Privacy Policy

1. Scope and Controller

This website is owned and operated by Pixsy, Inc., 340 S Lemon Ave, Walnut CA 91789, USA (herein referred to as “Pixsy”) as controller. More contact information about Pixsy can be found in the legal notice on this website.

This Privacy Policy describes the collection and use of your personal data in the context of the usage of our website www.pixsy.com including all subdomains and the usage of our services including the web-based applications which are accessible after a login (all services hereinafter referred to as “website(s)”).

2. Applicable Law

With regard to privacy and transparency requirements, this privacy policy reflects the high requirements of the European General Data Protection Regulation (hereinafter referred to as “GDPR”). Where applicable, Pixsy complies with other privacy regulations that might apply for non-European citizens, in particular, with requirements of US law.

If you have any questions about Pixsy’s Privacy Compliance Program, please contact our Data Protection Officer (see below).

3. Data Protection Officer

Our organization has appointed a Data Protection Officer, who you can via e-mail at dataprotection@pixsy.com

4. Webserver Logs

Nature and purpose of processing: When visiting our website our hosting provider is collecting transmitted personal data in connection with your visit. The data transmitted includes:

  • IP-Address
  • Name of access provider
  • Browser type, version of browser software and language of browser
  • Operating system
  • Date and time of access
  • Content of access
  • Amount of data transferred
  • Access status (successful transmission/error)
  • Website(s) the access was forwarded to
  • Website(s) accessed

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 f) GDPR (‘legitimate interest’). The legitimate interest for us to process this data is to provide the website to you and to monitor the security of the website.

Retention period: The data will be deleted when the purpose of the processing is fulfilled.

Data sharing with third parties: The above-mentioned data is processed by our hosting provider.

Provision prescribed or necessary: You are not obliged to provide us with the aforementioned personal data. However, the use of our website is not possible without the transmission of your IP-address.

5. General Information about Cookies

We use cookies on our website(s). Cookies are text files that are stored on a user’s computer system. If a user accesses our website(s) a cookie file can be saved on the local operating system. A cookie contains information that enables the identification of a user returning to our website(s).

Session cookies process information in so-called Session-IDs, which assist in identifying a user during continuous access to our website(s). Session-IDs are deleted automatically when closing the browser.

Persistent cookies will remain in the cookie files of your browser after the browser has been closed. Persistent cookies are deleted after a certain period of time has elapsed. The length of this period varies amongst the different types of cookies used.

The use of cookies can be disabled by changing the security settings on your browser. Further adjustments around cookie usage can be made in the security settings of your browser to block certain cookies (e.g. cookies of third parties) or disable cookies altogether.

6. Third-Party Cookies used

6.1. Adobe Typekit

Nature and purpose of processing: This website uses Adobe Typekit, a service provided by Adobe Systems Software Ireland Companies, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland to visually enhance the design and display of fonts on our website. To use the fonts provided by Adobe, your browser must connect to an Adobe server in the USA. In this context, your IP-address and the information that you have visited our website is processed by Adobe.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Recipients in third countries: Adobe processes your data in the USA. Adobe Inc. is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Provision prescribed or necessary: The provision of your personal data is voluntary, based on your consent.

Withdrawal of consent: Your consent can be withdrawn at any time. More information about Adobe is available at https://www.adobe.com/privacy/policy.html

6.2. Google Tag Manager

We use Google Tag Manager to facilitate the implementation of code on our website and manage our website. According to Google, no personal data of the website visitor is processed by Google Tag Manager, but the tool allows for activation of further tools that may track personal data.

6.3. Facebook Connect

Nature and purpose of processing: We use Facebook Connect, a service of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. Facebook Connect is a single sign-on application which allows users to login to third party services with their Facebook account. The Facebook API allows us to retrieve certain user information from your Facebook account profile to facilitate the registration process. The amount and extent of data sharing depends on your Facebook Privacy settings and may involve name, profile picture, e-mail address, gender, location, birthday, other information made public on Facebook.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Recipients in third countries: Facebook processes your data in the USA. Facebook is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Provision prescribed or necessary: The provision of your personal data is voluntary, based on your consent.

Withdrawal of consent: Your consent can be withdrawn at any time, e.g. by deleting your user account.

6.4. Twitter Button and Twitter Syndication

Nature and purpose of processing: This website uses Twitter Button and Twitter Syndication, a service of Twitter Inc., One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland. When you visit our website your IP-address is transferred to Twitter. If you have a Twitter profile your visit is connected to your user account. Your data may be used to show you advertisements or to analyze the usage of our website.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Recipients in third countries: Twitter processes your data in the USA. Twitter is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Provision prescribed or necessary: The provision of your personal data is voluntary, based on your consent.

