This Privacy Policy applies to piqura.com and its subdomains (weddings.piqura.com, journeys.piqura.com, and others), as well as all Piqura services. It describes how ES Contracting and Procurement ("we", "us", "our") collects, uses, stores, and protects your personal information, and explains your rights under applicable law including the EU General Data Protection Regulation (GDPR).

1. Definitions

"Personal data" means any information that can identify you as an individual - such as your name, email address, IP address, device information, or uploaded content linked to you.

"Organiser" means a person who creates a Piqura event. "Member" means a person who accesses an event as a guest to upload or view photos.

2. Data We Collect

We collect the minimum data necessary to provide the service:

• Information you provide: Your name (optional) when uploading photos, and your email address if you contact us directly.
• Uploaded content: Photos and videos uploaded by Members during an event. GPS coordinates and device metadata (EXIF data) are automatically stripped from all photos on upload and are never stored.
• Technical data: IP address, browser type, and basic usage data collected automatically when you access our services. This is used solely for security and performance monitoring.
• Event data: Event names, dates, and locations entered by Organisers when creating an album.

We do not collect payment information directly - this is handled by our payment provider when paid plans are introduced.

3. How We Use Your Data

We use personal data only for the following purposes:

• Providing the Piqura service - storing and displaying uploaded photos within a private event
• Operating the moderation and approval system
• Responding to support requests and enquiries
• Security monitoring and preventing abuse
• Complying with legal obligations

We do not use your data for advertising, profiling, or any automated decision-making. We do not sell or share your personal data with third parties, except where required by law.

4. Legal Basis for Processing (GDPR)

We process personal data on the following legal bases:

• Contract performance: To provide the service you have requested
• Legitimate interests: For security monitoring and service improvement
• Consent: Where you have explicitly agreed, such as when uploading photos with the consent checkbox
• Legal obligation: Where required by applicable law

5. Data Retention and Auto-Deletion

Piqura is designed to minimise data retention:

• All photos, videos, and event data are automatically and permanently deleted at the end of each event's retention window (typically 7-90 days depending on event type)
• Organisers are responsible for downloading their content before the retention period expires
• Contact information provided via email enquiries is retained only as long as necessary to resolve the matter
• Technical logs are retained for a maximum of 30 days

You may request full deletion of your data at any time by emailing info@smilen.nl.

6. Data Security

We take the security of your data seriously:

• All data is transmitted over HTTPS (TLS encryption)
• Photos are stored in a private, access-controlled environment - not publicly accessible by URL alone
• GPS and device metadata is stripped from every photo on upload
• Event access requires a QR code or magic link; photos require moderation approval before other guests can see them
• Access to personal data is restricted to authorised personnel bound by confidentiality obligations

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request that we limit how we use your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at info@smilen.nl. We aim to respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

8. Cookies

Piqura uses only a single session cookie to maintain your logged-in state within an event. We do not use tracking cookies, advertising cookies, or third-party analytics.

9. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices or content. We encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date. Where we hold your email address and the changes are significant, we will notify you directly.

12. Contact and Data Controller

The data controller for all Piqura services is:

ES Contracting and Procurement
Populierendreef 970-125
2273 HW Voorburg
The Netherlands
info@smilen.nl