Privacy Policy

DepoPlace OÜ Last updated: June 21, 2026

This Privacy Policy (the "Policy") explains how DepoPlace OÜ ("Depo", "we", "us") processes personal data as the controller. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

This Policy covers the Depo platform at depo.place (the marketplace, profiles, subscriptions, magazine submissions, content hosting and related services). Event-specific activities (for example Depo Awards events) may be governed by an additional event-specific privacy notice, which prevails over this Policy for that event where they conflict.

The controller of your personal data is:

DepoPlace OÜ Registry code: 17357640 Sepapaja tn 6, Lasnamäe district, Tallinn, Harju County, 15551, Estonia Email: info@depo.placePhone: +372 53683341

The supervisory authority for Estonia is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) — see Section 12 for your right to lodge a complaint.

We collect the following categories of personal data, depending on how you use Depo:

• Account and profile data: first and last name (or pseudonym), username, email address, password (stored in hashed form), date of birth, gender, country/place of residence, professional category and links you choose to add (e.g. website, Instagram, TikTok, Pinterest), and co-author names you provide.

• Content you upload: photographs, videos, articles and similar works, together with titles, descriptions and credits. These works frequently depict identifiable people (you and/or models and others portrayed). See Section 3.

• Transaction data: records of subscriptions, submissions, purchases and payouts; payment-method type; and confirmation/receipt data. We do not store full card numbers or CVV codes — card payments are handled by PCI-DSS-compliant payment providers (see Section 7).

• Usage, device and cookie data: service-usage records, access logs, IP address, device and browser information, advertising identifiers (e.g. AAID, IDFA) and interactions with the platform. See Section 9.

• Location data: approximate location derived from your IP address.

• Communications: messages you exchange through the platform and correspondence you send us (see Section 6).

• Social-login identifiers: if you connect a Google, Facebook, Instagram or similar account, the user identifier provided by that service.

We collect personal data that you provide to us, that we generate as you use the service, and that we receive from authorised third parties.

Because Depo is built around photography of people, we treat the status of images transparently:

• As a rule, photographs are processed as ordinary personal data under Article 6 GDPR.

• We do not apply facial-recognition or other biometric identification technology to uploaded images, and therefore do not process biometric data for the purpose of uniquely identifying a person.

• A photograph may nevertheless reveal special-category data within the meaning of Article 9(1) GDPR (for example data revealing racial or ethnic origin, health, or a person's sex life or sexual orientation), including in artistic or editorial works. Where you upload a work that contains or reveals such data, our processing of that work relies on your explicit consent (Article 9(2)(a)) and/or on the fact that the data has manifestly been made public by the data subject (Article 9(2)(e)).

Publication and public display of your uploaded content is based on your consent and on the content licence in our Terms & Conditions; you can withdraw that consent and request removal as described in Section 12, subject to the limits that apply to material already printed or distributed.

We ask you not to include unnecessary sensitive information in titles, descriptions or messages.

• Depo accounts may be created and held only by adults aged 18 or over. Minors are not users, subscribers or payees, and do not hold accounts.

• A minor may appear on Depo only as a depicted subject within children's content uploaded by a verified adult account holder who is the minor's parent or legal guardian, or an authorised representative holding documented parental/guardian authorisation. This processing relies on the consent of the holder of parental responsibility in accordance with Article 8 GDPR, and the uploader must retain and provide that consent on request.

• Children's content is kept strictly and absolutely separate from any mature / age-restricted content on the platform. This separation is described in, and enforced under, our Content Policy.

• We do not knowingly process the personal data of a minor outside the route described above. If we learn that a minor has provided personal data contrary to this Policy, or that content involving a minor has been uploaded without the required parental/guardian consent, we will remove the data/content and take account action.

• For users in the United States: consistent with the U.S. Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13.

If you believe a minor's data has been processed improperly, contact us at info@depo.place and we will act.

• Purpose: Create, operate and secure your account; provide the platform and the services you request; Legal basis: Performance of a contract (Art. 6(1)(b))

• Purpose: Process submissions, subscriptions, orders, payments and payouts; Legal basis: Performance of a contract (Art. 6(1)(b))

• Purpose: Publish, display, promote and exhibit content you upload; where a work reveals special-category data; Legal basis: Consent (Art. 6(1)(a)); for special-category content, explicit consent (Art. 9(2)(a))

• Purpose: Enable communication between users; Legal basis: Consent of each user concerned (Art. 6(1)(a))

• Purpose: Platform safety, content moderation, fraud and abuse prevention, defending legal claims, improving the service; Legal basis: Legitimate interests (Art. 6(1)(f))

• Purpose: Send administrative/service messages (changes to terms, security, account notices); Legal basis: Performance of a contract / legal obligation (Art. 6(1)(b)/(c))

• Purpose: Send marketing messages; Legal basis: Consent (Art. 6(1)(a)), or legitimate interest for existing customers where permitted (Art. 6(1)(f))

• Purpose: Accounting, tax, and responding to lawful requests from authorities; Legal basis: Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, we balance those interests against your rights and freedoms, and you may object as described in Section 12.

