European Union & EEA addendum (GDPR)
This addendum applies if you are in the European Union, the wider European Economic Area (Iceland, Liechtenstein, Norway), or are otherwise covered by Regulation (EU) 2016/679 (GDPR) and the ePrivacy Directive (2002/58/EC, as transposed locally). It supplements our baseline Privacy Policy rather than replacing it.
1. Controller / processor
Galeira is the data controller for account, billing, analytics and abuse-prevention data, and the processor for the photos, videos, voice messages, guest lists, and other event content that hosts collect through the service. Hosts who run public-facing events on Galeira are the controller for that event's content; we process it on their instructions under the standard terms of service (/legal/terms) — a separate negotiated DPA is available on request to privacy@galeira.com.
2. Lawful bases (Article 6)
- Contract (Art. 6(1)(b)) — running your account, taking payment, delivering uploads to the gallery you signed up for.
- Legitimate interests (Art. 6(1)(f)) — abuse prevention, fraud detection, securing the platform, basic non-tracking server logs. A balancing test is recorded internally and re-reviewed yearly.
- Consent (Art. 6(1)(a)) — non-essential cookies, analytics (PostHog), error monitoring (Sentry), face-grouping biometric processing, and the newsletter you sign up for separately. Withdrawn at any time via the cookie banner, the unsubscribe link, or by email.
- Existing-customer email (ePrivacy Art. 13(2)) — the welcome note, year-in-photos recap, unfinished-purchase reminder and occasional product news we send to account holders. These rest on the ePrivacy existing-customer rule rather than on consent, and Article 95 GDPR means no separate Article 6 basis is required for them. Every one carries an unsubscribe link, and Notification preferences in your account settings turns them all off at once.
- Legal obligation (Art. 6(1)(c)) — tax records, lawful requests for assistance from authorities, retention of disputed transaction data.
3. Special categories (Article 9)
If a host enables the optional Find your photos face-grouping feature, we compute biometric face vectors (Article 9(1) special-category data) on Amazon Rekognition. We rely on the data subject's explicit consent (Art. 9(2)(a)) collected by the host before the event (see our host consent template). Vectors are stored encrypted in the EU, deleted with the event, never shared, and never used to train any model.
4. International transfers
Default storage is in the EU (Hetzner Germany — application + self-managed Postgres, Resend eu-west-1, AWS Rekognition eu-north-1 in Stockholm). Legacy face collections may remain in the region in which they were created until the host deletes or recreates them. Transfers to processors outside the EEA (Stripe, Twilio, Sentry, GitHub, Firebase) are covered by the European Commission's Standard Contractual Clauses (2021/914) together with Transfer Impact Assessments where required by the Schrems II ruling. Sentry additionally relies on the EU-U.S. Data Privacy Framework.
5. Your GDPR rights (Articles 15–22)
- Access (Art. 15) — request a copy of what we hold about you.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure / right to be forgotten (Art. 17) — delete your account and uploads.
- Restriction (Art. 18) — pause processing while you contest accuracy or lawful basis.
- Portability (Art. 20) — receive your data in JSON / standard image formats.
- Object (Art. 21) — opt out of processing based on legitimate interests.
- Automated decision-making (Art. 22) — we do not subject you to legal- or similarly-significant decisions made solely by automated means.
To exercise any of these, email privacy@galeira.com. We acknowledge within 5 business days and respond within 30 days. Free of charge unless the request is manifestly unfounded or excessive.
6. Article 27 representative
Until a named in-region representative is appointed, EEA data subjects may contact us at privacy@galeira.com, subject line "Art. 27".
7. Supervisory-authority complaints
You have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement. A list is at edpb.europa.eu.
8. Cookies & tracking
Strictly necessary cookies (session, language, palette) load without consent. Analytics, error monitoring and any future marketing pixels load only after consent is granted via our banner. See our Cookie Policy.
9. Retention
Current-plan retention follows the host's event type and plan: standard Free events keep Galeira's copy for about 30 days without a connected cloud or about 90 days with one; sensitive events have longer 180-day / 365-day windows. New Event and Plus offers include 365 days of hosted storage from the event date, with exact deadlines in the event time zone recorded before checkout. Existing purchases and gifts keep their recorded deadlines. Legacy Event Duo and Account events retain their one-year hosted gallery under the saved terms. Deletion follows the applicable warning, grace and hold process. Approved files successfully mirrored to a host's Google Drive, Dropbox, or OneDrive remain subject to that provider's rules. Legacy Wedding, Forever, and Pro entitlements retain the windows in force when they were purchased. Aggregated, anonymised analytics is retained indefinitely. Audit logs are kept for 24 months for fraud / abuse investigation.