Privacy Policy

1. Data Controller

DigitalPhotoPassport is a trading name of HELLSMARKETING LTD, a company registered in England and Wales, company number 16760943. HELLSMARKETING LTD is the data controller for the personal information described in this policy. Our registered office address is listed on our contact page. If you have any questions about how we handle your data, contact us at support@digitalphotopassport.com.

2. What We Collect

• Photos: The image you upload for processing, and the processed image we generate from it.
• Email address: Collected at checkout for order confirmation and download links.
• Delivery address: Collected at checkout for printed orders only, and shared with our print and delivery partner solely to fulfil that order.
• Payment data: Handled securely by Stripe. We do not store your card details.
• Technical data: IP address and browser information for fraud prevention and analytics.

3. How We Use Your Data

• To generate compliant passport and ID photographs.
• To process payments, produce printed orders, and deliver them.
• To comply with legal obligations and prevent fraud.
• To improve our service (aggregated, anonymised data only).
• To invite you to review your order once it is complete.

4. Photo Storage & Deletion

Photographs are deleted by an automated sweep that runs once every day. Retention targets:

• The original photograph you upload: deleted at the first sweep after it is 24 hours old. Because the sweep runs daily rather than hourly, an original can in practice survive up to about 48 hours before it is removed. It is never kept beyond that.
• Abandoned orders (uploaded but never paid for): the original, the processed photograph and the automated compliance analysis are all deleted on the same schedule.
• Paid orders: the finished photograph is kept for 7 days so you can download it again, then deleted.
• Your email address and delivery address: removed from the order record after 90 days. The non-identifying order record itself is retained for accounting and tax purposes.

We do not retain backups beyond these windows. If you need your photo re-processed after deletion, you must upload it again.

5. Legal Basis (GDPR)

We process your data under the following lawful bases: contract performance (to fulfil your order), legitimate interests (to invite reviews from customers we have already served, and to prevent fraud), consent (for marketing, where given), and legal obligation (for tax and fraud prevention).

6. Your Rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Object to or restrict certain processing.
• Withdraw consent at any time.
• Lodge a complaint with the UK Information Commissioner's Office (ICO).

7. Cookies

We use essential cookies to maintain your session and remember your country preference, and analytics cookies to understand how the site is used.

8. Third-Party Services

We use the following processors, each under contract and acting only on our instructions:

• Stripe — card payments.
• Supabase — database storage.
• Cloudflare R2 — temporary photo storage.
• Amazon Web Services (Rekognition) — automated facial measurement for the compliance check.
• remove.bg — automated background removal.
• Resend — order confirmation and download emails.
• Prodigi — printing and dispatching physical orders. Your name and delivery address are shared with Prodigi for printed orders only.
• Trustpilot — review invitations. Once your order is complete we share your email address with Trustpilot, who email you an invitation to review us. You can decline or unsubscribe from their invitations at any time.
• Vercel, Google Analytics, Hotjar and Sentry — hosting, usage analytics and error monitoring.

9. Contact

For privacy-related questions, email support@digitalphotopassport.com.