Last updated: 16 August 2026

This Privacy Policy explains how Exportlab collects, uses, stores, shares, and protects personal data when you use Exportlab or when personal data is processed through Exportlab on behalf of an Exportlab customer.

This Policy applies to the Exportlab web app, websites, public pages, client portals, guest upload features, asset collection forms, status pages, model release workflows, team collaboration features, APIs, plugins, integrations, AI features, face recognition features, billing features, support interactions, and related services (together, the "Service").

1. Controller information

For personal data that Exportlab processes for its own purposes, the controller is:

Exportlab

Adelgundenstrasse 1

80538 Munich

Germany

Email: hey@exportlab.io

2. Our role as controller and processor

Exportlab processes personal data in different roles.

Exportlab acts as controller where we determine the purposes and means of processing, including account registration, authentication, billing, customer support, security, abuse prevention, service communications, product operations, legal compliance, and our own business administration.

Exportlab usually acts as processor where customers use the Service to upload, collect, manage, share, review, publish, or deliver personal data of other people. This may include personal data in photos, videos, files, galleries, guest uploads, asset collection forms, client portals, public profiles, status pages, review comments, team messages, model releases, signature workflows, group shoot workflows, API workflows, and integrations.

If you are a client, guest, model, signer, participant, employee, contractor, visitor, gallery viewer, public page visitor, or other end user interacting with an Exportlab workspace controlled by an Exportlab customer, the customer is usually the controller of your personal data. In that case, privacy requests should generally be directed to that customer. Exportlab will support the customer as required by law and contract.

Where required, Exportlab makes a Data Processing Addendum ("DPA") available to business customers.

3. Personal data we process

Depending on how the Service is used, we may process the following categories of personal data.

Account and workspace data

Name, email address, company or organization name, workspace or tenant identifier, role, permissions, onboarding information, plan information, profile information, and account settings.

Authentication and security data

Login information, authentication provider identifiers, Google or Apple sign-in data if you use those providers, session data, MFA or 2FA data where enabled, security events, access logs, IP addresses, user agents, device information, timestamps, and abuse prevention signals.

Profile, branding, and configuration data

Branding assets, public profile settings, portfolio information, pricing information, references, testimonials, social links, domain settings, gallery settings, workflow settings, integration identifiers, analytics identifiers, and other configuration data.

Media, content, and project data

Photos, videos, files, thumbnails, previews, transcodes, HLS assets, ZIP files, galleries, folders, titles, descriptions, tags, technical metadata such as EXIF, IPTC, or XMP data, comments, annotations, review decisions, approvals, versions, delivery history, download events, and project information.

Content, metadata, prompts, generated captions, keywords, classifications, categories, summaries, scene descriptions, assistant interactions, and AI-generated metadata where you enable or use AI features.

Biometric data

Face embeddings, biometric templates, or similar identifiers generated when optional face recognition is activated.

Client portal data

Client names, email addresses, login details, access permissions, shared content, project history, portal activity, and related communication or access logs.

Guest upload and asset collection data

Guest email addresses where collected, submitted files, submitted media, form answers, messages, upload logs, verification events, confirmation events, and event-related metadata.

Public profile and lead data

Contact requests, form submissions, names, email addresses, messages, timestamps, browser and device data, referrers, profile interactions, and associations with projects, contracts, or customer relationships.

Status page data

Status page subscriptions, subscriber email addresses, project references, notification preferences, notification delivery events, and related timestamps.

Model release and signature data

Names, contact details, role information, release scope, permitted usage, territory, duration, guardian or legal representative details where relevant, signature images, timestamps, IP addresses, device information, document versions, audit trail events, and related attachments.

Group shoot and check-in data

Participant data, guest or employee identifiers, form fields, check-in status, package or favorite information, shooting day information, statistics, API references, and associations with galleries or projects.

Integration, plugin, API, and webhook data

API keys or references, access scopes, webhook events, plugin versions, integration settings, connected account identifiers, upload status, delivery status, error logs, compatibility information, request metadata, and data exchanged with connected third-party services where an integration is activated.

