TERMS AND CONDITIONS

Last updated: September 06th 2026

1. Introduction

This policy explains what personal data I collect through https://peoplephotography.store/, why, and what rights you have. I am one person selling photography books and running critique sessions. I collect as little as I can, and I do not sell data to anyone.

2. Who is responsible

Data controller: Moulay Hassan Ouedrhiri, sole trader, Ville Verte, Bouskoura, Casablanca, Morocco. Email contact@peoplephotography.store, WhatsApp +212 661 399 474.

I am established in Morocco, so my processing falls under Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, supervised by the CNDP. Because I offer goods and services to people in the European Union and the United Kingdom, the EU GDPR and UK GDPR also apply to that processing, and this policy is written to meet their standard.

No Data Protection Officer is appointed, as none is required. All data questions come directly to me.

3. Which data I control, and which I do not

The Site leads to three different sellers, and each holds your data under its own policy.

E-books bought on Payhip. Payhip Limited is the merchant of record and the data controller for its checkout. Your name, email address, billing and location data, payment details and tax information are collected by Payhip on its own systems under Payhip’s privacy policy (payhip.com/privacy). I never see your card or bank details. As the author and seller of the product I subsequently receive, through my Payhip dashboard, your name, email address, country, the product bought, the order reference, the amount, and download activity. I am a controller for that information from the moment I receive it, and this policy governs what I do with it. Payhip also sends the review request described in §7 using the address you gave it.

Printed books on Amazon or IngramSpark. They receive nothing from me and I receive nothing identifiable from them. I see only aggregate royalty reports and never learn who bought a printed book.

Critique sessions and the Site itself. Here I am the sole controller: booking and payment data, the images you submit, session recordings, contact messages, reviews, and analytics.

4. What I collect

Site visitors — IP address, browser and device type, operating system, referring URL, pages visited and time on page, through cookies and similar technologies (§10).

Contact enquiries — the content of anything you send by contact form, email or WhatsApp, your email address or phone number, and my replies.

E-book customers, received from Payhip — the fields listed in §3, plus any refund or support correspondence.

Critique session clients — name, email address, billing country, order number and amount, the transaction reference received from PayPal, your preferred language, the images and links you submit, the context you give, and the session recording.

Reviewers — review text, star rating, display name, and the fact that you are a verified purchaser.

I do not knowingly collect special-category data, and I ask you not to send it. Photographs you submit for critique may incidentally reveal such information about the people depicted; I use them only to deliver your session and delete them after 60 days.

5. Why I process it, and on what legal basis

To take payment for and deliver a critique session, and to send transactional email — booking confirmations, joining details, receipts, replacement download links. Basis: performance of a contract. These are not marketing and cannot be unsubscribed from while your order is live.

To meet accounting, tax and consumer-law obligations. Basis: legal obligation.

To answer your questions by form, email or WhatsApp. Basis: steps prior to a contract, or my legitimate interest in replying to enquiries.

To send the automated review requests described in §7. Basis: my legitimate interest in feedback from actual purchasers, together with the existing-customer exemption in Article 13(2) of the ePrivacy Directive and equivalent national rules. You may object at any time.

To handle refunds under the 14-day guarantee, and to detect abuse of it. Basis: performance of a contract, and legitimate interests.

To protect my copyright, including retaining purchase records and using file stamps to trace unauthorised copies (§6). Basis: legitimate interests in protecting my work and my livelihood.

To understand how the Site is used. Basis: your consent, given through the cookie banner.

To publish reviews you submit. Basis: performance of your submission, and my legitimate interest in showing customer feedback.

To establish, exercise or defend legal claims. Basis: legitimate interests.

Where I rely on legitimate interests I have weighed them against your rights and consider the processing proportionate and within your reasonable expectations. Ask and I will explain the assessment. You can object (§13).

6. File stamping and copyright enforcement

The e-books carry no DRM. Instead, purchase and delivery records are retained, and files may carry a discreet visible stamp or embedded metadata identifying the original purchaser — typically your name, the email address used, or a unique order reference.

