For your data protection officer
What a DPO or procurement team usually asks before a company buys headshots for its staff, answered in one place. It restates our data protection impact assessment. If you need something that is not here, write to privacy@staffshots.com.
Last updated 3 October 2026
Who is responsible for what
Erik Finans AB (company number 559495-5063, Sweden), trading as Staffshots, is the controller for each person's photograph, for the check that a result looks like them, and for the headshots made from it.
Colleagues join in one of two ways. Invited by email, each signs in with their own account, uploads their own photograph and gives their own consent. Or a team owner adds them by name and email, which creates their account, and uploads a photograph the company took of them, confirming under the owner's own name that the colleague agreed. The colleague is emailed when they are added and when a photograph of them is added, and can see and delete everything from their own account.
Your company is a separate controller for the headshots it receives. We are not your processor, so there is no Article 28 agreement between us, and you do not need one to use Staffshots.
What your company receives
The headshots each colleague unlocks with the team's credits, and the colleague's name, or the part of their email address before the @ if they have not given one. The team's owners can see and download them. Every colleague is told this in the invitation before they join, or in the email that tells them they were added.
Headshots a team member asked the team to pay for, made just for them, are not part of what the company receives unless that member shares them with the team.
A set a colleague buys with their own card reaches you only if they choose to share it with the team. They can take it back whenever they like, and there is deliberately no way for an owner to ask for it.
A colleague can also ask the team to unlock a set they made. A set made outside the team's look always needs an owner's approval. While the request is open, the owners see that set's watermarked previews; after a yes the set is in the team archive like any other team purchase, and after a no the owners no longer see it. Only the colleague can start a request, and they can withdraw it.
Your company never receives a photograph a colleague uploaded themselves, or anything derived from anyone's face other than the finished headshots. A photograph your company uploads is not sent back to it either.
When you create an account, we compare the domain of your email address (the part after the @, for example yourcompany.com) with the companies we have contacted, to measure which of our marketing works. Only the domain is used, never your address or your name, and webmail addresses such as gmail.com are left out.
If you came to us through one of our partners, for example a web design agency, by their link or their code, we record which partner referred you so we can pay them a commission on your company's first order. The partner may learn from us that you bought and what the commission is. They get no photos, no headshots and no account details from us. Nothing is stored on your device for this.
Legal bases
| Purpose | Basis |
|---|---|
| Making headshots from a photograph | Explicit consent, Article 9(2)(a), for the biometric check. Contract, Article 6(1)(b), for the rest. |
| Making headshots from a photograph your company uploaded | Explicit consent, Article 9(2)(a), given by the colleague and confirmed by the uploading owner under their own name. Contract, Article 6(1)(b), for the rest. |
| Giving your company the headshots it bought | Contract, Article 6(1)(b). It is what the company bought, and the colleague is told before accepting the invitation. |
| Showing the team a headshot a colleague bought privately | Consent, Article 6(1)(a), given by the colleague for each image and withdrawable at any time. |
| Inviting the colleagues your organiser names | Legitimate interests, Article 6(1)(f). The colleague decides by accepting or not. |
| Adding a colleague directly and creating their account | Legitimate interests, Article 6(1)(f). The colleague is emailed at once, naming the owner, and can object by deleting the account. |
| Keeping order records | Legal obligation, Article 6(1)(c): Swedish bookkeeping law, 7 years. |
| Showing your name, quote or photos on our website, LinkedIn or sales material, only if you agree to it | Your consent, given directly to us and withdrawable at any time by writing to hello@staffshots.com; we take it down within 7 days. |
| Up to three reminders about a checked photo you have not paid for | Your consent, given by ticking the box (you can withdraw it in any of those emails or in your email settings) |
| For older preview sets, the email when they are ready and up to three reminders before previews you did not buy are deleted | Our legitimate interest in telling you about headshots you started an order for, or asked to preview, and can buy from us, Article 6(1)(f). These are marketing emails. We send them only to an address you gave us yourself when you signed up, after telling you about them there with a box to refuse them, and every one has a link that stops them. At the moment they only go to accounts in Sweden, the United Kingdom and the United States. You can refuse them on your account page or in any of these emails. |
| News, offers and product updates from Staffshots | Your consent, given by ticking the separate box when you sign up. You can withdraw it on your account page or with the link in any of these emails. |
| One reminder email before previews you did not buy are deleted, for photos where you ticked that box at upload before it was replaced | Your consent, given by ticking the box at upload. You can withdraw it with the link in the email, or by turning off the previews email. |
| One email 3 to 14 days after your first purchase asking for a review, only if we have a review page set up | Our legitimate interest in hearing how we did. You are an existing customer, every such email lets you refuse further ones, and we never offer anything in return for a review |
| One team headshots offer to you, 7 to 21 days after buying headshots for yourself with a work email address | Our legitimate interest in offering our customers a similar product, as the Swedish Marketing Act allows for existing customers. Never sent to anyone already in a team, or after a free or gifted order. The email has a link that stops all optional emails for good |
| Your answer to "How did you hear about us?" | Our legitimate interest in knowing which channels bring customers. Answering is optional |
| Comparing the email domain of new accounts with companies we have contacted | Our legitimate interest in measuring which of our marketing works |
| Recording which partner referred you, if you came through a partner's link or code | Our legitimate interest in paying our partners what we agreed with them |
Biometric data
To check that a generated headshot still looks like the person, we compute a numeric template of their face from the photograph and from each result, and compare the two. This is special category data under Article 9. It is processed only with the person's explicit consent, given in its own tick box before upload, and that consent is recorded with the exact wording they saw. The template is deleted after 30 days, or sooner if the photograph is erased, even when the headshot is kept. It is never used to recognise anyone, and there is no face database. When a company uploads the photograph, the owner confirms in the same way that the colleague agreed, and the record names the owner.
