Legal
Privacy Policy
Effective and last updated:
This is a translation of the Thai version. If they differ, the Thai version prevails.
GN Collage ("we") runs an event photo delivery service through gncollage.com and each event's gallery (the "Service"). This policy explains how we collect, use, disclose and protect personal data under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).
It covers two groups: "users", the photographers and organizers who sign in and create events, and "guests", the people who open a gallery through a QR code or link.
1. Data we collect
From users
- Google account data: name, email address and profile picture
- Google Drive access tokens granted when signing in
- Event data: name, description, date, linked Google Drive folder, QR code and watermark settings
- Photos from the folders users choose: thumbnails and files cached to show and download them
- Device and sign-in data: device ID, device name and last activity time
- Usage logs: pages opened, actions taken, IP address, browser, operating system and device type
- Support data: subject, messages and attached screenshots
- Package and entitlement data
From guests: a random session ID, IP address, browser and operating system, how often and when a gallery was opened, downloads, and face search logs (number of searches and number of photos found). Guests do not sign up, and we do not ask for their name or email.
2. Face data
When the event owner's package includes Face Search, the Service detects faces in that event's photos and creates face representations (face embeddings) with each face's position in the photo, used only to search photos within the same event. This is biometric data, a sensitive category of personal data.
- Face data is not used to identify people across events, is not sold and is not disclosed to others.
- The image a guest takes or picks to search is used to create a temporary face representation for matching and is not stored after the search.
- Using Face Search is the guest's consent to processing the image used to search. Guests can always browse the whole event without it.
- Face data for an event's photos is deleted when the photo or event is deleted, or when the owner's package no longer includes the feature.
3. Purposes and legal bases
- Contract: creating accounts, managing events, syncing photos from Google Drive, showing galleries, applying watermarks and answering support cases
- Consent: processing the image a guest uses for Face Search, and cookies for in-depth analytics and marketing
- Legitimate interests: security, preventing misuse, enforcing package device limits, aggregate statistics and improving the Service
- Legal obligations: complying with the law and orders from competent authorities
4. The event owner's duties to people in photos
Photos a user brings in are the user's data. As event owner, the user is the data controller for the people who appear in them and must notify or obtain consent from those people as the law requires, especially before turning on Face Search and where minors appear.
We process those photos on the user's instructions, only to provide the Service under the Terms of Service.
5. Google Drive connection
- At sign-in the Service requests profile, email and Google Drive access with the drive.file scope.
- The Service reads folder lists and the image files in folders the user links to an event.
- The Service creates a new folder, or moves a folder to the Google Drive bin, only when the user asks for it in the folder picker.
- The Service does not modify original files in Google Drive and does not make folders public.
- Data obtained from Google APIs is used in line with the Google API Services User Data Policy, including the Limited Use requirements. It is not used for advertising, not sold and not used to train AI models.
- Users can revoke this access at any time at https://myaccount.google.com/permissions
7. International transfers
Some service providers store or process data outside Thailand. We choose providers with appropriate data protection standards as the PDPA requires.
9. Retention
- Accounts and events: while the account is active, or until the user deletes them or asks us to
- When an event is deleted: its thumbnails, cached files and face data are deleted. Files in the user's Google Drive are not deleted
- Usage and visit logs: kept as long as needed for security and statistics
- Support cases: for the life of the account
- When an account is deleted on request: data is deleted or anonymized, except where the law requires us to keep it
10. Security
Data travels over HTTPS, Google tokens are stored and used server-side, staff access is limited by role, and simultaneous sign-ins are limited per package. No system is perfectly secure. If a breach poses a risk, we will notify the authority and affected people as the law requires.
11. Your rights
- Access your data and receive a copy
- Correct inaccurate data
- Have data deleted or destroyed
- Restrict the use of data
- Object to processing
- Data portability
- Withdraw consent, without affecting processing done before
- Complain to Thailand's Personal Data Protection Committee (PDPC)
Use these rights through the contact channels below. We reply within 30 days of receiving the request. Guests who want their photos removed from a gallery can contact the event owner directly, or contact us to coordinate.
12. Minors
User accounts are for adults, or minors with consent from a parent or guardian. Event owners who bring in photos of minors must have parental consent as the law requires.
13. Changes to this policy
We may update this policy and will change the date above. Material changes are announced in the Service or by email before they take effect.
14. Contact
- Email: dev.ezweasyweb@gmail.com
- Facebook: https://www.facebook.com/profile.php?id=61589792805063
- Signed-in users: Report a problem in the account menu