Privacy Policy

Last updated: 2026-10-08

1. General Provisions

This privacy policy describes how Viktorija Lekavičienė, operating under individual business activity (registration no. 1418392), trading as "Welepix" (hereinafter — "we", "our" or "Welepix"), collects, uses and stores personal data when using the platform welepix.com.

We only process personal data that is necessary for the provision of services, in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Lithuanian legislation.

2. Data Controller

Data Controller: Viktorija Lekavičienė (individual business activity, registration no. 1418392)

Email: [email protected]

2.1 Data Roles

Content uploaded by the User (e.g., photos and related personal data) is processed on behalf of the User. The same applies to data the User processes through the platform about their clients and their guests:

— gallery viewing statistics (time spent on a photo, device type, downloads, selections, screenshot attempts);

— photos uploaded to guest galleries and the name entered by the guest;

— the client database (contacts, notes) and contract signing data (signer name, email, time, IP address).

In such cases:

— The User is considered the data controller

— Welepix acts as the data processor

Welepix is not responsible for the legality of content uploaded by the User.

3. Data We Collect

Registration data: name, email address, password (encrypted).

Payment data: invoice information, payment history (we do not store card details).

Usage data: IP address, login time, browser type, device information, features used.

Uploaded content: photos and files.

Communication data: emails sent through the platform.

Cookies: essential, functional and, only with your consent, analytics and marketing (details in the Cookie Policy).

App data: push notification token, if you allow notifications in the Welepix app.

4. Purposes and Legal Basis

Account creation and management — Performance of contract

Service provision (galleries, storage) — Performance of contract

Payment processing — Performance of contract

Accounting and taxes — Legal obligation

Platform security — Legitimate interest (system protection, abuse prevention)

Fair use monitoring — Legitimate interest (ensuring service stability)

Communication with User — Legitimate interest (customer service)

Website analytics and advertising measurement — Consent (in cookie settings, can be withdrawn at any time)

Promotion codes and newsletter — Consent (see Section 5B)

5. Data Retention Periods

Account data is kept for as long as you have an account. You can delete it at any time yourself in settings or by asking us by email.

Files are kept while the subscription is active. If it is not paid, the services are paused and files are deleted 30 days after the subscription ends. The account remains until you delete it. Storage (archive) files are permanently removed from the cloud within 3 months at the latest.

Payment data and invoices are kept for 10 years as required by accounting law, including after the account is deleted.

The log of sent emails is kept for as long as the account exists.

Website traffic statistics are stored without your IP address, only with a daily changing encrypted identifier, so they cannot identify you.

5A. Group selection (invited friends)

When the User's client enables the "Share with friends" feature, the platform creates a separate selection process where third parties (hereinafter "Participants") may join via a sharing link.

Participant data collected:

— Name (which the Participant freely enters at the start of the selection);

— Cryptographic hash of the IP address (SHA-256, irreversible — used for abuse prevention, not identification);

— Selected photos (Participant's pick history);

— View events (time spent on each photo, number of full-size opens).

Legal basis:

— Name and picks: Participant's consent (GDPR Art. 6(1)(a) — the Participant actively enters their name and voluntarily marks picks;

— IP hash: legitimate interest (GDPR Art. 6(1)(f) — preventing abuse and spam;

— View events: legitimate interest (photographer's business analytics).

Data recipients:

— Photographer (User who owns the gallery): sees the Participant's name and picks;

— Client (who invited friends): sees the Participant's name and picks;

— Welepix: processes Participant data only to the extent necessary for technical operation and security.

Retention period:

Participant personal data (name, IP hash, pick history) is stored as long as the gallery in which the selection took place exists. When the Photographer (User) deletes the gallery or folder, Participant data is automatically destroyed. Anonymized statistical information ("Friend #1", "Friend #2") may be retained longer for the Photographer's business analytics, but without direct Participant identification.

Participant rights:

The Participant may at any time request removal of their data from the platform by contacting [email protected]. Removal is completed within 30 days.

5B. Promotions and newsletter

At events and promotions we may offer a gift (e.g. a free plan). On the dedicated page you leave your name and email address, and we send you a personal discount code.

Data collected:

— full name and email address;

— page language, IP address and the time you submitted the form (to prevent abuse and to prove consent);

— the discount code generated for you and whether you used it.

Legal basis:

— Sending the code: your consent (GDPR Art. 6(1)(a)), given by ticking the checkbox before submitting the form;

— Newsletter: a separate, optional consent (GDPR Art. 6(1)(a) and Art. 69 of the Lithuanian Law on Electronic Communications). If you do not tick the box, we do not send newsletters.

Retention period:

— Promotion participant data and an unused code are deleted automatically 12 months after the form was submitted. If you used the code, it is kept together with the order under accounting rules (Section 5).

— Newsletter subscription data is kept until you unsubscribe. After unsubscribing we keep only the fact and time of unsubscribing so that we no longer send emails.

How to withdraw consent:

Every newsletter contains an unsubscribe link. You can also write to [email protected] and ask us to delete your data. Withdrawing consent does not affect processing carried out before it.

We do not share promotion or newsletter data with event organisers, partners or other third parties. Emails are sent through email service providers (Section 6).

6. Data Transfers

Data may be processed with the help of trusted cloud infrastructure and technology service providers (e.g., storage, CDN, email, payment service providers) that help ensure the platform's operation.

All service providers are selected to ensure a high level of security and compliance with GDPR requirements.

Some service providers may process data outside the European Economic Area. In such cases, European Commission-approved Standard Contractual Clauses (SCC) or other lawful safeguards are applied.

We do not sell personal data. For marketing and analytics purposes data is shared only with Google (Analytics) and Meta, and only if you accept analytics or marketing cookies. For Meta, with your consent, hashed (SHA-256) email, name and phone data are also sent at registration and purchase. More in the Cookie Policy.

7. Your Rights

You have the right to:

— access your data

— rectify it

— erase it

— restrict processing

— data portability

— object to processing

Contact: [email protected]. We respond within 10 working days.

To protect data, we may ask you to verify your identity before processing a request.

8. Data Security

We apply technical and organisational security measures to protect data from unauthorised access, loss or disclosure.

9. Automated decision-making and artificial intelligence

We do not use automated decision-making or profiling that would have a legal or significant effect on the User.

Welepix does not use artificial intelligence to analyse, recognise, tag or select your photos or your clients' photos. There is no facial recognition on the platform.

Your photos and files are not used to train artificial intelligence models and are not shared with artificial intelligence providers. Galleries and share links are closed to AI crawlers.

We use AI tools only in building the platform itself, for writing code and copy. All output is reviewed by a human before publication, and no User or client data is entered into those tools.

10. Complaints

If you believe your rights have been violated, you may contact:

State Data Protection Inspectorate

https://vdai.lrv.lt

11. Changes to Privacy Policy

We may update this privacy policy. We will inform you about significant changes by email or through the platform.