Withdrawal of consent: Your consent can be withdrawn at any time, e.g. by using https://twitter.com/personalization to customize your settings.

6.5. HubSpot

Nature and purpose of processing: This website uses HubSpot, a marketing automation and tracking tool of HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141 USA. HubSpot analyzes website visitor’s behavior in order to optimize our website performance, send e-mail communications, and to administrate our customer database. If you provide us with information via our web forms (e.g. name and e-mail address) this data is saved on the HubSpot server and is connected with your user profile. This enables us to track your user behavior (e.g. clicks on the website, sites visited, e-mails received and clicks in e-mails).

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Recipients in third countries: HubSpot processes your data in the USA. HubSpot is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Provision prescribed or necessary: The provision of your personal data is voluntary, based on your consent.

Withdrawal of consent: Your consent can be withdrawn at any time. More information about HubSpot is available at https://legal.hubspot.com/privacy-policy.

6.6. Google Analytics

Nature and purpose of processing: This website uses Google Analytics, a web analysis service of Google Ireland Ltd., Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google“) to help the website analyze how users use our site. We have implemented a so-called anonymization of your IP-address on our website to protect your privacy. This means that your IP-address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP-address transmitted to a Google server in the USA and shortened there. The purposes of data processing are to evaluate the use of the website and to compile reports on activities on the website. The IP-address which is transmitted by your browser will not be brought into contact with other data stored by Google.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Recipient: Google is the recipient of the data as a processor on our behalf. We have concluded a corresponding data processing agreement.

Storage period: Pixsy itself only receives an anonymous overview of the use, which does not allow any conclusion about you as an individual. We have instructed Google to delete data on their servers within a period of 14 months.

Recipients in third countries: Google processes your data in the USA. Google is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Provision prescribed or necessary: The provision of your personal data is voluntary, based on your consent.

Withdrawal of consent: You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP-address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout.

6.7. Facebook Custom Audiences

Nature and purpose of processing: This website uses the “Custom Audience pixel” of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. This tool tracks a user’s behavior after they see or click on a Facebook advertisement and allows monitoring of the conversion rate and effectiveness of Facebook ads. The data provided to us by Facebook is aggregated and cannot be assigned to a single user by us.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Storage period: Facebook pixels are stored up to 28 days after initial saving.

Recipients in third countries: Facebook processes your data in the USA. Facebook is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Provision prescribed or necessary: The provision of your personal data is voluntary, based on your consent.

Withdrawal of consent: Your consent can be withdrawn at any time. The remarketing function “Custom” can be deactivated if you are logged into Facebook here: https://www.facebook.com/settings.

6.8. Google reCAPTCHA

Nature and purpose of processing: This website uses the Google reCAPTCHA to stop spam and abuse and in order to identify misuse of our services. The tool allows for the identification and blocking of spam traffic reaching our website. For this purpose, the tool captures a snapshot of the users’ browser window and checks the cookies placed on a users’ computer.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 f) GDPR. The legitimate interest is based on our interest to prevent the misuse of our website.

Recipient: Google is the recipient of the data as a processor on our behalf. We have concluded a corresponding data processing agreement.

Storage period: The cookies stored become invalid after 30 days.

Recipients in third countries: Google processes your data in the USA. Google is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

6.9. Facebook Pixel

Nature and purpose of processing: This website uses Facebook Pixel, a service of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. This tool tracks user’s behavior after viewing or clicking on a Facebook advertisement and allows monitoring of the conversion rate and effectiveness of Facebook ads. The data provided to us by Facebook is aggregated and cannot be assigned to a single user by us.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Storage period: Facebook Pixels are stored up to 28 days after initial saving.

Recipients in third countries: Facebook processes your data in the USA. Facebook is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Provision prescribed or necessary: The provision of your personal data is voluntary, based on your consent.

Withdrawal of consent: Your consent can be withdrawn at any time. The remarketing function “Custom Audiences” can be deactivated if you are logged into Facebook here: https://www.facebook.com/settings.

6.10. Google Marketing and Re-Marketing-Services/Google Adsense/Google Ads

Nature and purpose of processing: This website uses the online marketing services of Google, Google Ireland Ltd., Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland such as Google Ads and Google AdSense. This service allows us to integrate advertisements of third parties according to potential user interests. Generally, these advertisements will be labeled as Google advertisements. In this context, statistical information about the user may be collected and transmitted to third parties.

