Order Status
Contact us

CEWE Photo Service

Privacy Policy

Language notice:
This English version is provided for convenience and information purposes only. The German version is the legally binding version of this Privacy Policy. In the event of any discrepancy, inconsistency or conflict between the German and English versions, the German version shall prevail.

1 General Information

This Privacy Policy explains which information is collected through the use of the CEWE Photo Service (hereinafter also referred to as “we” or “us”) and how this information is processed. At CEWE, we respect your privacy. All data collected are used to fulfil orders and to improve our services. Data protection and data security for customers and users are a high priority for CEWE. The protection of your personal data throughout all of our business processes is therefore of particular importance to us.

We comply with the statutory provisions of the Swiss Federal Act on Data Protection (FADP), the Data Protection Ordinance (DPO), the Telecommunications Act (TCA), and any other applicable data protection laws under Swiss or EU law, in particular the General Data Protection Regulation (GDPR).

2 Name and Contact Details of the Controller

This Privacy Policy applies to the processing of personal data by the following entity:

CEWE AG
Hochbordstrasse 9
8600 Dübendorf
Switzerland

3 Contact Details of the Data Protection Officer

If you have any questions regarding data protection at CEWE, please feel free to contact our Data Protection Officer or the department responsible for data protection. You may contact the responsible person using the contact details below:

CEWE AG
Data Protection
P.O. Box
4002 Basel
Switzerland

Tel.: +41 (0)44 802 90 33
datenschutz@cewe.ch

4 Type, Scope and Purpose of the Collection and Processing of Personal Data

We process your personal data in accordance with applicable data protection law solely for the purposes connected with the relevant collection of data and to safeguard our legitimate business interests.

4.1 Visiting Our Photo Service Website

Each time you visit our Photo Service website, your device’s internet browser sends information to the server of our website. This information is temporarily stored in so-called log files. The data collected are used to ensure the secure and uninterrupted operation of our systems and to improve our services.

The data records stored in this process include, in particular, the following data:

  • The IP address of your internet connection
  • The software used for the purpose of placing an order
  • The session ID used to identify your connection session
  • The date and time of your visit

The collection and processing of these data are carried out for the purpose of enabling the use of our website, establishing a connection, ensuring the ongoing security and stability of our systems, improving our online offering and for internal statistical purposes. This constitutes our legitimate interest in the processing of data.

4.2 Purchase of Goods and Use of Services

Processing the data described below, which are necessary for the purchase of goods and the use of services, is required in order to take steps prior to entering into a contract and to perform the contract. It is also in our legitimate interest to provide our services in a customer-friendly manner.

4.2.1 Creation of an Online Customer Account and Use of the Services Available Through It

Creating an online customer account is required in order to use the services and features made available as part of an online order. The services and features available for online orders include:

  • Designing photo products via the website
  • Saving image data in the personal online gallery for later use
  • Purchasing additional online storage space
  • Saving personal product designs for later ordering, including CEWE PHOTOBOOK, CEWE CALENDAR, CEWE GREETING CARDS and photo gifts
  • Making digital copies of the CEWE PHOTOBOOK available to other persons (“sharing”)
  • Providing and managing online content linked within products, for example videos in the CEWE PHOTOBOOK
  • Viewing previous orders and downloading copies of invoices
  • Linking the customer account to an existing account in a customer loyalty programme in order to use services offered through that programme in connection with future orders
  • Subscribing to the Photo Service newsletter independently of purchasing products

As part of creating an online customer account, the following personal data are collected, stored and processed for the duration of the contractual relationship:

  • Email address
  • Password, in encrypted form
  • Title, first name and surname
  • Billing and delivery address(es), as well as, where applicable, further payment details, such as credit card information
  • Content added by you, including image data and text

If your customer account has been inactive for 36 months, we will delete the customer account and all data linked to it which we are not required by law to retain for a longer period. If you wish to place a new order at a later date, you will need to create a new customer account. The inactivity period begins with your last login to the customer account. You will be informed by email 30 days before the expiry of the above-mentioned 36-month period about the upcoming deletion of your data and that the deletion can be prevented by logging in to your customer account again.

