Privacy Policy

1. Roles and responsibilities

1.1 Personal data controller (the School)

The controller of the personal data of students, parents, and school employees is the school or educational institution (the “School”) that creates an account in YEARBOOK.STUDIO (the “Service”) and enters personal data into it.

The School independently:

• Determines the purposes and means of processing personal data
• Obtains the required consents, including consent to publish a person’s image
• Handles data subject rights, including access, rectification, and erasure
• Sets data retention periods and decides when data is erased
• Is responsible for compliance with the GDPR and Polish law

1.2 Processor (YEARBOOK.STUDIO)

YEARBOOK.STUDIO acts as a processor within the meaning of Article 28 of the GDPR. The Service processes personal data only on behalf of and on the documented instructions of the School, to the extent necessary to provide the service.

YEARBOOK.STUDIO:

• Provides the technical tool used to create yearbooks
• Processes data only to provide the service to the School
• Does not independently determine the purposes of processing student data
• Does not disclose data to third parties without the School’s instructions
• Provides appropriate technical measures to protect the data

Creating an account in the Service constitutes entering into a data processing agreement under Article 28 of the GDPR on the terms set out in this Policy and the Terms of Service.

2. Data processed in the Service

2.1 Data entered by the School

• Students’ first and last names
• Class membership
• Photos uploaded to the yearbook, including portrait and class photos
• Quotes and dedications

2.2 School account data

• Email address of the person creating the account (the School Administrator)
• Name of the school or organization

2.3 Data collected automatically

• IP address
• Browser and operating system type
• Session data, including login time and activity in the Service

3. Legal bases for processing

Purpose	Legal basis	Responsible party
Creating a yearbook (student data)	Consent or the School’s legitimate interest	School
Publishing a person’s image in a yearbook	Consent of the person or parent (Article 6(1)(a) GDPR)	School
Providing the service (account data)	Contract (Article 6(1)(b) GDPR)	YEARBOOK.STUDIO
Service security (logs)	Legitimate interest (Article 6(1)(f) GDPR)	YEARBOOK.STUDIO

4. Consent to publish a person’s image

Obtaining consent to publish a student’s image in a yearbook is the sole responsibility of the School. The Service provides a way to record consent digitally, but the School is responsible for:

• Informing students and parents or guardians about the purpose of processing
• Obtaining consent before entering data into the Service
• Handling withdrawal of consent and erasing the data from the yearbook

5. Data recipients and location

Data processed in the Service may be entrusted to:

• Hosting and IT infrastructure providers acting as YEARBOOK.STUDIO subprocessors

Data is stored and processed exclusively within the European Economic Area (EEA). The Service infrastructure is hosted by DigitalOcean in data centers located in the European Union. The specific data center location may change, but the data will always remain within the EEA.

Data is not transferred to third countries outside the EEA. If subprocessors established outside the EEA are used, any transfer takes place only under a mechanism provided for in Chapter V of the GDPR, such as standard contractual clauses or an adequacy decision.

YEARBOOK.STUDIO does not disclose student data to third parties on its own behalf.

6. Retention periods

• Student data and photos — retained until erased by the School or until the account is deleted. The School independently decides when the data should be erased.
• School account data — retained while the Service is used and for 30 days after the account is deleted
• Technical logs — retained for up to 12 months

7. Data subject rights

Students, parents, and school employees have the right to:

• Access their data
• Rectify their data
• Erase their data (the “right to be forgotten”)
• Restrict processing
• Data portability
• Object to processing
• Lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw

Requests should be submitted to the School as the data controller. YEARBOOK.STUDIO provides technical support to the School in handling these rights through Service features such as data export and erasure.

8. Cookies

The Service uses only cookies that are necessary for it to operate:

• Session cookies — maintain the user’s authenticated session
• Preference cookies — remember the selected theme (light or dark) and language

We do not use marketing cookies or third-party analytics cookies.

9. Security measures

YEARBOOK.STUDIO applies appropriate technical and organizational measures under Article 32 of the GDPR, including:

• Connection encryption (HTTPS/TLS)
• Password hashing
• Role-based access control
• Data isolation between accounts (multi-tenancy)
• Regular security audits

10. Personal data breaches

If a personal data breach occurs, YEARBOOK.STUDIO will notify the School without undue delay and no later than 48 hours after becoming aware of it. Reporting the breach to the President of UODO and notifying affected data subjects are the responsibility of the School as the data controller under Articles 33 and 34 of the GDPR.

11. Changes to this Policy

We announce material changes through a notice in the Service. The current version is always available at /en/content/privacy-policy.