Privacy Notice
How Crestford handles account data, project files and personal photographs.
1. What Crestford processes
Depending on the service, Crestford may process account information, contact details, order details, payment-status information, uploaded photographs or videos, generated results, project messages, technical/security logs and customer-support communications. Photographs or videos containing identifiable people are personal data.
2. Why we process it
- To create and manage Crestford accounts.
- To perform the service the customer orders and deliver results.
- To process payments and prevent fraud.
- To provide customer support, project updates and account history.
- To protect the service and comply with legal obligations.
3. Legal bases
Most project processing is necessary to perform the customer's contract or take steps requested before entering into that contract. Some processing may be required by law or carried out for legitimate security and business-administration interests. Where Crestford relies on consent, the consent request should be separate, clear and capable of being withdrawn.
4. Uploaded family photographs
Customers should only upload material they are entitled to provide. If a photograph identifies another living person, the customer should consider whether they have an appropriate right, permission or other lawful basis to submit it. Crestford processes uploaded material for the requested project and does not assume permission to publish it publicly.
5. AI and production providers
To perform a project, Crestford may transmit uploaded material and project instructions to carefully selected hosting, storage, payment, AI-processing or production service providers acting under appropriate contractual and data-protection arrangements. The final live Privacy Notice should identify the categories of providers and, where required, explain international-transfer safeguards.
6. Retention
Account, order and payment records are kept for as long as reasonably necessary for account administration, legal, tax, accounting, dispute and security purposes. Project media and generated files are retained according to the service's operational retention period and may be deleted when no longer needed. The final launch version should publish the applicable project-file retention period or the criteria used to determine it.
7. Portfolio use
Crestford will not treat a customer upload as permission to use private family material in advertising, social media or a public showcase. Public portfolio use should require a separate permission or another valid legal basis.
8. Your data-protection rights
Subject to the GDPR and applicable Maltese law, individuals may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent where consent is relied upon. They may also lodge a complaint with Malta's Information and Data Protection Commissioner.
9. Security
Crestford's live architecture is intended to use authenticated accounts, private project storage, role-based access and server-side secrets. No online service can guarantee absolute security, but access should be restricted to what is needed to provide and administer the service.
10. Cookies and local storage
Strictly necessary account/session storage may be used to keep the service working. Non-essential analytics or advertising cookies should not be activated for Maltese/EU visitors without the required consent mechanism.