A customer account that has been inactive for 36 months, together with all data linked to it, will not be deleted in any of the following cases: (1) if you have an active paid prepaid subscription with us, your customer account and the data linked to it will not be deleted during the term of that subscription; (2) if you have outstanding payments due to us, your customer account will not be deleted until the outstanding payment has been made, but no later than the expiry of the statutory limitation period applicable to our claim; or (3) if we have a legitimate interest in further storage, in particular where we require personal data in order to enforce or defend claims, for archiving purposes or to ensure IT security.

4.2.2 Design and Ordering Using the Desktop Design Software (Windows/MacOS/Linux)

The selection and compilation of your image files in preparation for a photo order are carried out using the CEWE Desktop Software exclusively on your computer, without necessarily requiring a connection to one of CEWE’s web servers.

Your computer will only connect to CEWE’s web servers when you request a price update or product update via the internet or submit a photo order to us via the internet.

4.2.2.1 Online Order

Placing an online order using the desktop design software requires an existing online account or an online account that is newly created during the ordering process.

To protect your data, our ordering software does not store personal data by default. However, you have the option to save your username and password in the applications in order to log in more easily. This function is optional and can be selected by you.

Data such as login details, passwords, address details, payment method information, credit card details or bank account details for direct debit payments, as well as order data transmitted when placing an order, are transmitted exclusively via encrypted connections (HTTPS / SSL) and processed on secure servers.

Once an order has been submitted as part of an online order, the order data are retained in production for up to six weeks in order to process any complaints or repeat orders. After that period, these data are irreversibly deleted.

4.2.2.2 Offline Order

When products are ordered offline using a burned CD and a postal mailing envelope, your personal data are stored on the image data carrier. In addition, it is necessary to provide your postal address in order to process the order.

Once an order has been submitted by CD, the customer and order data, including image data, text and designs, are retained in production for up to six weeks in order to process any complaints. After that period, these data are irreversibly deleted. The CD created for transmission will be returned to you separately or together with the goods ordered.

4.2.2.3 Creation and Transmission of Error Logs

In the event of a malfunction of the software, it is possible to submit an error report. This report contains anonymous technical data relating to crashes, which help us to resolve reported errors by means of a software update.

In addition, in the case of complex errors, it may be helpful to create and review a software process log (run log) for analysis purposes. This process log may contain personal data, such as the name of the logged-in user or file names and file paths stored on the computer. You can review the content of the error report before it is transmitted. The transmission of such data is always voluntary.

4.2.3 Design and Ordering Using the Mobile Design Software (“App” for Android/iOS)

4.2.3.1 General Information

Placing an online order using the mobile design software requires an existing online account or an online account that is newly created during the ordering process. Offline orders cannot be placed through the apps.

Our apps connect to our servers for various purposes. This may be necessary, for example, when selecting a market, retrieving and updating price information, or placing an order.

Data such as login details, passwords, address details, payment method information, credit card details or bank account details for direct debit payments, as well as order data transmitted when placing an order, are transmitted exclusively via encrypted connections (HTTPS / SSL) and processed on secure servers.

Once an order has been submitted as part of the ordering process, the order data are retained in production for up to six weeks in order to process any complaints or repeat orders. After that period, these data are irreversibly deleted.

4.2.3.2 Creation and Transmission of Error Logs

In the event of a malfunction of the app, it is possible to submit an error report. This report contains anonymous technical data relating to crashes, which help us to resolve reported errors by means of a software update. You may also add an optional description of the error, which helps us to identify and narrow down the issue.

Error reports are assigned a unique identifier, for example “CFWA-example”. If you provide this code to our Customer Service team during troubleshooting, the error report can be assigned and, where appropriate, individual assistance can be provided. The transmission of such data is voluntary.

4.2.4 Ordering Biometric Passport Photos Through the CEWE Passport Photos App

Our CEWE Passport Photos app enables you to create passport photos that meet the technical requirements for official documents such as passports. For this purpose, the biometric characteristics of the image are checked. These characteristics are used solely to verify whether the image meets the applicable requirements and are not processed separately for any other purpose.