Processors and other recipients
| Service | What it does | Where | Safeguard |
|---|---|---|---|
| Google Cloud | Hosting, database and storage | Finland | Google Cloud Data Processing Addendum |
| Google Vertex AI | Generates the headshots from the photograph | Google's global endpoint, which may be outside the EEA | Data Processing Addendum with Standard Contractual Clauses |
| Stripe | Payments, invoices and VAT | EU and US | Stripe DPA with Standard Contractual Clauses |
| Resend | Sending our emails: sign-in links, invitations, receipts, notices, the email when older preview sets are ready and the reminders before unbought previews are deleted (sent from updates@notify.staffshots.com, with the set's dates, how many previews it has and when they are deleted), the reminders about a checked photo you have not paid for (from the same address, with the date it was checked, the date it is deleted and a link to it), and the optional emails (a review request 3 to 14 days after your first purchase, a team headshots offer 7 to 21 days after buying your own headshots with a work email, never if you already belong to a team or the order was free or a gift, and news, offers and product updates only if you ticked that box). The team offer may include your first name and our team prices. Never an image. | Stored in the US, sent from Ireland | Resend DPA with Standard Contractual Clauses, and the Data Privacy Framework between the EU and the US |
| Lovable | Hosts this website. Photographs and account data go straight to our servers in Finland, not through it | Website only | Lovable DPA |
| Google Analytics | Visit statistics, only for visitors who accept them | EU and US | Data Privacy Framework between the EU and the US |
| Google or Microsoft | Sign-in, only for a person who chooses that button | Their own services | Independent controllers. They learn only that the person is signing in to Staffshots |
Transfers outside the EEA
Besides payment details, which Stripe processes in the EU and the US, two things routinely leave the EEA. Photographs go to Google's image model, which has no EU-only endpoint for this work yet. They go with the prompt and nothing else: no name, email address, account identifier or filename, and all metadata is stripped first. Email is stored by Resend in the US. These transfers rest on Standard Contractual Clauses in the providers' data processing terms, and Resend is also certified under the Data Privacy Framework. If you turn on statistics or ad measurement, Google Analytics and Google Ads may also transfer data to the US under the EU-US Data Privacy Framework. Everything else, including photographs and headshots at rest, the database and its backups, stays in Google Cloud's Finland region.
How long things are kept
| What | Kept for |
|---|---|
| The uploaded photograph, the biometric template, and any preview nobody bought | 30 days, then deleted automatically |
| A background image you uploaded, or one a team owner chose for the team | Until you delete it, or your account. It is a picture of the scene behind you, not of you |
| Headshots someone bought | While their account exists. After two years without a sign-in we email a warning, and delete 30 days later |
| An invitation nobody answered, with the address and any name on it | 30 days after it expires |
| Order records and the credit ledger | 7 years, as Swedish bookkeeping law requires |
| Records of administrator access to personal data | 365 days |
| Your answer to "How did you hear about us?" | Until you delete your account |
| Your email choices (the emails about your previews, the reminders among them, and news, offers and product updates), which wording you were shown and when you changed them | Until you delete your account |
| A record of each previews email we sent you | Until the set it was about is deleted |
| Whether you ticked the old reminder box at upload | Until you delete the photo or your account |
| Which partner referred you | Until you delete your account or the team |
Each person can erase a set, a photograph or their whole account from their account page at any time, and erasure reports what was actually deleted.
Security
- Customer images are only made public with that person's own consent, given directly to us. Links to private images are signed and expire within minutes.
- Photographs, headshots and the database live in Google Cloud's Finland region, encrypted at rest.
- Metadata, including location data, is stripped from every upload before it is stored or sent anywhere, and files are stored under random identifiers.
- Keys and passwords live only in Google Secret Manager. Our services authenticate as service accounts, not with keys in code.
- Every time an administrator reads a customer's email address, IP address or photographs, it is recorded. Only a super administrator can read that record, and their reads are recorded too.
- A written breach procedure is in place, built around the 72 hour deadline for notifying the Swedish authority, IMY.
- We do not hold SOC 2 or ISO 27001 certification ourselves. Our infrastructure runs on Google Cloud, which is certified to ISO/IEC 27001 and audited under SOC 2, and payments go through Stripe, a PCI DSS Level 1 service provider.
Our impact assessment
Because the service processes biometric data, we carried out a data protection impact assessment under Article 35 before launch. It was adopted on 22 August 2026, and it is reviewed whenever the model, the transfers, the retention periods or the kinds of data change, and at least once a year. It assesses every remaining risk as medium or lower, so prior consultation with IMY under Article 36 is not required. For questions about it, write to privacy@staffshots.com. It was updated on 3 October 2026 for photographs a company uploads of its own staff, and that risk is also assessed as medium.
Requests from your staff
Each person can erase their own data from their account page. For a copy of their data, a correction, or anything else, they write to privacy@staffshots.com, and we answer within a month. Requests about headshots your company has already received are yours to answer, as their controller. The supervisory authority is Integritetsskyddsmyndigheten (IMY).
Who runs Staffshots
Erik Finans AB
Öljersjö 212
371 94 Lyckeby
Sweden
Company registration number 559495-5063
VAT ID SE559495506301