Purpose: solely to identify the source of a file later distributed without authorisation. Basis: my legitimate interest in protecting copyright, together with the acknowledgement in §9.5 of the Terms. Who sees it: nobody, unless an unauthorised copy surfaces. In that event I may extract and use the identifier to investigate and, if necessary, disclose it to my legal advisers, a platform’s takedown team, or a court. Please note: the identifier travels with the file. If you print pages or share a page image on social media, the stamp may be visible.

7. Automated review request emails

Two separate systems send these, depending on what you bought. They are described separately because the data, the sender and the opt-out differ.

If you booked a critique session on this Site. Approximately four days after your booking, the Customer Reviews for WooCommerce plugin running on my Site generates a review request. The data used is your name, email address, order number and the session booked, held in my WordPress database. The message is transmitted by Resend (§11). The opt-out is described in the email itself, and you can always reply or write to me.

If you bought an e-book on Payhip. The review request is sent by Payhip from its own systems, using the name and email address you gave at its checkout. That processing is governed by Payhip’s privacy policy, and the opt-out or unsubscribe mechanism in that email is Payhip’s.

Legal basis for both. My legitimate interest in feedback from verified purchasers, plus the existing-customer exemption permitting contact with someone who has bought a similar product from me, provided a free and simple opt-out is always offered.

Your control. Opting out of one system does not remove you from the other, since they hold separate lists. Write to contact@peoplephotography.store and I will suppress you in both, immediately and permanently. It costs nothing and changes nothing about your purchase, your files or the support you receive. Reviewing is never required and never rewarded.

Frequency. One request per order from each system.

Retention. In my own systems, your address stays on the review-request list for 24 months after your last order, then is removed. If you opt out I keep a minimal suppression record indefinitely, so that you are never contacted again. Retention on Payhip’s side is governed by Payhip.

8. Critique sessions, images and recordings

Sessions run on Zoom (Zoom Communications, Inc.) or Google Meet (Google LLC / Google Ireland Ltd), which process your name, email address, IP address and audio and video during the call under their own privacy policies.

The photographs, links and context you send are used only to prepare and deliver your session. They are never published, reused, added to my books or used in marketing without your separate written permission.

Sessions are recorded and the recording is shared with you. Basis: your consent, given by joining the call after this notice, together with performance of the contract. You may decline recording before we begin, and you may withdraw consent afterwards and ask me to delete it. Some countries require every participant to consent to recording; accepting these terms at booking and joining the call constitute your consent.

Recordings and submitted images are deleted 60 days after the session, unless you ask me in writing to keep them longer.

9. Reviews you publish

Your review text, rating, chosen display name and, where enabled, your country are published on the Site and may be reused in my marketing. Please do not include personal details you would not want public, and do not identify third parties. I invite and publish reviews only from verified purchasers, and I never hide a review because it is negative. Ask me and I will remove yours.

10. Cookies and similar technologies

The Site runs on WordPress and WooCommerce and uses:

Strictly necessary — cart, checkout and session security for critique bookings, and spam protection. These cannot be switched off and need no consent.

Analytics — Google Analytics 4 via the MonsterInsights plugin. Google LLC and Google Ireland Ltd process your IP address (truncated where anonymisation is enabled), pages viewed and interactions. Jetpack Stats (Automattic Inc.) may also record visits.

Functional and marketing — OptinMonster (Awesome Motive, Inc.) sets cookies to decide when to show a sign-up popup and to remember that you dismissed one. Jetpack may serve images through Automattic’s content delivery network, which receives your IP address.

Spam protection — Akismet (Automattic Inc.) analyses form submissions, including sender IP address, email address and message content, to detect spam.

Non-essential cookies are set only after you consent through the cookie banner. You can also block cookies in your browser, though the booking checkout may then misbehave. Payhip pages set their own cookies under Payhip’s cookie policy.

11. Who receives your data

I do not sell your personal data. It is shared only with:

Payhip Limited (United Kingdom) — as merchant of record and independent controller for e-book sales, and as the platform hosting my store, file delivery, refunds and e-book review requests.

PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, and PayPal, Inc., USA), integrated via the YITH PayPal Payments extension — as an independent controller, for payment of critique sessions, fraud prevention and regulatory compliance.