To validate the biometric characteristics, the biometric data of the portrait image are compared with the legal requirements. In this context, we use a software solution provided by Cognitec Systems GmbH. The comparison of biometric data is carried out in accordance with ISO 19794-5 and ISO 39794-5 standards. For this purpose, the image data are transmitted to our servers via secure interfaces. Once completed, you may continue to use the image digitally or transmit it to one of our retail partners for printing at a CEWE Photo Station.

The CEWE Passport Photos App can essentially be divided into the following functions:

  • Taking a portrait photograph
  • Checking biometric characteristics
  • User registration or login
  • In-app purchases

When selecting the following items, user registration or login and the purchase of an item in the app are required:

  • Purchase of a digital passport photo for storage on a smartphone
  • Purchase of a digital passport photo for storage on a smartphone and subsequent printing at a CEWE Photo Station operated by a partner
  • Purchase of a digital passport photo for transmission to public authorities, such as passport offices, driving licence authorities or similar bodies

The personal data collected in this context are used for processing the order and for simplifying future use of the app.

4.2.4.1 Data Transfer to Retail Partners for Printing at a CEWE Photo Station

If you use the printing option, the passport photo created will be transmitted to an external partner from whom you can collect the print. Our partners are independent controllers for data processing. The partners undertake to comply with the applicable data protection requirements and process your data independently in accordance with the requirements of the GDPR and the FADP.

4.3 Access to Online Storage Services (Cloud)

4.3.1 Access to the CEWE MyPhotos Online Storage Service

When designing photo products, you may choose to access the CEWE MyPhotos online storage service. CEWE MyPhotos is an independent service provided by CEWE Stiftung & Co. KGaA and requires a separate user account. Information on the terms of use and data protection can be found on the CEWE MyPhotos website.

https://www.cewe-myphotos.com/

4.3.2 Access to External Online Storage Services

To acess external online storage services provided by third parties, such as Dropbox or Google Photos, it is necessary to link the respective service from within the application. The app will then receive access authorisation limited to the app and your account with the relevant service provider. The access authorisation is stored in the app until you log out of the relevant service in the app. Alternatively, you can generally revoke the access authorisation via the website or settings of the respective service provider.

Use of cloud services requires an account with the respective provider. For more detailed information on data protection, you may contact the responsible provider directly.

4.4 Payment

Depending on the ordering method and the product selected, various payment methods may be available when placing an order, such as payment by invoice, TWINT, credit card or PayPal. Some payment methods are provided by external service providers. The data necessary for payment processing are collected, stored and processed by these service providers under their own responsibility. Further information on the processing of personal data by payment service providers can be found in their respective privacy policies:

4.5 Contacting Us

You may contact us in several ways: by email, telephone, post, or through the chat and customer service services available on our website.

When you contact us, we use the personal data that you voluntarily provide to us in this context. This is done for the purpose of communicating with you, processing your request appropriately, and documenting and tracking the processing of your request.

4.5.1 Zendesk Customer Service Ticket System

We use a customer service ticket system provided by Zendesk to process, manage and document customer enquiries. Depending on the enquiry, we process in particular contact and communication data, order and case data, the content of support enquiries and any attachments submitted.

4.5.2 Customer Service via AI Chatbot

The chatbot assists you with service requests such as questions about products and services, orders, complaints and cancellations, vouchers, and forwarding requests to Customer Service.

In order to process your service request, the messages you enter in the chat, including messages containing personal data, are processed using a generative AI model. Processing takes place exclusively within the Member States of the European Union. Personal data such as your email address, order number, delivery address or billing address are collected and processed where you have an order-related request. Your data are processed solely for the purpose of handling your request and, where necessary, forwarding it to our Customer Service team for further assistance.

The AI may generate incorrect or incomplete responses (“hallucinations”). No liability is accepted for such responses.

Order-related requests are processed in order to perform a contract or take pre-contractual measures. Other use of the chatbot is generally based on your consent.

Chat histories are stored for a maximum of 90 days on internal CEWE servers in Germany and are subsequently deleted. Anonymised and aggregated usage data obtained from them, which cannot be linked to individuals, are stored internally.

