Terms, Conditions, and Privacy Policy

1. Who We Are

The company responsible for this service and for your personal data (the "Data Controller") is:

Company

Neospawn SL

Tax ID (CIF)

B16428419

Registered address

Calle Sierra Nevada 1, 29640, Fuengirola, Málaga, Spain

Email

[email protected]

2. Service Description

This agreement regulates the provision of school photography services. The service includes capturing photographs of the students, a private online gallery for each registered family, the printing and delivery of the photography packages and extras purchased by parents or legal guardians, and the delivery by download of any digital copies they purchase.

Accepting these terms: you accept these terms when you create your account in our app or accept an invitation to it (or registered through our 2026 pre-registration form), and again whenever we publish a new version of these terms. The latest version you have accepted applies to your use of the app, and each order is governed by the version in force when it was placed (see section 11).

3. Photos Taken at School

On the day of the session, two kinds of photography take place. They have different rules.

Photos for the School's Records

Shine International Academy has asked Neospawn SL to photograph all its students so the school can update its student records. For these photos we act on the school's behalf and follow its instructions, under a written agreement with the school.

• What is taken and delivered: an individual portrait of each student (delivered to the school as a small ID photo), class photos, staff photos and a whole-school photo.
• Permission: these photos rely on the image permission parents have given the school. Questions about how the school uses them should be sent to the school, which is responsible for that use.
• Students not to be photographed: the school tells us which students must not be photographed, and we do not photograph them. We also respect any student who does not want to be photographed on the day.

Your Family Gallery and Orders

Our family service (private online gallery and prints) is only for families who register with us. By registering, you declare that you are the parent or legal guardian of the student (or have the other parent's consent in case of shared custody), and you consent to us using your child's photos to show them in your private gallery and to produce the products you order.

• If you do not register: your child's photos are not placed in any gallery and are not offered for sale. They are used only for the school's records described above.
• Group and class photos: your child may appear in class or group photos alongside classmates. These are only shown in the private galleries of registered families of students in that group.
• Behind-the-scenes photos: informal photos taken while students prepare or play are shown only in the gallery of a registered family whose child appears in them, and only if every identifiable student in the photo belongs to a registered family.
• Students aged 14 or over: under Spanish law, students aged 14 or over may give consent themselves. We will always respect a student's wish not to be photographed.
• Withdrawing consent: you can withdraw your consent at any time by writing to [email protected]. We will then close your gallery and delete your child's photos from our family service. This does not affect anything done before you withdrew it, or the photos already delivered to the school.

4. How We Use the Photos

Your child's photos are used only to deliver the school's records, including class, staff and whole-school photos (section 3), to show them in your private gallery, to produce and deliver the products you order, and to send your child's own photos to the school if you consented to it (see below).

Class and Group Photos for the School

Class photos, staff photos and the whole-school photo are part of the school's records (section 3) and are given to the school that commissioned the session. We do this on the school's behalf, as its data processor, under the image permission parents have given the school; it is not a sharing of your family's photos. If you do not want your child to appear in them, please tell the school. You can also write to us at [email protected] and we will pass your request on to the school.

Digital delivery to the school: the school's records, including the staff photos and the whole-school photo, may be delivered to the school as digital files through a private download link with an access code. We make these deliveries on the school's behalf, as its data processor, in the same way as the class photos.

Sharing Your Child's Own Photos with the School (Optional)

We send your child's own photos to Shine International Academy only if you gave your consent for this in the 2026 pre-registration form. This was completely optional: if you did not give it, none of your child's own photos are sent to the school and your order is not affected. Any future sharing of this kind will be asked for separately, with its own consent form.

• What we send: the digital files of your child's individual photos (and the sibling photo, if any), once your order has been delivered. Class and group photos are covered by the previous paragraph.
• How the school uses them: once the school receives the photos, it is responsible for them and uses them according to the image permission you have given the school and its own privacy policy. For any question about how the school uses the photos, please contact the school directly.
• Changing your mind: you can withdraw this consent at any time by writing to [email protected]. If the photos have not been sent yet, we will not send them. If they have already been sent, we will let you know so you can contact the school about them.