Usage, device, and operational data

IP address, browser type, device type, operating system, pages visited, actions taken, timestamps, referrer, approximate location derived from technical data, storage usage, bandwidth usage, processing logs, WebSocket connection data, audit logs, and system events.

Communications and support data

Support requests, emails, chat messages with support, feedback, attachments, bug reports, abuse reports, and other communications with Exportlab.

Referral and acquisition data

If you reach our Service through an Exportlab-managed partner or referral link and have consented to the optional measurement, we may process information about the referral source. This includes the internal referral link ID, the referral code, the time of attribution, and UTM parameters. If an account or workspace is subsequently created, this information may be associated with the tenant identifier and the account. On a first paid purchase, the plan, amount, currency, payment date, and related Stripe references may additionally be linked to the referral record. Renewals are not recorded again for this purpose.

Billing data

Billing name, billing address, tax information, plan, subscription status, invoice information, payment status, Stripe customer ID, and limited payment method references such as the last four digits of a card where provided by the payment processor. Full payment details are processed by Stripe or the relevant payment provider.

4. Special categories of personal data

Exportlab does not intentionally collect special categories of personal data for its own purposes unless this is necessary for a feature you activate or content you upload.

Special categories of personal data may be included in customer content, such as photos, videos, forms, model releases, or biometric features. Where Exportlab processes such data as processor, the customer is responsible for ensuring that a valid legal basis exists.

Biometric data used for unique identification is subject to special legal requirements. You must only enable face recognition where all required notices, consents, and legal bases have been obtained.

5. Purposes of processing

We process personal data to:

provide, operate, maintain, and secure the Service;
create and manage accounts, workspaces, plans, roles, and permissions;
authenticate users and protect accounts;
upload, store, process, transcode, preview, organize, share, review, and deliver media and files;
operate galleries, client portals, guest uploads, asset collection forms, public profiles, status pages, model releases, team collaboration, group shoots, check-ins, and project workflows;
provide AI features where enabled or requested;
provide face recognition where enabled or requested;
process payments, subscriptions, invoices, taxes, renewals, cancellations, credits, and add-ons;
provide customer support and respond to inquiries;
send transactional emails, invitations, confirmations, service notices, billing notices, status updates, and security alerts;
operate APIs, plugins, webhooks, and integrations;
monitor usage limits, storage limits, token balances, and fair use;
detect, prevent, and investigate fraud, abuse, spam, security incidents, illegal content, and rights violations;
troubleshoot errors, maintain logs, improve reliability, and develop the Service;
internally evaluate the effectiveness of our partner and referral sources, in particular whether a referral link led to a registration and to a first paid purchase;
comply with legal obligations and enforce legal rights.

6. Legal bases where Exportlab is controller

Where GDPR applies and Exportlab acts as controller, we rely on the following legal bases.

Contract performance

We process data where necessary to create accounts, provide the Service, manage subscriptions, deliver features, provide support, and perform our agreement with you.

We rely on consent where required, including for certain optional analytics, certain marketing communications, certain integrations, and certain AI or biometric processing contexts where Exportlab acts as controller and consent is required.

You may withdraw consent at any time with future effect.

Legitimate interests

We process data based on legitimate interests where appropriate, including service security, abuse prevention, fraud prevention, audit logging, troubleshooting, product improvement, legal defense, platform integrity, email deliverability, and business administration.

You may object to processing based on legitimate interests where the legal requirements are met.

Legal obligations

We process data where necessary to comply with legal, tax, accounting, regulatory, data protection, and law enforcement obligations.

7. Where Exportlab is processor

Where Exportlab acts as processor, we process personal data on behalf of and under the documented instructions of the customer. The customer is responsible for determining the purposes and legal basis of processing, providing required privacy notices, obtaining required consents, configuring access, responding to data subject requests, and deciding when data should be deleted.

Exportlab supports customers with these obligations as required by law and contract.

8. AI processing

AI features are optional and user-enabled or user-initiated.

When AI indexing or AI assistance is enabled, relevant content and metadata may be sent to third-party AI providers, including OpenAI and AWS, to generate captions, tags, keywords, classifications, summaries, descriptions, recommendations, assistant responses, or similar outputs.