Where necessary to process your request, your chat messages may be forwarded internally to CEWE Customer Service. Data are not disclosed to external third parties unless this is necessary for the performance of a contract or we are legally obliged to do so.

4.5.3 Call Recording for Quality Assurance and Training Purposes

With your consent, we record telephone calls with our Customer Service team for quality assurance and training purposes. No recording takes place without your consent.

As part of the recording, we process in particular the content of the conversation as well as accompanying communication data, such as the date, time and duration of the telephone call, and, where provided by you during the conversation, identification and contact data as well as order-related information, such as your name, email address or order number.

Recordings are stored only for as long as necessary for the above-mentioned purposes, but for no longer than 28 days, and are then deleted in accordance with our deletion periods.

You may withdraw your consent at any time with effect for the future.

4.5.4 Remote Assistance

In the event of technical problems connected with the use of our services, or in the case of complex questions relating to their operation, remote assistance may be offered where appropriate and where expressly requested by you.

For this purpose, our Customer Service team will provide you, where necessary, with special remote support software via download. This version does not require installation and can simply be deleted again once use has ended. By running the remote support software and providing our service representative with the displayed connection ID, you consent to the transmission of your screen content to us.

Remote assistance is generally provided in a view-and-guide mode. This means that only your screen content is transmitted to the Customer Service representative, allowing them to see your actions and guide or support you step by step as if they were physically present with you. Although the software used also technically provides the possibility of remotely controlling your computer, we generally do not use this option as part of our support services for your security. Control of your computer therefore remains with you at all times.

The transmission is encrypted and cannot be viewed by third parties. The session is not recorded or stored, and we do not store any personal data as part of this connection.

In order to access the session, Customer Service requires the connection ID generated by the software, which can only be viewed by you. A connection can only be established once you provide this ID to the service representative. Our service representatives may only establish and maintain a connection during the period in which you are simultaneously in telephone contact with our Customer Service team. Any use beyond this is not permitted. Our service representative will only connect to your system for the period necessary to resolve your request.

You retain full control over your computer throughout the session and may end the connection yourself at any time, for example by closing the remote support software, or by asking us to end the session.

Use of this service is free of charge. We accept no liability for disruptions or data loss not caused by us, even if they occur in close temporal proximity to the support provided.

4.6 Review Reminder Through Trusted Shops

If you have given us your express consent during or after your order by activating the relevant checkbox or clicking the button provided for this purpose (“Review later”), we will transmit your email address to Trusted Shops GmbH for the purpose of sending you a reminder to submit a review of your order. Trusted Shops GmbH will then remind you by email of the possibility of submitting a review.

4.7 Data Processing for Advertising Purposes

CEWE has a legitimate interest in using your data for marketing purposes in order to continuously develop our products based on your needs and to offer our services in a customer-friendly manner. Where necessary, we will ask for your consent to process data for advertising purposes.

In order to improve our offering, we reserve the right to supplement your data with additional personal data in compliance with legal requirements. This serves to avoid unnecessary advertising and to better tailor our communications to your needs.

The data may also be used to display personalised online advertising to you. This may take place directly or with the assistance of third-party service providers and/or agencies.

4.7.1 Email Advertising Following Newsletter Subscription

If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to send you our email newsletter on a regular basis.

You may unsubscribe from the newsletter at any time, either by contacting us using the contact details set out in Section 3 of this Privacy Policy or by using the unsubscribe link provided in the newsletter. After unsubscribing, we will delete your email address unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this to the extent permitted by law and of which we inform you in this Privacy Policy.

4.7.2 Email Advertising Without Newsletter Subscription

If we receive your email address in connection with the sale of our goods or services and you have not objected to this, we reserve the right to regularly send you offers by email for similar products from our range, such as products you have already purchased. This serves to safeguard our interest in promoting our products and services to our customers. You may object to the use of your email address at any time by contacting us using the contact details set out in Section 3 of this Privacy Policy or by using the link provided in the advertising email.

4.7.3 Postal Advertising

If we receive your postal address in connection with the sale of our goods or services and you have not objected to this, we reserve the right to regularly send you offers by post for similar products from our range, such as products you have already purchased. This serves to safeguard our interest in promoting our products and services to our customers. You may object to the use of your address at any time by contacting us using the contact details set out in Section 3 of this Privacy Policy.

