1. What this policy covers
Pickit provides a Digital Asset Management and content distribution platform for organizations. This policy explains how personal data is handled when you visit our website, ask about Pickit, communicate with us, or use the platform and its supported applications and integrations.
Personal data is information that identifies you, or can reasonably be linked to you. It can include business contact details, account identifiers, activity records and information about people appearing in files.
This policy describes our processing and your choices. Visiting a website or continuing to use a service does not, by itself, give consent to all processing described here. Where consent is required, it must be obtained separately for the relevant purpose.
Our customers' own privacy notices also apply when they decide why personal data is placed in Pickit or how it is used. A connected service may have its own notice, as explained in section 7. Employment and recruitment processing requires its applicable separate notice.
2. Who is responsible and how to contact us
PicHit.Me International AB, Swedish company registration number 559609-7484, is the data controller for the Pickit website from the date it takes over the operation of the site, planned for 10 November 2026. This includes demo, pricing and support requests submitted through the website and optional website analytics. The change follows the acquisition of the business and assets from the bankruptcy estate of the former operator, PicHit.Me AB (556914-4156). For personal data Pickit processes on behalf of a customer in the Pickit service, the applicable customer agreement and Data Processing Agreement govern Pickit's role.
For a privacy question or request concerning Pickit's own processing, contact privacy@pickit.com. For ordinary product support, use support@pickit.com. Please identify the website or customer organization involved so we can route your request.
3. When we are a controller or a processor
When Pickit determines the purposes and means of processing for its own business, it acts as a controller. Examples include responding to sales inquiries, administering customer business relationships and meeting our own legal obligations. The controller processing covered by this policy is described in section 5.
When a customer determines why personal data is processed through its Pickit environment and Pickit processes it on that customer's instructions, Pickit acts as a processor. This commonly includes personal data in customer files and metadata, provisioned user access and customer-directed content activity reporting. The applicable customer agreement and Data Processing Agreement (DPA) govern this processing. A customer can itself be a processor for another organization, in which case Pickit can be a subprocessor.
A single account or support interaction can involve both roles for different purposes. For example, we can process a file supplied for a customer's support issue on that customer's instructions while administering the support relationship for our own business purposes. Customer organization administrators may be able to see account information and recorded activity relevant to their environment.
This notice does not authorize Pickit to reuse Customer Content or identifiable customer activity beyond the applicable signed agreement, DPA and lawful instructions. A separate controller purpose requires its own lawful basis and transparency; publishing this notice does not create that permission.
For requests about data controlled by your organization, contact its administrator or privacy contact first. You can also contact Pickit; where we act as processor, we assist the responsible controller under its instructions and applicable law.
4. How we obtain personal data
We receive personal data:
- From you, when you submit a request, create or update an account, communicate with us, or use the service.
- From your organization and its administrators, including account invitations, permissions, group membership and files or information they provide.
- From an identity provider or authorized source connection, to the extent needed for the configured sign-in or integration.
- From devices and service interactions, including technical request information, session records and recorded content activity.
- From business partners or professional contacts, where they introduce an inquiry or are involved in your organization's relationship with Pickit.
- From the former operator or its bankruptcy estate, to the extent that business contact details and related account, order or support records are lawfully transferred to support continuity of customer and business relationships. The purposes and lawful bases for Pickit's own processing of those records are described in section 5.
5. Our own business processing and its purposes
The table below describes controller processing under the GDPR. Its lawful bases apply where the GDPR governs the activity. We do not rely on the existence of a contract with your employer alone to claim that we have a contract with you personally.