More information is available at https://support.google.com/dfp_sb/answer/94149 and concerning the usage of your personal data for advertising purposes, settings and opt-out options can be found at https://policies.google.com/privacy/partners?hl=en (‘How Google uses data when you use our partners’ sites or apps’), https://policies.google.com/technologies/ads?hl=en (‘Advertising’), https://adssettings.google.com (‘Advertising Preferences’).

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

6.11. Intercom

Nature and purpose of processing: Our website uses Intercom, a service provided by Intercom Inc., Intercom R&D Unlimited Company 55 2nd Street, 4th Floor, San Francisco, California 94105, USA. Intercom provides a chat window, on-page chat, and e-mail communications to get in contact with you. In this context, your user name, e-mail address and further information provided by you can be transferred to Intercom. Further information such as IP-addresses, pages requested, and time spent on pages can be transferred automatically to Intercom.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Recipients in third countries: Intercom processes your data in the USA. It is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Provision prescribed or necessary: The provision of your personal data is voluntary, based on your consent.

Withdrawal of consent: Your consent can be withdrawn at any time with effect for the future.

6.12. Mixpanel

Nature and purpose of processing: We use Mixpanel, a service of Mixpanel Inc., 405 Howard Street, Floor 2, San Francisco, California 94105, USA to track the user behavior on our website. Mixpanel tracks which subpages have been opened by the website visitors and their respective activities.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Recipients in third countries: Mixpanel processes your data in the USA. It is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Withdrawal of consent: You can withdraw your consent at any time, e.g. by opting out (see https://help.mixpanel.com/hc/en-us/articles/360000679006-Managing-Personal-Information#optout-users for more information).

6.13. New Relic

Nature and purpose of processing: We use New Relic, a service of New Relic Inc., 188 Spear Street, Suite 1200 San Francisco, CA 94105, USA for purposes of technical and functional administration of our websites. In particular, we analyze the speed of our websites and the user behavior to monitor the functionality of our websites and in order to optimize our service.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Recipients in third countries: New Relic processes your data in the USA. It is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Withdrawal of consent: You can withdraw your consent at any time.

6.14. FullStory

Nature and purpose of processing: Our websites use FullStory, a service of FullStory Inc., 120 Ottley Dr. NE Ste. 100, Atlanta, Georgia, 30324 to analyze and track user behavior on our website. FullStory tracks user sessions and the user behavior (such as page visits and clicks) and links this information to your user profile.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 a) GDPR (‘consent’).

Recipients in third countries: FullStory processes your data in the USA. It is certified under the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.

Withdrawal of consent: You can withdraw your consent at any time, e.g. by clicking on this link: https://www.fullstory.com/optout/

7. Signing-Up to Pixsy customer platform

Nature and purpose of processing: If you sign up and register to our services under my.pixsy.com you are providing Pixsy with personal information such as:

  • Name, address, e-mail, phone, website
  • Date of birth
  • Bio, career and profile information
  • Photo information
  • Tax & payment information (remittance payments)
  • Signatures & settlement agreements
  • Documents and files
  • Information in connection with an account sign-in facility (e.g. log-in and password details)
  • Communications sent by you (e.g. via post, e-mail or website communication forms)

Pixsy processes this data only to fulfill its contractual obligations, in particular, to handle cases, scan for image matches, register images at copyright offices and perform the services as further specified in our Terms of Use (https://www.pixsy.com/terms-of-use/). If you commission Pixsy to enforce your copyrights, the respective data may be transferred to our selected partner law firms for this purpose.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 b) GDPR (‘contract performance’).

Storage period: The data is stored for as long as you hold an account with Pixsy. You can delete your data by deleting your Pixsy account. Personal data that has to be stored due to legal requirements of applicable tax law will be deleted in accordance with these legal requirements.

8. Uploading your images to Pixsy customer platform

Nature and purpose of processing: Pixsy enables you to directly import pictures from third party sources (e.g. Flickr, Tumblr, Photodeck, Instagram, Google Drive, Dropbox etc.).

In this context personal information such as:

  • Image title, filenames, date of file creation
  • Date and location of creation
  • Metadata, EXIF data, tags, and categories

will be processed by Pixsy to perform the contractual tasks as described above.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 b) GDPR (‘contract performance’).

Storage period: Your data is stored until you delete it manually using the delete function on our platform or delete your Pixsy account.

9. Image users, license purchasers, and potential infringers

Nature and purpose of processing: As part of our services, we enforce the intellectual property rights of our customers as their agent. If you are an image user (and seek to purchase an image license), copyright infringer or potential infringer (or if we have reasonable grounds to assume that you are an infringer) of the intellectual property rights of our customers, we may collect and process personal data in this regard, including:

  • Name, address, e-mail, phone, website, social media account details
  • Image use/infringement information
  • Business information
  • Director and employee names

This data is collected from publicly available sources or provided by our customers.