4.7.4 Analysis for Marketing Purposes

In order to improve our offering and provide communications tailored to your needs, we may analyse personal data from your orders, previous contacts with us, and your usage and purchasing behaviour in order to identify interests and display or send you suitable information, offers or product recommendations. In particular, this may help to avoid unnecessary advertising and make our communication as relevant and customer-oriented as possible.

Profiling is carried out in accordance with the applicable legal requirements. Where consent is required for this purpose, we will obtain it in advance. You may object at any time, with effect for the future, to the processing of your data for direct marketing purposes, including any associated profiling.

5 Cookies, Tracking Tools and Plugins

In order to make visiting our website attractive and to enable the use of certain functions, we use so-called cookies on various pages.

Cookies are small text files that are stored on your device. Some of the cookies we use are deleted at the end of the browser session, i.e. when you close your browser; these are known as session cookies. Other cookies remain on your device and enable us or our partner companies to recognise your browser the next time you visit; these are known as persistent cookies.

You may configure your browser so that you are informed when cookies are set and decide individually whether to accept them, accept them in certain cases, or exclude them generally. If cookies are not accepted, the functionality of the website may be restricted.

In addition, web analytics technologies are used on this website to collect and store data for marketing and optimisation purposes, from which user profiles are created using pseudonyms. These technologies are also often referred to as tracking tools.

These user profiles are used to analyse visitor behaviour and are evaluated in order to improve and tailor our offering to users’ needs. Cookies may also be used for this purpose. Pseudonymised user profiles are not combined with personal data relating to the holder of the pseudonym without the separate and express consent of the person concerned.

Further information about the cookies, tracking tools and plugins we use is available in our cookie settings.

6 Data Transfers

6.1 Data Transfers Abroad

6.1.1 Data Transfers to Countries Within the European Union

As a company operating throughout Europe, CEWE has locations in Switzerland and within the European Union. All CEWE locations outside Switzerland at which the data you submit are or may be processed are located in countries that provide an adequate level of data protection according to Swiss standards. In the case of laboratory orders, the order data are first transferred to CEWE Stiftung & Co. KGaA in Oldenburg, Germany. The data are then transferred to the production location responsible for production on the basis of order-related criteria, such as the selected product, the customer’s place of residence and production requirements. The specific production location for a laboratory order is selected by CEWE as required and at CEWE’s discretion.

6.1.2 Data Transfers to Third Countries Outside the European Union

In order to ensure the high availability and efficient handling of our Customer Service operations, we use certain service providers and technical systems where it cannot be ruled out that personal data may be transferred to third countries, in particular the United States, or accessed from such countries. Such countries may not provide a level of data protection equivalent to that provided in Switzerland or in the EU or EEA.

Nevertheless, we ensure the protection of your personal data in an appropriate manner. Where necessary, we rely on recognised transfer mechanisms, in particular adequacy decisions, certifications under the EU-US Data Privacy Framework or the Swiss-US Data Privacy Framework, Binding Corporate Rules, or standard contractual clauses approved, issued or recognised by the European Commission and the Swiss Federal Data Protection and Information Commissioner. Where necessary, we also take additional technical and organisational measures to ensure an adequate level of data protection.

We also regularly verify that our high data protection requirements are fully met by such service providers.

6.2 Transfer of Data to Third Parties

Personal data are only transferred to public authorities where required by mandatory legal provisions. Your data are only disclosed to private third parties if you have expressly consented to this, if there is a legal obligation to do so, or if this is necessary to enforce our rights, in particular claims arising from the contractual relationship. In addition, we disclose your data to third parties where this is necessary in connection with the use of the website and the performance of the contract, including outside the website, in particular for the processing of your orders.

Our employees are required by us to maintain confidentiality and comply with the applicable data protection provisions.

6.2.1 Processors

CEWE uses processors for the purpose of performing contracts. Processors do not use the data for their own purposes but process the data exclusively on behalf of CEWE. CEWE remains the controller in respect of this processing.