HostGator (Newfold Digital, Inc., United States) — my web host. The site database, containing critique booking records, contact-form submissions, reviews and the review-request list, is stored on HostGator’s servers, and its server logs record visitor IP addresses.

Resend, Inc. (United States) — my outgoing email provider. Every email the Site sends you, including booking confirmations, joining details, receipts and review requests, passes through Resend, which processes the recipient address, subject line, message content and delivery events, and retains delivery logs for the period configured in my Resend account.

Automattic Inc. (USA) — through WooCommerce, Jetpack and Akismet.

Google — Google Analytics via MonsterInsights, and Google Meet where used for sessions.

Awesome Motive, Inc. (USA) — OptinMonster.

Brainstorm Force — SureForms, which stores contact-form submissions in my site database.

Customer Reviews for WooCommerce — the plugin generating session review requests, running on my own site.

Zoom — where used for sessions.

Professional advisers, tax authorities, law enforcement or courts — only where legally required, or to protect legal rights.

Amazon and IngramSpark receive nothing from me, and I receive nothing identifiable from them.

12. International transfers and retention

I am established in Morocco, which the European Commission has not recognised as providing an adequate level of data protection. My host, my email provider and several other providers are in the United States, and Payhip is in the United Kingdom. Where personal data of EU or UK residents reaches me or those providers, the transfer is either necessary for the performance of your contract, or protected by the provider’s own safeguards — typically the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or certification under the EU–US and UK–US Data Privacy Framework. The UK benefits from an EU adequacy decision. Ask me and I will tell you which applies to a given provider.

Retention periods: order, payment and accounting records, 10 years, as required by Moroccan commercial law; download and delivery records, 24 months, for copyright enforcement and refund-abuse prevention; file stamp identifiers, for as long as the file may circulate; contact and support correspondence including WhatsApp, 3 years from last contact; critique materials and recordings, 60 days; review-request list, 24 months after your last order or until you opt out; published reviews, until you ask for removal; analytics, 14 months; email delivery logs, as configured at Resend; opt-out and suppression records, indefinitely, so I can honour your choice.

13. Your rights

If you are in the EEA or the UK you have the right to access your data, to correct it, to have it erased, to restrict its processing, to receive it in portable form, to object to processing based on legitimate interests, to object at any time to direct marketing including review requests, and to withdraw consent where consent is the basis. I do not carry out automated decision-making producing legal or similarly significant effects.

For data held by Payhip about your e-book checkout, please also contact Payhip directly, since it is the controller for that data. I will help you reach them.

If you are in Morocco you have equivalent rights of access, rectification and objection under Law 09-08, and may address the CNDP at cndp.ma.

If you are in California or another US state with a comprehensive privacy law: you may request to know, delete or correct your personal information, and to opt out of its “sale” or “sharing” for cross-context behavioural advertising. I do not sell your personal information. I will never discriminate against you for exercising these rights.

To exercise any right, email contact@peoplephotography.store. I respond within one month, free of charge, and may ask you to write from the address used for your order so I can confirm it is you.

If you are unhappy with how I have handled your data, please tell me first — but you may complain to your supervisory authority: the CNDP in Morocco, the ICO in the UK (ico.org.uk), or the data protection authority where you live in the EU.

14. Security

The Site runs entirely over an encrypted HTTPS connection. Payment data is handled exclusively by Payhip’s providers and by PayPal and never touches my systems. I use strong unique passwords and two-factor authentication, keep WordPress and its plugins updated, and limit administrative access to myself alone. No system is perfectly secure, but if a breach occurs that is likely to put your rights at risk I will notify you and the relevant authority without undue delay.

15. Children, other sites, changes, contact

The Site is not directed at children and I do not knowingly collect data from anyone under 18; tell me if you believe a child has provided data and I will delete it. The Site links to Payhip, Amazon, IngramSpark and social platforms, and I am not responsible for their content or privacy practices — read theirs before giving them data. I may update this policy; material changes will be posted here and notified by email where required, and the date at the top shows the last revision.

Moulay Hassan Ouedrhiri — Ville Verte, Bouskoura, Casablanca, Morocco — contact@peoplephotography.store — WhatsApp +212 661 399 474.