| Activity | Personal data involved | Purpose and lawful basis |
|---|---|---|
| Website delivery and security | Technical connection information such as IP address, browser/device information, requested pages, dates and diagnostic records, to the extent collected by the hosting and security configuration | Deliver the requested website, diagnose faults and protect it from misuse. Legitimate interests in maintaining a secure, functioning website, subject to a balancing assessment. Separate rules apply to accessing or storing information on your device; see section 8. |
| Demo requests, pricing inquiries and business conversations | Name, work email, organization, role and any information you provide in the request or follow-up | Respond to your request, discuss your organization's needs and prepare a proposal. Legitimate interests in responding to and maintaining business relationships. Steps at your request before entering a contract, or contractual necessity, apply only where you personally are the prospective or actual contracting party. |
| Customer relationship, procurement and billing administration | Business contact details, contact responsibilities, order and invoice information, subscription/payment status and correspondence | Administer our relationship with your organization and payment for the service. Legitimate interests in managing B2B relationships; legal obligations where accounting or other mandatory records are involved; contractual necessity where you personally are the contracting party. |
| Communications and support administration | Contact details, messages, ticket history and relevant diagnostic information | Respond to questions and administer support and service communications. Legitimate interests in helping customers and running the service. Personal data in customer content supplied for support is handled under the customer's instructions where Pickit is a processor. |
| Operational security and service reliability | Account and customer identifiers, login/session information, IP address, application/device context, error records, request timings and security-relevant events | Detect misuse, investigate incidents and operate a reliable service. The basis for Pickit's own controller purposes is legitimate interests in service security and reliability; processing for a customer's purposes follows the DPA. The division of roles is explained in section 3. |
| Product analysis and improvement | Recorded use of features and content, searches and interaction records, where authorized for this purpose | Understand and improve use of the service. Any independent controller use requires an applicable purpose, data minimization and lawful basis. Customer-directed reporting remains processing on the customer's behalf. Analytics requiring device consent must also meet the requirements in section 8. |
| Marketing communications | Business contact details, communication preferences and, where separately enabled, relevant campaign interactions | Send relevant Pickit information. Consent where required by applicable electronic marketing rules; otherwise an assessed legitimate interest where permitted. You can object to direct marketing at any time. |
| Legal obligations and claims | Records relevant to the obligation, dispute or request | Meet applicable legal obligations or establish, exercise or defend legal claims. Legal obligation where applicable, or legitimate interests in protecting legal rights. |
Pickit's website uses its own demo, pricing and support forms. We use the contact details, organization information, request details and any support attachments you submit to route and respond to your request. SendGrid delivers the resulting email to Pickit and any confirmation email to you. These website forms do not send your request directly to HubSpot. We do not include form contents or attachments in website analytics.
Where personal data is necessary to answer a request, verify identity, provide an account or administer a purchase, failing to provide it can prevent that activity. Optional information should be identified as optional when collected. We do not need photographer reward details to provide the enterprise DAM service.
6. Accounts and customer-controlled content
Depending on the customer's configuration and supported sign-in method, account information can include your name, work email, user identifier, organization, permissions and group membership. Authentication can involve account credentials or information supplied by Microsoft Entra ID, Google or a configured SAML identity provider, including identifiers and attributes needed for sign-in and access decisions. Session records can include login and expiry times, IP address, browser/application context and revocation information.
Customer Content can include images, video, documents, presentations and other files, together with filenames, descriptions, tags, author details, usage information, form submissions and other metadata. This can contain personal data about employees, customers, business partners and people depicted or described in the material. Content processing can involve storage, previews, search, metadata management, authorized sharing and delivery to supported destinations, according to the customer's instructions and enabled features.
Recorded activity can include searches, views, downloads, insert actions, interaction times, asset or collection identifiers and names, and user/customer identifiers. These records are not necessarily anonymous. Customers can use available reports to understand their content use. The division between these customer reports and Pickit's own operational purposes is explained in sections 3 and 5.
Customers decide what content to provide, the audience and permissions for their environment, and whether a link, portal or other publication should be accessible externally. Information deliberately shared with an external audience can be viewed or copied by that audience. Imported content has the permissions assigned within Pickit; source-system permissions are not automatically assumed to follow a file into Pickit.
7. Connected sources, API access and AI features
7.1 Authorized integrations
An authorized integration can exchange selected files and metadata, source or destination identifiers, account information and access tokens or permissions needed to operate it. The information exchanged depends on the specific connector, the authorization granted and the configured import or export. Depending on the enabled connection, this can involve Microsoft storage, Google Drive, Dropbox or HubSpot Files export. This does not mean all connectors are enabled for every customer.
Custom applications using the Pickit API can retrieve or submit content within their configured access. Your organization determines which applications to connect and is responsible for its own destination processing. A service acting independently for its own purposes applies its own privacy notice; a service processing on behalf of a customer or Pickit is governed by the relevant processing arrangements. The actual role depends on the service and purpose.