If you connect Exportlab to an external AI assistant such as Claude or activate a corresponding integration, the workspace data, content, and metadata you request may be transmitted to the relevant provider, such as Anthropic. The transmission takes place only within the integration you have activated and in connection with requests initiated by you or the AI assistant.

External AI assistants and their providers may process personal data under their own terms and privacy notices where they act as independent controllers. Users are responsible for making available through the integration only data for which they have the necessary rights and legal bases for processing and transmission.

AI-generated metadata may be stored in Exportlab to support search, filtering, discovery, organization, and workflow automation.

If AI features are not enabled or requested, we do not intentionally send your media to AI providers for those AI features.

AI outputs may be inaccurate or incomplete. Users are responsible for reviewing outputs before relying on them.

9. Face recognition and biometric data

Face recognition is optional.

If enabled, AWS Rekognition or a similar provider may process photos to generate face embeddings or comparable biometric templates. These are used to match faces across photos or projects.

Customers are responsible for obtaining all required notices, consents, and legal bases from individuals depicted in the content before enabling face recognition.

Biometric data is retained until the customer deletes it, disables the relevant feature, deletes the related content, or closes the account, unless a longer retention period is required or permitted by law.

Exportlab does not sell biometric data.

10. Public pages, visitors, and analytics

Customers may create public or semi-public Exportlab pages, including public profiles, galleries, status pages, delivery links, review links, guest upload links, asset collection links, or client portal resources.

When visitors interact with these pages, Exportlab may process technical data, access logs, form submissions, contact requests, download events, status subscriptions, and other interaction data.

Where those pages are operated by a customer for the customer's own purposes, the customer is usually the controller and Exportlab acts as processor. Exportlab may separately process technical, security, and operational data as controller where necessary to operate and protect the Service.

Public pages and public content may be indexed or cached by search engines or other third parties if made publicly available.

If customers activate analytics services, such as Google Analytics, additional data may be processed by that provider. Customers are responsible for configuring analytics lawfully and obtaining any required consent.

11. Model releases and signature workflows

Where customers use model release, document, form, or signature workflows, Exportlab may process the data entered into the document or generated by the workflow, including names, contact details, release scope, guardian details, signature images, timestamps, IP addresses, device information, document versions, and audit trail events.

This data is processed to generate, execute, document, store, retrieve, and manage the relevant workflow.

Exportlab does not provide legal advice and does not determine whether a specific document or signature is legally sufficient for a customer's intended use.

12. Group shoots, check-ins, forms, and asset collection

Where customers use group shoot, check-in, form, or asset collection features, Exportlab may process participant data, check-in information, form answers, uploaded content, accompanying messages, favorites, statistics, API references, HR import references, and project or gallery assignments.

This processing is used to technically provide, document, manage, and administer the relevant workflow. The customer is usually responsible for the purpose, lawfulness, necessity, and retention of that data.

13. Integrations, plugins, APIs, and webhooks

If you activate integrations, plugins, APIs, or webhooks, Exportlab may exchange data with the connected third-party service to provide the requested functionality.

This may include account identifiers, project identifiers, event data, upload status, comments, files, metadata, error logs, API request data, authentication data, and configuration information.

Third-party integrations may include creative software providers, automation platforms, messaging tools, analytics providers, authentication providers, payment providers, signature providers, or other services selected by you.

Third-party providers process data under their own terms and privacy policies where they act independently.

14. Cookies, local storage, and similar technologies

Exportlab may use cookies, localStorage, sessionStorage, in-memory storage, device storage, and similar technologies to provide authentication, session continuity, security, preferences, tenant routing, UI settings, uploads, real-time features, and other Service functionality.

Some storage or access may be strictly necessary to provide the Service requested by the user. Optional analytics, tracking, or marketing technologies are used only where enabled and where legally required consent has been obtained.

A separate Cookie Policy or consent interface may provide more detail about specific technologies, purposes, providers, and choices.

Embedded YouTube videos

On exportlab.io, particularly in blog articles, we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

These videos are blocked by default. Before you consent, no content is loaded from YouTube and no connection to Google servers is established — you see only a placeholder where the player would be. The player is loaded only once you enable the "Marketing" category, or the "YouTube" service specifically, in the consent banner and start the video.

