photo/person identifiers (such as bib number, file names or example photo). Pannben Foto will be expeditiously remove the photos from our systems with no questions asked (unless follow-up questions are required to confirm which photos are to be removed).