The platform includes internal messaging. So that we can keep the platform safe and lawful, authorised members of the Depo team may access messages and shared content for defined purposes only — content moderation, safety, fraud and abuse prevention, handling reports of illegal content (including under the Digital Services Act), responding to support requests, and complying with legal obligations. This access is based on our legitimate interests and the performance of our contract with you (Art. 6(1)(b)/(f)), is limited to what is necessary for those purposes, and is not general surveillance for unrelated purposes.

We share personal data only as needed to run the service, with providers acting on our instructions and bound by data-processing terms. We do not sell personal data. Our principal recipients/processors are:

• Recipient / processor: Stripe; Purpose: Payment processing; Location: USA

• Recipient / processor: PayPal; Purpose: Payment processing; Location: USA

• Recipient / processor: Wise Europe SA/NV; Purpose: Payments / payouts; Location: Belgium (EU)

• Recipient / processor: MagCloud (HP Inc.); Purpose: Print-on-demand production; Location: USA

• Recipient / processor: Hetzner Online GmbH; Purpose: Hosting / infrastructure; Location: Germany (EU)

• Recipient / processor: Google Workspace; Purpose: Email / communications; Location: Ireland / USA

• Recipient / processor: Google Analytics; Purpose: Website analytics; Location: USA

• Recipient / processor: Microsoft Clarity; Purpose: Session analytics / UX; Location: USA

• Recipient / processor: Event venues / local partners; Purpose: On-site logistics for specific events; Location: EU (per event)

We may also disclose data to public authorities or other third parties where required by law, to enforce our terms, to respond to claims about third-party rights, or to protect the rights, property or safety of Depo, our users or the public. If Depo's business or assets are transferred (for example through a merger, sale or reorganisation), personal data may be transferred to the acquirer under this Policy.

Some recipients are located outside the European Economic Area (in particular in the United States — Stripe, PayPal, MagCloud, Google, Microsoft). Where personal data is transferred to a third country not covered by an EU adequacy decision, we rely on appropriate safeguards under Article 46 GDPR, principally the European Commission's Standard Contractual Clauses (SCCs), supplemented by additional measures where required. You may request information about these safeguards at info@depo.place.

We use cookies and similar technologies (pixels, tags, web beacons). Cookies fall into categories: strictly necessary (required for the site to work), analytics (e.g. Google Analytics, Microsoft Clarity), and marketing.

Non-essential cookies (analytics and marketing, including tags loaded via Google Tag Manager) are set only after you give prior consent via our cookie banner. You can accept all, reject all, or choose categories, and you can change your choice at any time. Details are in our Cookie Policy.

We keep personal data only as long as necessary for the purposes above:

• Account and profile data: for the life of your account and up to 12 months after closure, unless a longer period is needed to defend legal claims.

• Uploaded works and published content: while they remain part of the platform or archive and your consent stands; on withdrawal we cease further use, subject to the limits on material already printed or distributed.

• Transaction and accounting records: retained for 7 years, as required by Estonian accounting and tax law.

• Parental/guardian consent records and uploader verification: retained for as long as the related content remains published, and for up to 3 years after its removal, to demonstrate the lawful basis.

• Support correspondence: retained for up to 2 years.

• Marketing consent and suppression records: until you withdraw consent; we keep a suppression record so we can continue to honour your opt-out.

• Cookies: for the lifetimes stated in the Cookie Policy.

We apply appropriate technical and organisational measures to protect personal data, including access restrictions, secure authentication and encryption in transit. No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we work to protect your data and to respond appropriately to any incident.

Under the GDPR you have the right to: access your data; obtain rectification or erasure; restrict or object to processing (including processing based on legitimate interests and direct marketing); data portability; and to withdraw consent at any time (without affecting prior lawful processing). To exercise these rights, use the tools in your account settings or contact us at info@depo.place. We will respond in accordance with applicable law.

You also have the right to lodge a complaint with a supervisory authority. In Estonia this is:

Andmekaitse Inspektsioon (AKI) Tatari 39, 10134 Tallinn, Estonia www.aki.ee · info@aki.ee· +372 627 4135

If you do not provide personal data that is necessary for a service, you may be unable to use that service.

We send marketing messages only where permitted. You can opt out at any time by clicking the unsubscribe link in any marketing email, updating your account settings, or contacting us. After opting out you may still receive non-marketing service messages necessary to administer your account.

We may update this Policy. The current version and its revision date are always shown at the top of this page. We will notify you of material changes in a clear and noticeable way; material changes apply prospectively. You may download or print a copy of this Policy at any time.

DepoPlace OÜ, Sepapaja tn 6, Lasnamäe district, Tallinn, 15551, Estonia — info@depo.place.