We use the privacy-enhanced mode (youtube-nocookie.com). Even in this mode, YouTube sets cookies and processes data during playback. This may include your IP address, browser and device information, the video watched, playback progress, and the referring page. If you are signed in to your Google account at the same time, Google may associate this data with your account.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future by changing your cookie settings. Transfer to the United States is possible; Google relies on the Standard Contractual Clauses and the EU-US Data Privacy Framework.

For more information, see Google's privacy policy: https://policies.google.com/privacy

Google Tag Manager

On exportlab.io we use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Google Tag Manager is a management tool through which we deploy and control measurement and marketing technologies. The Tag Manager itself does not set cookies and does not create user profiles; it only serves to deliver the downstream services technically. When it loads, technically necessary connection data such as your IP address is transmitted to Google.

We use Google Consent Mode. Until you make a choice in the consent banner, analytics and marketing storage are denied by default; downstream services such as Google Analytics or the Meta Pixel only execute after you have given consent.

For more information: https://policies.google.com/privacy

Partner links and referral attribution

Exportlab uses its own partner and referral links, for example links of the form exportlab.io/r/<code>, to internally evaluate which referral sources lead to registrations and first paid purchases. This is not an affiliate programme: no commissions are paid, and the referrer receives no access to the registration, account, or payment data processed here.

When a referral link is opened, the referral code is resolved server-side and you are redirected to the intended Exportlab page. For plain reach measurement we increment a counter and store the internal link ID, the time, the language, and the target page. For this click measurement we store no IP address, no user agent, no fingerprinting characteristics, and no individual visitor or cookie ID. The click record therefore cannot be attributed to any particular website visitor; it is created independently of your cookie choice and does not by itself establish a personal reference.

Only if you consent to the "Partner Links" service in the consent banner do we additionally set the first-party cookie exportlab_referral on the domain .exportlab.io. It has a maximum lifetime of 30 days, is set with the Secure and SameSite=Lax attributes, and contains only the internal referral link ID, the referral code, the time of capture, and the expiry time.

The purpose of this cookie is to recognise the referral source on a later registration. If you register within that period, we associate the referral link ID, referral code, time, and related UTM parameters with your account or workspace. Our referral database may additionally store the tenant identifier, email address, and registration date. If a first paid purchase follows, the plan, amount, currency, date, and related Stripe references such as PaymentIntent, subscription, or invoice identifiers may be linked to that record. Only the first paid purchase is recorded; renewals are not stored again.

Storing and reading the cookie on your device takes place solely with your consent pursuant to Section 25(1) TDDDG. You may withdraw this consent at any time with effect for the future via your cookie settings; the referral cookie will then no longer be read and no new attribution will be created. Without your consent the referral link works unchanged — the redirect happens as usual, only no attribution to a later registration is established.

Where referral information is linked to your account after registration and processed for our internal evaluation of referral and acquisition channels, we base this processing on our legitimate interests pursuant to Article 6(1)(f) GDPR. Our legitimate interest is to assess the effectiveness of our referral partnerships and acquisition channels. We limit the processing to the data required for that attribution. You may object to this processing under Article 21 GDPR.

Referral data is stored in an AWS database in the Frankfurt region (eu-central-1). On a first paid purchase the internal referral link ID is additionally transmitted to Stripe as payment metadata; the safeguards described in Section 16 apply to international transfers. No names, email addresses, account data, or payment information are transmitted to the referrer.

Meta Pixel and Meta Conversions API

On exportlab.io we use technologies provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the performance of our ads on Facebook and Instagram.

They are used only with your consent. Before you agree in the consent banner (category "Marketing", service "Meta Pixel"), no Meta script is loaded, no cookies are set, and no data is transmitted to Meta.

