GDPR Compliance

If you photograph clients in the European Union or market to EU residents, GDPR applies to you. The General Data Protection Regulation governs how you collect, store, and process personal data. Here's how creavio helps you stay compliant.

What GDPR Requires

At its core, GDPR requires that you:

Have a lawful basis for collecting personal data
Tell people what data you collect and why
Allow people to access, correct, or delete their data
Protect data from unauthorized access
Report data breaches within 72 hours

creavio's Built-In Protections

creavio provides several GDPR-compliant features out of the box:

Data encryption: All client data is encrypted in transit (TLS) and at rest (AES-256)
Consent tracking: When clients fill out forms or sign contracts, their consent is recorded with timestamps
Data access requests: Clients can request a copy of all data you hold about them. creavio can generate this report automatically.
Right to erasure: You can permanently delete a client's data including all images, emails, and records
Data Processing Agreement: creavio provides a DPA that covers our role as your data processor

Setting Up GDPR Features

Go to Settings > Privacy > GDPR
Enable cookie consent banner for your website
Enable data collection notice on forms and booking pages
Review and customize the privacy notice text
Upload your privacy policy or use creavio's template as a starting point

Handling Data Requests

When a client requests their data or asks for deletion:

Go to their client record
Click Privacy > Export Data (for access requests) or Privacy > Delete All Data (for erasure requests)
Confirm the action
creavio logs the request and your response for compliance records

Important Note

creavio provides the tools for GDPR compliance, but you are the data controller. This means you're ultimately responsible for how you collect and use client data. We recommend consulting a legal professional to ensure your specific practices meet GDPR requirements for your situation.