5. Your Personal Data

What We Collect

We collect only:

• Contact details of the parent or legal guardian (name, email, phone), given when you create your account or accept an invitation, or in our 2026 pre-registration form.
• Identifying data of the student (name, grade and class).
• The photographs taken of the student.
• Orders are delivered at the school; we do not ask for your home address.

For the school's records only, the school gives us the student names and classes needed to label the ID photos, and the list of students who must not be photographed.

Why We Use It

The data is used strictly for the creation of photography products, administrative management, and the shipping of orders. We do not use analytical systems, nor do we share data for advertising purposes.

Legal Basis

• Photos for the school's records (including class, staff and whole-school photos): we process them on the school's behalf, as its data processor (Article 28 GDPR). The legal basis is the school's, under the image permission parents have given it.
• Your family gallery and products: your consent (Article 6.1.a of the General Data Protection Regulation, GDPR).
• Sending your child's own photos to the school: your separate, optional consent given in the 2026 pre-registration form (Article 6.1.a GDPR).
• Managing and delivering your order: performance of the contract you enter into with us (Article 6.1.b GDPR).
• Keeping invoices: compliance with our legal tax and accounting obligations (Article 6.1.c GDPR).

Who Receives It

To print the photographs, the image files and the order data needed for printing are sent to our laboratory, Fototecnology, S.L. (Fotolab), CIF B11215050, located in Spain. Fotolab acts only as a "data processor": it may only use the data to print your order, following our instructions, and may not use it for any purpose of its own. Fotolab only looks at the photos to check that the files are correct and print properly, and to confirm which order they belong to.

To run the service, we also use these providers, which act as data processors on our behalf:

• Hostinger International Ltd: our app is run by us on a server rented from Hostinger, located in Paris, France (EU), where your photos, account details and orders are stored.
• Cloudflare, Inc. (DNS and content delivery): traffic to our app passes through its network, which may include servers outside the EU, under the EU Standard Contractual Clauses and the EU–U.S. Data Privacy Framework.
• Hostinger email, for the messages we send you from [email protected].
• Tally BV (Belgium), the 2026 pre-registration form for Shine International Academy. It received only the details entered in that form (never the photos).
• Google (Google Sheets), where we keep the registrations made through the 2026 pre-registration form and the data it collected. It receives only those details (never the photos).

Shine International Academy receives the photos for its records described in section 3, including class, staff and whole-school photos. If you consented in the 2026 pre-registration form, it also receives your child's own photos (see section 4). In both cases the school holds the photos as data controller, under its own privacy policy.

We do not share your data with anyone else, except where required by law (for example, at the request of the tax authorities or a court).

Where It Is Stored

Your child's photos are stored by us and our laboratory within the European Union. Our app, including your gallery, runs on a server we rent from Hostinger International Ltd in Paris, France (EU), where your photos, account details and orders are stored.

The details given in the 2026 pre-registration form (contact details, student name, class, and products ordered) are stored with Tally in the EU and in Google Sheets. Google may process this data outside the EU, for example in the United States. In that case, the transfer is protected by the safeguards approved by the European Commission (the EU–U.S. Data Privacy Framework and Standard Contractual Clauses).

Security

Each family gallery is private: it is not listed anywhere, is not indexed by search engines, and opens only for the members of your family. Each family receives an invitation link, and each member signs in with their own email and password. Please do not share your login with others.

Neospawn SL, Hostinger and our laboratory apply appropriate technical and organisational security measures to protect personal data and photographs against loss and unauthorised access. All communications and exchanges of personal data take place over encrypted connections (HTTPS).