6.2.2 Transfer of Data to Shipping Service Providers

For the purpose of delivering ordered goods, we work with shipping service providers, such as Swiss Post. The following data may be transmitted to these providers for the purpose of delivering the ordered goods and providing delivery notifications: first name, surname, postal address, email address and telephone number.

6.2.3 Transfer of Data Relating to Outstanding Claims to Debt Collection Service Providers

If outstanding invoices or agreed instalments remain unpaid despite repeated reminders, we reserve the right to transfer the data required to carry out debt collection or debt enforcement proceedings to a debt collection service provider for collection on our behalf. We also reserve the right to sell the claims to such provider. In this case, the claim is transferred to the provider, which will assert the claim directly against the debtor. We work with Intrum AG as a debt collection service provider.

Further data protection information can be found in Intrum’s Privacy Policy:
https://www.intrum.ch/de/konsumenten/uber-intrum/ihre-privatsphare-ist-unsere-prioritat/datenschutz…

7 Data Security

All data that you provide to us, including your payment data, are transmitted, processed and/or stored in accordance with generally accepted security standards.

In addition, we use appropriate technical and organisational security measures to protect your personal data stored by us against manipulation, partial or complete loss, and unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

8 Your Rights

In addition to the right to withdraw any consent given to us, you are entitled to the further rights listed below where the relevant legal requirements are met. These rights depend on the applicable data protection legislation and may therefore be more limited or more extensive depending on the circumstances.

8.1 Right of Access

You have the right to request confirmation as to whether personal data relating to you are being processed. Where this is the case, you have the right to request access to such personal data.

8.2 Right to Rectification and Erasure

You have the right to request without undue delay the rectification of inaccurate personal data relating to you and, where applicable, the completion of incomplete personal data.

You also have the right to request that personal data relating to you be deleted without undue delay where one of the legal grounds for deletion applies, for example where the data are no longer required for the purposes pursued.

8.3 Right to Restriction of Processing

You have the right to request restriction of processing, for example where you have objected to processing, for the duration of any review.

8.4 Right to Data Portability

In certain cases, you have the right to receive the personal data relating to you in a structured, commonly used and machine-readable format or to request that such data be transmitted to a third party.

8.5 Right to Object

Where data are collected and processed in order to safeguard legitimate interests, you have the right to object at any time to processing on grounds relating to your particular situation. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for processing that override the interests, rights and freedoms of the person concerned, or where processing serves the establishment, exercise or defence of legal claims.

8.6 Right to Lodge a Complaint with a Supervisory Authority

Where applicable, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of data relating to you violates data protection provisions.

8.7 Right to Withdraw Consent

Where we process data on the basis of your consent, you have the right to withdraw the consent given at any time. Withdrawal of consent does not affect the lawfulness of data processing carried out on the basis of consent before the withdrawal.

9 Applicable Law and Jurisdiction

This Privacy Policy and any contracts concluded on the basis of or in connection with this Privacy Policy shall be governed by Swiss law, unless the law of another country is mandatorily applicable. Subject to mandatory statutory provisions, the courts at the registered office of CEWE AG, Hochbordstrasse 9, 8600 Dübendorf, Switzerland, shall have jurisdiction.

10 Content of This Privacy Policy / Right to Amend

Should individual parts of this Privacy Policy be invalid, this shall not affect the validity of the remaining provisions of this Privacy Policy. The invalid part of this Privacy Policy shall be replaced by a provision that comes as close as possible to the intended economic purpose of the invalid part.

It may become necessary to amend this Privacy Policy as a result of the continued development of our website and services or due to changes in legal or regulatory requirements. The latest version of this Privacy Policy is published on our website. This Privacy Policy was last updated on 2 April 2026.

11 Record of Changes

  • 2nd April 2026
            Addition of the Service Bot; addition of call recording; changes to remote assistance
  • 8th December 2025
            Update of information relating to remote assistance
  • 14th November 2024
            Update and addition of payment providers; addition of the CEWE Passport Photos App
  • 16th January 2024
            Addition of profiling; editorial amendments
  • 1st August 2023
            Addition of the procedure for account deletion
  • 5th August 2021
            Editorial amendments