We use two technical paths that describe the same event:

Meta Pixel (browser): A script embedded through Google Tag Manager that records page views and interactions on exportlab.io. This may process your IP address, browser and device information, the pages you visit, the referring page, and the click identifier of the ad (fbclid). Meta sets the cookies fbp and fbc for this purpose.
Conversions API (server-side): If you create an account after clicking one of our ads, we additionally report that event from our server to Meta. What is transmitted is the click identifier, IP address, browser identifier, and your email address exclusively in irreversibly hashed form (SHA-256). Your email address in plain text is not transmitted to Meta for this purpose.

Both paths use the same event identifier so that Meta can recognise an event reported twice and count it only once. The purpose of this processing is to measure the performance of our advertising and to optimise how it is delivered.

The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future by changing your cookie settings. If you withdraw your consent, the server-side transmission stops as well.

With respect to the collection and transmission of this data, we and Meta are joint controllers under Art. 26 GDPR. Meta makes the essential content of this arrangement available at https://www.facebook.com/legal/controller_addendum. Any further processing by Meta is carried out under Meta's sole responsibility.

Transfer to the United States is possible; Meta relies on the Standard Contractual Clauses and the EU-US Data Privacy Framework.

Meta's privacy policy: https://www.facebook.com/privacy/policy/

Your ad settings at Meta: https://www.facebook.com/adpreferences/ad_settings

Google reCAPTCHA

To protect our contact forms against automated abuse, we use reCAPTCHA Enterprise provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

reCAPTCHA analyses your usage behaviour in the background in order to distinguish human input from automated requests. This may transmit your IP address, browser and device information, and interaction data such as mouse and keyboard movement to Google.

On exportlab.io the legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time through your cookie settings.

For more information: https://policies.google.com/privacy

We use Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, and Sendinblue SAS, France) to send our newsletter.

If you sign up for our newsletter, your email address is transmitted to Brevo and stored there. Sign-up uses the double opt-in procedure: you first receive a confirmation email and are only added to the list after you confirm. Brevo also processes technical data such as the time of sign-up and your IP address in order to evidence your consent.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can unsubscribe at any time using the link in every email, which also withdraws your consent.

Brevo's privacy policy: https://www.brevo.com/legal/privacypolicy/

15. Service providers and recipients

We do not sell or rent personal data.

We may share personal data with trusted service providers and recipients where necessary to provide, secure, operate, support, or improve the Service, including:

AWS, including services such as hosting, storage, databases, queues, content delivery, operational infrastructure, AWS Cognito, AWS SES, and AWS Rekognition where enabled;
OpenAI, Anthropic, and other AI or assistant providers where corresponding AI features or integrations are enabled;
Stripe or other payment providers for billing and payment processing;
Google and Apple for optional sign-in;
Google Analytics, Google Tag Manager, or similar analytics providers where enabled;
Meta Platforms Ireland Limited to measure the performance of our advertising, where you have given consent;
Brevo (Sendinblue) for sending our newsletter;
Slack, Microsoft Teams, Make, Zapier, or similar integration providers where enabled;
email delivery, logging, monitoring, security, support, analytics, signature, or infrastructure providers;
legal, tax, accounting, compliance, and professional advisors where necessary;
authorities, courts, regulators, or law enforcement where required by law or necessary to protect rights, safety, and security.

16. International data transfers

Exportlab is based in the European Union and aims to store and process data primarily within the EU or EEA where reasonably possible.

Some providers or integrations may process data outside the European Economic Area, including in the United States. Where international transfers occur, we use lawful transfer mechanisms such as adequacy decisions, Standard Contractual Clauses, or other valid safeguards where required.

17. Data retention

We retain personal data only as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Typical retention periods include:

