Data protection for personalized products: What happens to your photos

When you order a photo product, you upload private images to an external server. What happens to them afterward is usually stated in the fine print. Here's an overview of the rules that apply in the EU and what you should pay attention to.

The Legal Basis

Photos in which individuals are recognizable are considered personal data under the General Data Protection Regulation (GDPR). For providers, this means several obligations: they may only process the data for the agreed purpose, must adequately protect it, and must delete or anonymize it after the purpose has been fulfilled.

Important: These rules apply to the provider, not to you as a private individual. Your own use of family photos in a private setting does not fall under the GDPR.

Your Rights Against the Provider

• Right of Access: You can inquire what data about you is stored.
• Right to Erasure: After completing the order, you can request the deletion of your images, provided there are no legal retention obligations to the contrary.
• Right to Information on Data Transfer: Providers must specify to which service providers data is transferred – such as printing companies or hosting providers.
• Right to Object to Promotional Use: Your images may not be used for marketing without explicit consent.

What to Look for in the Terms and Conditions

1. Storage Period. Reputable providers specify a concrete deadline, usually 30 to 90 days after delivery – useful for reorders and complaints.
2. Server Location. Servers within the EU significantly simplify the legal situation.
3. Usage Rights. Clauses that grant the provider extensive rights to your images are critical. A license for order processing is normal; one for free use is not.
4. Sub-processors. External printing companies are common but should be named.
5. Encrypted Upload. Recognizable by the https protocol – now the minimum standard.

If Other People Are in the Photos

For private gifts within family and friends, you generally do not need formal consent. However, if images are publicly displayed or distributed in larger quantities, the situation is different – here, the right to one's own image applies.

For children: The consent of the legal guardians is decisive. For photos of other people's children, a brief consultation is advisable before printing them – regardless of the legal situation, this is the better practice.

What You Can Do Yourself

• Before uploading, check which images are actually needed – do not upload the entire media library.
• After receiving the order, request the deletion of the data if you do not plan to reorder.
• Do not upload sensitive documents as image files – screenshots of chats can contain more than expected.
• Remove location data if you share images with third parties. EXIF data often contains exact coordinates.

For personalized products like a printed magazine, the same principle applies as with any other online purchase: a provider who transparently names storage periods and service providers is a safer choice than one who remains silent about them.

Frequently Asked Questions

Are uploaded photos viewed by employees?

In quality control, visual inspection is technically common. However, access permissions should be limited and documented.

What happens if the provider becomes insolvent?

Data protection obligations continue to apply even then. Practically, it makes sense to insist on deletion after receiving the goods.

May providers show customer photos as examples?

Only with explicit, separate consent. A general clause in the terms and conditions is usually not sufficient for this.