Fotografiska Emerging

Privacy policy

1. SCOPE

With the following Privacy Notice we, Fotografiska Emerging GmbH (hereinafter "Operator", "we" or "us"), like to inform you how personal data is processed in the context of the registration and use of the Fotografiska Emerging platform ("Platform") by users ("User" or "you"). In case of further questions, please do not hesitate to con-tact us under the contact details specified in Section ‎2.

2. NAME AND CONTACT DETAILS OF THE DATA CONTROLLER AND ITS DATA PROTECTION OFFICER

The controller responsible for processing your data is: Fotografiska Emerging GmbH, Linienstrasse 127, 10115 Berlin, E-Mail: pri-vacy@fotografiska.com. You can contact our data protection officer at: Fotografiska Emerging GmbH, Linienstrasse 127, 10115 Berlin, c/o data protection officer, E-Mail: privacy@fotografiska.com.

3. PERSONAL DATA THAT IS PROCESSED, PURPOSES AND LEGAL BA-SES OF PROCESSING

3.1 Registration

For registration on the Platform and setting up an account for a User ("User Ac-count") the User must provide the information that is marked as mandatory infor-mation / required fields (e.g., name and email address). This information is necessary for the creation and administration of the User Account. All other information the User may provide (e.g., social media account, website, country of origin) is voluntary.
We process personal data in connection with the authentication method you choose. The following authentication methods are available:

  • Third-Party Authentication Services (Google or Apple Sign-In): If you choose to log in via a third-party authentication service such as Google or Apple, we receive certain profile information from the respective provider to create and authenticate your User Account. This typically includes your name, email address, and a unique user identifier assigned by the provider. The scope of the data transmitted depends on the settings and permissions you have configured with the respective third-party provider. We do not receive or store your password for the third-party service. The processing of your data by the third-party provider is governed by that provider's own privacy policy, which we recommend you review before using this authentica-tion method.
  • Verification link sent to the User's registered email address ("Magic Link"): If you choose to log in via a Magic Link, we use the email address you provided during registration to send you a unique, time-limited verification link. When you request a Magic Link, we process your email address and generate a secure, single-use token that is associated with your account. We also process metadata related to the login request, such as the time of the request and the IP address from which the request was made, for security and fraud prevention purposes. The verification link expires after a limited period and can only be used once. Regardless of the authentication method used, we may process technical data such as your IP address, browser type, device information, and login timestamps in connection with the login process. This data is processed for the purposes of providing and secur-ing access to your account and for detecting and preventing unauthorized access at-tempts. Processing is carried out on the basis of Art. 6 (1) (b) GDPR (i.e. the performance of the agreement on the use of the Platform). If processing is based on User's consent, le-gal basis is Art. 6 (1) a) GDPR. - The processing of metadata related to the login re-quest is based on our legitimate interest in protecting our Platform and User Accounts against unauthorized access and fraudulent use (Art. 6 (1) (f) GDPR). The processing of technical data in connection with the login process is based on our legitimate interest in maintaining the security and integrity of our Platform (Art. 6 (1) (f) GDPR). After registering on the Platform, Users shall receive an email containing a confirma-tion link as part of the double opt-in procedure. The processing of personal data within the double opt-in process is based on Art. 6 (1) (b) GDPR, as it is necessary to verify the User's identity and to complete the registration, and on Art. 6 (1) (c) GDPR, where applicable, to comply with legal obligations to document consent.

3.2 Upload of Photos

If the User uploads photos to his/her User Account ("Photo" or "Photos") we collect and process any personal data contained in the Photo (e.g. images of persons depicted in the Photo) solely for the purpose of uploading and storing it in the User Account. Processing is carried out on the basis of Art. 6 (1) (b) GDPR (i.e. the performance of the agreement on the use of the Platform).

3.3 Private Profile

By default, the User Account, any personal data of the User contained herein, and Pho-tos that have been uploaded herein by the User may only be accessed and viewed by the respective User and the Operator.

3.4 Public Profile

If the User decides that their User Account and Photos that have been uploaded herein shall become public, i.e. made available to other Users and visitors of the Platform, ("Public Profile"), the Operator collects and processes the following personal data for the following purposes:

3.4.1 Setting up a Public Profile

For setting up a Public Profile, certain personal data must be provided by the User (e.g., social media accounts or website, country of residence, short biog-raphy). This data is marked as mandatory information / required fields. This information is necessary for the creation and administration of a Public Profile by the Operator. All other information the User may provide is voluntary. Processing is carried out on the basis of Art. 6 (1) (b) GDPR (i.e. the perfor-mance of the agreement on the use of the Platform with a Public Profile). If processing is based on User's consent, legal basis is Art. 6 (1) a) GDPR.

3.4.2 Upload of Photos

For setting up a Public Profile, an upload of Photos is required by the User. We collect and process any personal data contained in the Photo (e.g. images of persons depicted in the Photo) for the purpose of uploading and storing it in the User Account. Processing is carried out on the basis of Art. 6 (1) (b) GDPR (i.e. the performance of the agreement on the use of the Platform with a Public Profile).

3.4.3 Verification and approval of the Operator

Personal data provided by the User (Section 3.4.1 and 3.4.2) is further pro-cessed by the Operator to verify and approve a Public Profile. Processing is carried out on the basis of Art. 6 (1) (b) GDPR (i.e. the performance of the agreement on the use of the Platform with a Public Profile).

3.4.4 Publication of a Public Profile

The processing of personal data contained in a Public Profile and contained in Photos uploaded herein by the User includes that this information is made public by the Operator on the Platform, i.e., it shall be made available to other Users and visitors of the Platform. Legal basis is Art. 6 (1) (b) GDPR (i.e. the performance of the agreement on the use of the Platform with a Public Profile) and, if processing is based on User's consent, Art. 6 (1) a) GDPR. The Operator has no control over any further publication of this data on third-party websites, as the information on the Platform is accessible worldwide.

3.5 Deletion of a User Account, Adjustments by the User, Update or personal data

We retain the User Account and any personal data contained herein for the duration of the existence of the User Account. The User can, at any time, delete their User Ac-count. Upon deletion of the User Account, personal data will be erased unless statutory retention obligations require further storage. The User can adjust the settings and revert to a Private Profile in their User Account at any time. In this case, the Operator will no longer make the User's personal data con-tained in the Public Profile and the Photos contained herein publicly available on the Platform. The User can update their personal data contained in a Public Profile at any time.

3.6 Storage and deletion of your personal data

Unless a specific duration of data storage is specified in this Privacy Notice, we will only process your data as long as this is necessary for the respective purposes (e.g. for performance of the Agreement on the use of the Platform) or as long as there are legal retention obligations. After the respective processing purpose ceases to apply and re-tention obligations end, your data will be routinely deleted.

3.7 Your rights

You can request information about your stored data. If you have provided personal da-ta on the basis of a contract or consent, you have the right to receive this data in a standard and machine-readable format.

To the extent allowed under GDPR, you can also request the deletion, correction or re-striction of the processing of your data. You can revoke your consent at any time without affecting the lawfulness of pro-cessing based on your consent before its withdrawal. You can object to the processing of data processed on the basis of our legitimate inter-ests at any time under the conditions of the GDPR. In case of questions and in case of possible concerns about the data processing, you can also contact a supervisory authority. The responsible supervisory authority is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstrasse 219, 10969 Berlin, phone: +49 30 13889-0, Fax: +49 30 2155050, E-Mail: mail-box@datenschutz-berlin.de, website: www.datenschutz-berlin.de. Version: 11.03.2026