7.2 AI-assisted content processing and retrieval
Where enabled for a customer's environment, AI-assisted processing can extract text from images or documents, generate descriptive image tags, transcribe supported audio or video content, create searchable representations of content, and help retrieve relevant assets or brand guidance. Depending on the particular feature and configuration, processing can take place in Pickit's environment or require sending the relevant image, text, media or search query to a configured processing service. Extracted text, tags, transcripts or search representations can be stored as part of the customer's content environment.
A separately authorized AI assistant connection using Model Context Protocol (MCP) can request information within the connecting user's Pickit access. The external assistant can receive retrieved files or file references, metadata, excerpts, brand guidance and, for supported actions, selected images. Pickit can record the authorized user, connection, requested tool, search query, returned content references and outcome for available activity reporting and operational purposes.
Data delivered into an external assistant is also subject to the customer's arrangement with that assistant provider. Revoking a Pickit connection does not by itself erase information already delivered into an external service or downloaded by a recipient.
7.3 Facial grouping, if enabled
In customer environments with facial grouping enabled, configured image analysis can process photographs and derived face identifiers to group similar faces and help find related images. This information is processed for the customer's configured content-management purpose. The responsible customer must explain that use to affected people and determine the applicable lawful basis and safeguards; using a photograph for facial identification may require additional protections for biometric data.
8. Cookies and similar technologies
Cookies, local storage and similar technologies can support sign-in, session handling, preferences and embedded services. Analytics and marketing technologies have separate purposes and are not automatically necessary because they are included in a website or embedded form.
On the Pickit website, optional browser analytics use Microsoft Azure Application Insights after you choose Allow analytics. You can choose Essential only or change your choice using Analytics settings in the footer. Supported Global Privacy Control and Do Not Track signals keep optional analytics off. Some older blog articles contain YouTube or Vidyard videos that connect to those providers only when you choose to load the video. The Cookie Policy explains the storage, analytics and video choices on the website.
9. Who can receive personal data
Personal data can be accessed by authorized Pickit personnel and service providers where needed for the relevant purpose. Recipient categories include:
- Cloud infrastructure, storage and database providers.
- Authentication and identity providers.
- Monitoring, diagnostics and operational security providers.
- Transactional email delivery providers.
- Sales, CRM, communication and support providers.
- Accounting, payment or billing providers involved in the relevant purchase.
- Providers used for an enabled content connection or AI processing, and destinations selected by the customer.
- Professional advisers and authorities where a specific legal obligation or legitimate legal claim requires disclosure.
Customer administrators and recipients selected by the customer can receive account, activity or content information within the configured environment. Other Pickit entities may receive personal data where needed to provide services under the applicable customer agreement.
Service providers can include Microsoft Azure for infrastructure and website analytics, SendGrid for email delivery, and HubSpot for separate marketing and customer relationship activities, depending on the configured service and purpose. This does not mean every provider receives every category of data. Payment-provider processing, including any Stripe subscription workflow, is distinct from Pickit's enterprise invoicing and depends on the purchase and payment arrangements.
Where Pickit acts as a processor, subprocessors and the customer's notification/objection rights are governed by its applicable DPA. The general privacy recipient description does not replace that contractual list or procedure.
10. Where data is processed and international transfers
Pickit uses Microsoft Azure for platform hosting, including EU regions for media storage. Provider services, support access, connected source or destination systems and customer-authorized AI assistants can involve processing in other countries. EU hosting alone does not establish that all personal data remains in the EU or EEA.
Where GDPR-regulated personal data is transferred outside the EEA, the transfer needs an applicable legal mechanism. Depending on the verified recipient and transfer, this may be an applicable adequacy decision or the European Commission's current Standard Contractual Clauses with the required assessment and any supplementary measures. Other jurisdictions can require additional arrangements.
You can contact our privacy team for information about safeguards relevant to your data and, where applicable, a copy or description of them with confidential details appropriately protected. The former EU–US Privacy Shield and generic labels such as “GDPR compliant” are not a substitute for an applicable transfer mechanism.