Account and workspace data: retained while the account is active and for a limited period after closure where required for legal, billing, support, security, or dispute purposes.
Uploaded content and metadata: retained until deleted by the customer, deleted through the Service, or the account is closed, subject to backup cycles and legal requirements.
Client portal, guest upload, asset collection, public profile, status page, review, and group shoot data: retained until deleted by the customer, the relevant project ends, or the account is closed, subject to legal requirements.
Model release and signature data: retained until deleted by the customer or until account closure, unless longer retention is required for legal, contractual, or defense purposes.
Biometric data: retained until deleted, the feature is disabled, related content is deleted, or the account is closed, unless longer retention is required or permitted by law.
AI assistant sessions: typically retained for up to 30 days for operational purposes unless otherwise stated.
WebSocket and real-time connection data: typically retained temporarily, for example up to 24 hours, where needed for operation, security, or troubleshooting.
Audit logs: typically retained for up to 365 days unless a longer period is required for security, compliance, or legal reasons.
Billing and invoice records: retained for legally required periods, commonly 7 to 10 years depending on applicable law.
Email suppression lists and abuse records: retained as long as necessary to maintain deliverability, prevent abuse, comply with legal obligations, or protect the Service.
Referral and acquisition data: the exportlab_referral cookie expires after 30 days at the latest. Account-related referral and acquisition data is retained for the duration of the associated customer account and then deleted or anonymised in line with the rules for account and billing data, unless longer retention is legally required or permitted. Click statistics that cannot be attributed to a website visitor may be retained longer for historical analysis.

Deleted data may remain in backups for a limited period until backup rotation or purge is completed.

18. Security

Exportlab uses technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure.

These measures may include TLS/HTTPS encryption in transit, encryption at rest through infrastructure providers, access controls, role-based permissions, tenant separation, signed URLs, secret management, audit logging, monitoring, vulnerability management, backups, incident response procedures, and need-to-know access for authorized personnel.

No system can be guaranteed to be fully secure. Users are responsible for securing their accounts, using strong authentication, managing team permissions, protecting API keys, and notifying Exportlab of suspected compromise.

19. Your rights

Where Exportlab acts as controller and the legal requirements are met, you may have the following rights:

access to your personal data;
correction of inaccurate personal data;
deletion of personal data;
restriction of processing;
data portability;
objection to processing based on legitimate interests;
withdrawal of consent with future effect;
complaint to a supervisory authority.

You can exercise these rights by contacting hey@exportlab.io.

We respond without undue delay and generally within one month after receiving your request. This period may be extended where legally permitted, depending on complexity and number of requests.

Where Exportlab acts as processor for a customer, please direct your request to the customer who controls the relevant workspace or page. Exportlab will assist the customer where required.

20. Email communications and suppression list

Exportlab sends transactional emails such as account emails, login emails, invitations, upload confirmations, client portal notifications, status notifications, billing notices, security alerts, and service communications.

To maintain deliverability and prevent abuse, Exportlab may maintain suppression lists for email addresses that hard-bounce, repeatedly soft-bounce, unsubscribe where applicable, or generate spam complaints. Suppressed addresses may no longer receive certain emails.

You may contact hey@exportlab.io if you believe an address has been suppressed incorrectly.

21. Automated decision-making

Exportlab does not use automated decision-making that produces legal or similarly significant effects within the meaning of GDPR Article 22.

Certain service restrictions may be applied automatically based on objective criteria such as plan limits, storage limits, token balance, failed payment status, trial status, abuse signals, or security rules. You may contact support if you believe an automated restriction is incorrect.

22. Children and minors

Exportlab accounts are not intended to be created or administered by minors.

Minors may appear in customer-uploaded content or customer workflows, such as photos, videos, guest uploads, group shoots, model releases, or guardian-related forms. In those cases, the customer is responsible for obtaining all required consents, guardian approvals, notices, and legal bases.

If you believe a minor's personal data has been processed unlawfully through Exportlab, contact the relevant customer or contact us at hey@exportlab.io so we can assist where appropriate.

23. Data portability and deletion requests

Customers may download media files and export certain data through available Service functionality. Additional assistance may be requested at hey@exportlab.io.

Some data, such as face embeddings, operational logs, security records, or derived system data, may not be portable in a commonly usable format.

Deletion requests are handled according to applicable law, customer instructions, backup cycles, legal retention requirements, billing retention requirements, and security obligations.

24. Changes to this Policy

We may update this Privacy Policy to reflect changes in the Service, technology, providers, legal requirements, or business operations.

When changes are material, we will provide appropriate notice, such as through email, in-app notice, or a prominent website notice where required.

The "Last updated" date shows when this Policy was last revised.

25. Contact and complaints

For questions, concerns, or requests relating to this Privacy Policy or personal data, contact: