Política de fotos de menores
LESARI OÜ
Version: 2.0
Last updated: 27 October 2026
Effective date: 27 October 2026
This Children’s Photo Policy explains how photographs of children are handled when customers create personalised products through our website. It forms part of our Privacy Policy and should be read together with it and our Terms of Service.
We have written this Policy to be specific rather than reassuring. Every commitment below is one we can evidence.
1. Purpose and Scope
LESARI creates personalised books and other customised products that may include illustrations generated from photographs provided by customers.
Photographs of children deserve particular care. This Policy sets out, in concrete terms, who may upload a photograph, what we do with it, who else touches it, how long it exists in our systems, and what rights parents and guardians have.
This Policy applies to every photograph of a child uploaded to LESARI, regardless of the product ordered.
2. Who May Upload a Photograph of a Child
A photograph of a child may be uploaded only by:
- a parent of the child;
- a legal guardian of the child; or
- another person who holds the legal authority and the necessary permissions to provide that photograph for the creation of a personalised product.
You must be at least 18 years old, or the age of majority in your country, to place an order.
Before a photograph can be uploaded, you must confirm by an explicit, separate action at the upload step that you hold this authority. We record the fact, date, and time of that confirmation as evidence of consent under Article 7(1) GDPR.
If you do not hold that authority, do not upload the photograph.
3. Legal Basis for Processing
We process a child’s photograph on the basis of the consent given by the parent or guardian at the point of upload, obtained through a clear, unambiguous affirmative action, given for the specific purpose of producing the personalised product ordered (Article 6(1)(a) GDPR).
You may withdraw that consent at any time by writing to [email protected]. The effect of withdrawal depends on the stage of your order:
- Before personalisation begins: we delete the photograph and cancel the order, and any amount paid is refunded in full.
- After personalisation begins but before production: we delete the photograph. Because the product cannot be created without it, the order is cancelled; refunds are handled in accordance with our Terms of Service.
- After production has begun: we delete the photograph, but we cannot recall a product already manufactured or dispatched.
Withdrawal never affects the lawfulness of processing carried out before it.
4. What We Do With the Photograph
A photograph is used for one purpose only: to create the personalised product you have ordered. Within that purpose it may be:
- processed by artificial intelligence and other personalisation technologies to generate original illustrated artwork;
- reviewed by a member of our team where a technical or quality issue arises, or where an automated content-safety check flags the image for human review;
- transmitted to the processors identified in Section 7, solely for the steps described above.
A photograph is never used for advertising, marketing, promotional material, social media, portfolio or sample work, market research, profiling, or any purpose unrelated to fulfilling your order — including where a customer has praised the result or where the image would make attractive publicity. If we ever wish to use an image of a finished product for promotional purposes, we will ask for separate, specific, written consent, and you are free to refuse.
5. Retention and Deletion
We apply strict data minimisation to photographs of children.
| What | How long it is kept | Notes |
|---|---|---|
| The original photograph, in our systems | Deleted within 30 days of upload | Deletion is automated and does not depend on anyone remembering |
| A technical copy held by a processor under its own security controls | Deleted within 60 days of upload in all cases | Not accessible to us and never used to create your product |
| The finished illustration and print file — which contain no photograph | 24 months after delivery | Held so we can reprint your book if it arrives damaged, for as long as your two-year legal guarantee runs |
| The record that consent was given | 3 years | The date, time and account only — never the image |
Photographs are not written to our logs and are not included in our backups.
We do not maintain a searchable database, library, gallery, or training set of children’s photographs.
Each new order requires a new upload. We do not keep photographs on file between orders, and we cannot re-use a photograph from a previous purchase.
What deletion can and cannot guarantee. When we say a photograph is deleted, we mean that it is removed from our systems on the schedule above, and that every provider who handled it is contractually required to delete its copy within a defined period.
We hold those providers to that obligation and we choose them for it. But we cannot inspect another company’s infrastructure from the inside, and no online service can prove with absolute certainty that no copy ever persisted somewhere outside its control — in a cache, a replica or a log. Anyone who tells you otherwise is describing an intention rather than a fact.
That uncertainty is exactly why we work the way we do: we send as little as possible, we keep it for as short a time as we can, we never send the original photograph to our printer, and we use only providers contractually barred from keeping it or learning from it. Minimising exposure is the only honest answer to a guarantee nobody can give.
A consequence worth knowing. Because the original image is deleted within 30 days of upload, we will usually not be able to compare the finished product against the photograph you supplied if a dispute arises later. Where you think the resemblance is wrong, contact us promptly and keep your own copy of the image you uploaded.
6. Artificial Intelligence
Artificial intelligence is used to assist in creating personalised illustrations from the photograph you provide.
Transparency. In accordance with Article 50 of Regulation (EU) 2024/1689 (the “AI Act”), we inform you that the illustrations in our products are generated by artificial intelligence. Where technically feasible, AI-generated image content is marked in a machine-readable format.
No model training. Children’s photographs are never used to train, fine-tune, evaluate, or improve publicly available artificial intelligence models. This prohibition is imposed contractually on every processor that handles the image, and it applies to our own systems as well.