Legal basis: The legal basis for this processing activity is Art. 6 para 1 sentence 1 f) GDPR (‘legitimate interest’).

10. Contact via e-mail, phone, and postal mail

Nature and purpose of processing: If you make use of the possibility to contact us via e-mail, phone or postal mail, the provided information (your e-mail address, possibly your name, telephone number and further information provided by you) will be saved by us in order to process your request.

Storage period: The personal data collected in this context will be deleted if the storage is no longer necessary for this purpose. Alternatively, we may restrict access to the stored data if legal retention periods apply. If you contact us via e-mail a secure transfer can only be guaranteed in case of encrypted communication.

11. Newsletter and related e-mails from Pixsy

Nature and purpose of processing: If you register an account, we occasionally send you newsletters and other e-mails related to our services. Upon registration we use the so-called double opt-in procedure. This means that we will only send you newsletters and other related e-mails if you confirm our initial notification e-mail with a click. If you confirm your e-mail address, we will store your e-mail address, the time of registration and the IP-address you used when registering. The purpose of storing this data is to prove that you registered and in order to prevent misuse by third parties. In addition, we track which e-mails have been opened by the addressees to assess the success of our campaigns and to deliver improved user experiences.

Legal basis: For subscription to our newsletter, solely the provision of your e-mail address is required. After confirmation, we save your e-mail address in order to send you our newsletter. The legal basis is Art. 6 para 1 sentence 1 f) GDPR (‘legitimate interest’).

Right to object: You can object to the processing of your personal data for marketing purposes (e.g. by sending an e-mail to our Data Protection Officer, see above under Point 2).

12. Purpose and legal basis of processing your personal data

In addition to the particular purposes mentioned, the processing of your personal data is required to display our websites, to provide stability and security of our webservers and to improve the usability of our websites. The legal basis for processing your personal data is Art. 6 paragraph 1 sentence 1 f) GDPR if not stated otherwise. If personal data is processed on the basis of a consent, the legal basis is Art. 6 paragraph 1 sentence 1 a) GDPR. If personal data is processed to perform on our contractual obligations, the legal basis is Art. 6 paragraph 1 sentence 1 b) GDPR.

13. Data transfer to third parties

In general, data transfer to third parties is only conducted in the cases mentioned in this Privacy Policy. Service Providers such as:

  • Storage & database providers
  • Customer service/support tool providers
  • Case management software providers
  • Payment providers (collection and remittance)
  • Accounting and tax providers
  • E-mail providers

may process personal data on our behalf or as joint controller bound by a contract according to the requirements of Art. 26 et seq. GDPR.

In addition, data transfer to third parties may occur if:

  • we have received your explicit consent (Art. 6 paragraph 1 sentence 1 a) GDPR);
  • the processing is necessary in connection with legal claims, except if the respective interests are not overridden by the interests or fundamental rights and freedoms of the data subject (Art. 6 paragraph 1 sentence 1 f) GDPR);
  • the processing is necessary for compliance with a legal obligation (Art. 6 paragraph 1 sentence 1 c) GDPR);
  • the processing is necessary for the performance of a contract with you or the performance of steps at your request prior to entering into a contract (Art. 6 paragraph 1 sentence 1 b) GDPR)

14. Data deletion and data storage

Collected personal data will be deleted and/or the access to the data will be restricted if the purpose of the processing activity ceases to be relevant. Extended retention periods may apply in case of statutory legal provisions requiring further data retention.

15. Rights of the data subject and the right to lodge a complaint with a supervisory authority

With regard to the personal data processed, you have the following rights according to Art. 12 – 23 GDPR:

  • Right to information and access,
  • Right to rectification and erasure,
  • Right to restriction of processing,
  • Right to objection,
  • Right to data portability.

In addition, you have the right to lodge a complaint with the competent data protection authority with regard to the processing of your personal data by us.

16. Data security

Personal data processed by us are protected against loss, falsification and unauthorized third-party access by adequate technical and organizational measures. In general, our data is stored and processed by ISO 27001 certified service providers.

In order to provide a secure transmission of data between your browser and our systems, we generally use Secure Socket Layer (‘SSL’) encryption technology to encrypt communication between your browser and our webserver. URLs of websites using an SSL-encryption start with ‘https://’. In addition, we periodically review our website security for vulnerabilities.

17. Update of the Privacy Policy

Our Privacy Policy may be updated according to changes of our website(s). You can find the current version of our Privacy Policy on our websites.