Privacy and security

Roles and legal basis

Your company decides which employees are photographed and remains responsible for the data of its employees. VideoPhotoWorkers GmbH in Winterthur processes the images and the related data on behalf of your company.

• Personal data is processed under the Swiss Data Protection Act (FADP).
• We do not offer a separate data processing agreement. Our collaboration is governed by our AGB and our privacy policy.

Where is the data stored?

Who has access?

• Employees: only to their own image, through a personal link without an account.
• Customers: only to the data of their own account. The data of different customers is strictly separated, also through the API.
• Internally: only employees of VideoPhotoWorkers GmbH. The actions of admin accounts are logged.
• Preview images and downloads are only available after login or with a valid personal link.

Technical and organisational measures

• Encrypted transmission of data (HTTPS).
• Personal links (invitation, photo upload, approval) are stored in the database only as a hash and are valid for a limited time.
• Passwords are at least 10 characters long, are checked against known data breaches and are never stored in plain text.
• Protection against abuse: login attempts and requests to interfaces are rate-limited.
• Application errors are monitored.

Consent and approval by the employees

• Before the photo upload, employees must agree to a consent statement. Time, IP address and the displayed wording are stored as proof.
• The consent text is a standard text and can be replaced by a custom text per customer.
• The edited image is only released for download after the person has approved it.

Use of the images

• The images are used exclusively for the customer’s purpose for editing and delivery.
• No self-promotion without consent: We do not use customer images for our own advertising unless the customer agrees.
• No disclosure to third parties without consent: We do not pass on images without the customer’s consent. This does not affect the technical service providers for storage and operation, such as cloudscale.ch.
• No AI training: Customer images are not used to train AI systems.
• Image editing: The photographer uses local AI tools and controls them manually. No generative AI is used, and the images are not sent to external servers for this.
• We do not generate portraits with AI from selfies: the images show the real people, edited by a photographer.
• A face detection runs exclusively on our own server and only aligns the image section on the eyes. Only the position of the eyes is stored.

Retention, backup and deletion

• After the contract ends: The data remains stored for later access, for example for later additions or follow-up questions. After about a year it is archived offline.
• Backup copies: Backup copies of the application, the database and the images exist and are stored securely. They are kept until archiving or until deletion on request.
• Deletion on request: On the customer’s request we delete the data manually.
• Trial accounts: Test data is deleted within 30 days after the test project expires. We send an email reminder seven days beforehand. Anyone who wants to continue gets in touch, and the data is kept.
• Deleting in the system: When a person, a project or a customer is deleted, the system also removes the stored images and preview images.

Data breaches

If a data breach occurs, we inform affected customers as quickly as possible.

Rights of data subjects and contact

We normally answer requests within one day.

For access, correction, deletion or withdrawal of consent, data subjects contact studio@portraitflow.ch or

VideoPhotoWorkers GmbH
Fröschenweidstrasse 2
8404 Winterthur, Switzerland
Imprint

Statistics on the website

On the public pages (home, trial access and help) we use Google Analytics to improve the website. Google Analytics is not used in the customer portal, on the employees’ upload pages or in the API. Details are in our privacy policy.