No biometric processing. We do not use facial recognition and do not create, store, or compare biometric templates. Photographs are not used to uniquely identify a natural person and therefore are not processed as biometric data within the meaning of Article 9(1) GDPR. We do not attempt to infer health, ethnicity, or any other special category of data from an image.
No automated decisions with legal effect. No decision producing legal or similarly significant effects concerning a child is taken by automated means. A content-safety check may flag an image, but the resulting decision is always taken by a person.
Artistic interpretation. The resulting illustrations are artistic interpretations in the style of the product selected. Variations in facial features, proportions, colour, hair, and expression are an expected part of the creative process and are not defects.
7. Who Else Handles the Photograph
We do not sell, rent, license, or disclose children’s photographs to third parties.
Within our supply chain, a photograph may be handled by:
| Category of recipient | Role | Location | What they receive |
|---|---|---|---|
| AI and image-processing providers | Processor | EU and United States | The photograph, solely to generate the illustration |
| Cloud hosting provider | Processor | EU | Secure storage of the photograph during your order |
| Print and fulfilment partners | Processor | EU and international | The finished PDF only — never the photograph |
Each processor acts under a written agreement meeting the requirements of Article 28 GDPR, which:
- restricts them to processing on our documented instructions;
- prohibits any use of the image for their own purposes, including model training;
- imposes confidentiality obligations on their personnel;
- requires deletion within a defined period; and
- requires our prior authorisation before engaging any sub-processor.
Where a processor is located outside the European Economic Area, the transfer is protected by Standard Contractual Clauses or another mechanism under Chapter V GDPR, as described in Section 9 of our Privacy Policy.
If you would like to know which provider handles a particular step, write to [email protected] and we will tell you.
We disclose a photograph to a public authority only where legally compelled to do so, and we will notify you unless prohibited by law.
8. Security Measures
Photographs are protected by measures appropriate to their sensitivity, including:
- encryption in transit (TLS) and at rest;
- storage in a segregated processing environment with restricted access;
- access limited to the minimum number of personnel who need it, under the principle of least privilege and subject to confidentiality undertakings;
- multi-factor authentication for administrative access;
- access logging and monitoring;
- automated deletion, so that retention does not depend on someone remembering;
- contractual and, where appropriate, audited security obligations on processors.
No electronic system can guarantee absolute security. If a personal data breach affecting children’s photographs occurs, we will notify the Estonian Data Protection Inspectorate without undue delay and, where feasible, within 72 hours, in accordance with Article 33 GDPR, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Where a breach is likely to result in a high risk to the rights and freedoms of the individuals concerned, we will also notify the affected parents or guardians directly and without undue delay, in accordance with Article 34 GDPR.
9. Rights of Parents and Guardians
As the parent or legal guardian, you may at any time:
- ask what personal data relating to your child we hold, and obtain a copy;
- ask us to correct inaccurate data;
- ask us to delete the photograph and associated personalisation data;
- ask us to restrict processing;
- object to processing;
- request a copy of the data in a structured, machine-readable format to transfer to another provider, where technically feasible;
- withdraw your consent (see Section 3); and
- lodge a complaint with a supervisory authority (see Section 11).
How to make a request. Write to [email protected]. Requests are free of charge. We respond within one month, extendable by up to two further months for complex requests, in which case we will tell you within the first month.
Identity verification. We may ask for information reasonably necessary to confirm that you are the parent or guardian and that the request relates to your order. We ask for the minimum needed and we do not use it for any other purpose.
10. Reporting an Unauthorised Upload
If you believe that a photograph of a child has been uploaded to LESARI by someone who did not have the authority to do so — for example, by another parent, a relative, or a former partner — contact us immediately at [email protected] with the subject line “Unauthorised upload”.
On receiving such a report we will, without undue delay:
1. acknowledge your report;
2. suspend processing of the image and, where production has not been completed, halt the order;
3. verify the report to the extent reasonably possible;
4. delete the photograph and associated personalisation data where the report is substantiated; and
5. inform you of the outcome.
We will act on a credible report even where we cannot conclusively determine the position between two adults, prioritising the interests of the child.
11. Complaints and Supervisory Authority
If you are not satisfied with how we have handled your request, you may lodge a complaint with a data protection supervisory authority, in particular in your country of residence.
Our lead supervisory authority is:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Tatari 39, 10134 Tallinn, Estonia
Email: [email protected] · Web: www.aki.ee
Individuals in the United Kingdom may complain to the Information Commissioner’s Office (www.ico.org.uk).
12. Changes to This Policy
We may update this Policy to reflect changes in our services, technologies, processors, or applicable law.
The current version is published on this page with its version number and “Last updated” date. Where a change is material — in particular any change that lengthens a retention period, adds a processor handling children’s photographs, or expands the purposes of processing — we will notify affected customers in advance and, where the change requires it, obtain fresh consent.
Previous versions are available on request.
13. Contact
LESARI OÜ Kaupmehe tn 7-120, Kesklinna linnaosa, 10114 Tallinn, Estonia Registry code 17372020
Privacy, children’s photo and general enquiries: [email protected]