6. How Long We Keep It

• Online galleries: each family gallery stays online until the closing date shown in your invitation (usually 7 to 30 days). After that it is closed.
• Photos: after the gallery closes, Neospawn SL keeps the photos for a limited retention period (normally 60 days), so we can resolve any incidents and complete orders. We then review them and permanently and securely delete them from our app, including the gallery previews; your gallery is closed for good, and only your order history remains. Our encrypted backup copies are deleted automatically within a further 30 days. Order data is kept for as long as needed to manage and deliver your order, and billing data as described below.
• Digital copies: the copies prepared for a download link (for your family or for the school) are deleted within a day of the delivery expiring or being withdrawn by us (for example, if the order is cancelled), and at the latest when the photos themselves are deleted (see "Photos" above). Our encrypted backup copies follow within a further 30 days.
• Photos for the school's records: we delete our copies at the end of the same retention period. Photos of students whose families did not register are deleted at the same time.
• At the laboratory: Fotolab keeps the image files for a maximum of 5 days after printing, only to check quality and fix any problem with the order. After that, they are permanently deleted.
• At the school: how long the school keeps the photos is decided by the school, according to its own privacy policy. Our own deletion periods above still apply to our copies.
• Invoices and billing data: kept for the period required by Spanish tax and commercial law (generally up to 6 years). Invoices never contain photos.

7. Your Rights

At any time, and free of charge, you can:

• Access your data and your child's photos, and get a copy.
• Correct data that is wrong or incomplete.
• Delete your data or ask for the immediate deletion of your child's photos.
• Restrict how we use your data in certain cases.
• Object to the use of your data.
• Receive your data in a commonly used format or have it sent to another company (portability).
• Withdraw your consent.

If you are not satisfied with our answer, you have the right to file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es.

8. Orders, Prices and Payment

• You can order in your gallery in our app (pre-paid packages chosen in the 2026 pre-registration form are included in your gallery). Prices of each photography package and extra are shown before you place your order and include VAT.
• Extras (such as additional prints) can be ordered in your gallery. Packages and extras already paid for in the 2026 pre-registration form are included in your gallery.
• Payment is made by bank transfer, writing your order reference (shown when you place the order and in our email) in the transfer description. No card payment is taken online.
• Your order is confirmed once payment has been received. We will confirm receipt of your payment by email.

9. Delivery

Orders are delivered at the school within approximately 10 working days of the photo session, provided payment has been received by then. If payment is received after the photo session, the 10 working days count from the date we receive it. Orders placed in your gallery in our app are delivered at the school within approximately 10 working days of receiving payment. If there is any delay, we will let you know by email.

Digital Copies

Digital copies you order are delivered by a private download link in your account (My downloads), valid for 30 days. Please download your photos within that time. If the link expires, we can send the copies again while we still keep the photos (normally until about 60 days after the gallery closes, see section 6). After that, they can no longer be sent.

Personal-Use Licence

Digital copies are licensed for your family's personal use. You may print them and share them privately, for example with relatives and friends. Commercial use and resale are not allowed. If you share them, a credit to the photographer is appreciated.

10. Returns and Defective Products

Because the photos are personalised products made specifically for you, the 14-day right of withdrawal does not apply (Article 103.c of the Spanish Consumer Protection Law, Royal Legislative Decree 1/2007).

Digital copies are digital content supplied without a physical medium. When you order them, you expressly ask us to make them available as soon as your payment is confirmed, within the 14-day withdrawal period, and you acknowledge that you therefore lose your right of withdrawal once supply has begun (Article 103.m of Royal Legislative Decree 1/2007). We confirm this in your order confirmation email.

Please check your order as soon as you receive it. If it arrives damaged, incomplete, or with a printing defect, contact us at [email protected] within 3 working days of delivery, ideally with a photo of the problem, and we will reprint it free of charge. This does not affect your legal rights as a consumer.

11. Changes to These Terms

We may update these terms from time to time. The date of the latest version is shown at the top of this page. Orders are always governed by the terms in force when they were placed.

12. Applicable Law

These terms are governed by Spanish law. Any dispute will be resolved by the courts of the consumer's place of residence.