11. Protecting personal data
We use technical and organizational measures appropriate to the nature and risk of processing. Our documented approach includes authentication and access controls, encryption, monitoring, backup arrangements and incident handling. Security measures differ by system and configuration. Customers also control their content, permissions, integration authorizations and endpoint access.
No security measure eliminates every risk. If you suspect unauthorized use of an account or disclosure of personal data, contact support or the privacy team promptly. Where an incident requires notification, the applicable law and, for processor activity, the relevant DPA govern those notifications.
12. Retention, return and deletion
We retain personal data for the relevant purpose and applicable legal requirements. Different categories have different retention criteria:
| Category | Retention criteria |
|---|---|
| Inquiries, CRM and business correspondence | The period needed to handle the request and maintain the relevant business relationship, taking account of your preferences, ongoing relevance and legal claims. |
| Controller account and service-administration data | The period needed for account administration and the allocated operational purpose, with any additional period justified by legal obligations or claims. Customer-provisioned data processed on instruction follows the customer's arrangements. |
| Customer Content and related processor data | The applicable customer contract, DPA and documented instructions, including agreed return, export and deletion arrangements. |
| Diagnostics, usage and security records | The period justified for the specific operational or reporting purpose, with access and detail limited appropriately. Different systems can retain different records for different periods. |
| Backups and recovery copies | The applicable backup lifecycle and recovery requirements, subject to agreed deletion arrangements and legal requirements. Removal from active systems and expiry from backup copies can occur through different processes. |
| Invoices and legally required records | The retention requirements of the law applicable to the responsible entity and record. |
| Marketing preferences and suppression records | The information needed to honor communication choices and prevent renewed marketing to people who have objected, subject to applicable law. |
An erasure request does not require deletion of information that applicable law requires us to retain, but retained information must remain limited to its justified purpose. Data delivered to a customer-selected external destination or downloaded by a recipient is also subject to that recipient's processing and deletion arrangements.
13. Your rights and choices
Subject to applicable law and its conditions, you can ask to access your personal data, correct it, erase it, restrict its processing or receive eligible data in a portable format. You can object to processing based on legitimate interests and withdraw consent for future processing where we rely on consent. Withdrawal does not change the lawfulness of processing before withdrawal.
You can object to direct marketing at any time. Use the unsubscribe option in the relevant communication, where available, or contact the privacy team. Necessary service messages have a separate purpose.
You also have rights relating to solely automated decisions that produce legal or similarly significant effects. Content search, extraction and retrieval should be distinguished from decisions about a person.
Send a request to privacy@pickit.com and tell us which account, customer organization or interaction it concerns. We may ask for proportionate information to verify your identity or clarify the request. Please do not send copies of identity documents unless we request them through an appropriate process.
For requests under the GDPR, the controller must respond without undue delay and normally within one month of receipt. Applicable law permits extensions in certain circumstances; where an extension applies, we explain the reason within the required period. This response period is separate from a customer contract's content-return or deletion arrangements. Rights can be limited by law, and we explain any applicable limit.
You can complain to the relevant supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection, IMY. Where the GDPR applies, you can also contact the supervisory authority in the country of your habitual residence, workplace or alleged infringement.
14. Children and information about other people
Pickit's enterprise platform is intended for organizational use. If you believe a child has provided personal data directly to Pickit inappropriately, contact our privacy team so the circumstances can be reviewed. Customer files can depict or describe people of any age; the customer remains responsible for the purpose, notices and applicable legal basis for that content.
Please avoid including unnecessary personal data, sensitive information or information about other people in an inquiry or support message. Where a customer has a justified need to process sensitive content through the platform, it must assess the applicable safeguards and arrangements rather than relying on this general policy alone.
15. Updates to this policy
We update this policy when processing or legal requirements change. Material changes will be communicated as required by applicable law, using a suitable channel for the affected processing, such as a website notice or direct communication.
An updated notice does not itself create consent, amend a signed customer contract or replace a DPA. A new purpose or consent-dependent activity must be assessed and communicated separately as required.
16. Related documents
For information relevant to your use, see the Cookie Policy, Data Transfers information and Security Overview. If Pickit processes personal data on behalf of your organization, consult the DPA incorporated into its agreement; the standard international DPA and US DPA are separate documents.