Seven things the law asks of you.
And where Mammut puts them in your hands.
The rules are cited with the article in full, on purpose: so you can check them, or have your advisor check them. This page is information, not legal advice.
A portrait may not be displayed, reproduced or sold without consent; for a minor it is given by whoever holds parental responsibility. The exceptions in art. 97 are exhaustive and do not include selling.
That consent to sell exists, separate from consent to photograph.
Commercial consent is a separate entry in the catalogue. Without it, the photo isn’t sold: the block is on the server, not a warning you can ignore.
The burden of demonstrating consent lies with the data controller — that is, the school.
When it was given, by whom, and which text was in force at that moment.
Every signature keeps the date, time, IP address, device, channel, version number and a fingerprint of the text. You know what was signed, not just that something was.
Withdrawing consent must be as easy as giving it.
That the withdrawal is recorded and that processing stops from that moment.
A button on the consent row. The status changes everywhere, and whatever depended on that permission — selling a photo, delivering it to the family — closes on its own.
Face and biometrics: prohibited, save explicit consent. And non-occasional processing of children’s data with innovative technology requires an impact assessment.
That recognition does not start before the impact assessment.
Face recognition stays off until the school uploads its own document. Remove the document and it closes again. It isn’t a recommendation: it’s a switch.
With joint controllers, the data subject may approach each of them, and each answers for the whole damage. Whoever paid claims back afterwards.
Who is controller, who is processor, and for which perimeter.
The perimeter is decided by the software, not by intentions: a photo taken inside the school’s session and one taken outside it are two separate worlds, with separate documents and consents.
Access to your own data and the right to take it with you.
That the family can see and download their own data, without friction.
In the family portal, «Your data» downloads everything — without going through the office and without opening a ticket.
Accountability: you must be able to demonstrate what you did, and the log must be trustworthy.
That the log cannot be rewritten after the fact — not even by you.
A genuine append-only log: every change is written by the database, not by the application; and a second check refuses every edit or deletion.
We don’t make you compliant.
We give you the proof the law asks of you.
Your advisor writes the privacy notice, and it stays yours: Mammut has an editor and a version number, not a notice generator — the app keeps the record, it doesn’t write it. What we do is duller and more useful: keeping it in a way that holds up the day somebody asks.
Why nobody, at any point,
can forget about it.
A permission that depends on somebody remembering to ask for it will, sooner or later, be missing.
The consent catalogue is yours
Every school writes its own text and raises its own version. You are the data controller: the text cannot be ours.
Whoever signs really signs
For a minor the link goes to the guardian, not to the pupil. Separate boxes, none pre-ticked, the mandatory ones block the submission.
The log isn’t written by the application
The database writes it, whichever way the change arrives: public link, family portal, front desk, checkout, QR code on the slope. Whoever saves a consent doesn’t even know the log exists — and that is exactly the point.
And nobody can rewrite it
A second check, inside the database, refuses every edit and deletion. If one day you delete the person at their own request, the proof that they had consented at the time remains.
The instructor notices out on the slope
Next to every pupil there is the light. Without permission, uploading the photo is blocked — not discouraged — even when it starts from the instructor’s phone.
Where it lives, who sees it,
how it comes back.
Where it lives
The database is in the European Union, in Frankfurt. The files — photos, documents, backups — are on Cloudflare infrastructure, with the standard contractual clauses of GDPR Chapter V. We write the arrangement out in full because that is what your advisor needs to be able to read.
Who sees it
Each school sees only its own. Permissions are per person, and hiding a menu entry doesn’t count as access control: if a section isn’t yours, the server refuses it.
How it comes back
Verified backups, a readable operations log, and export: the school’s data stays the school’s, and the family downloads their own from the portal whenever they want.
Your advisor writes the privacy notices and they stay yours: we keep the proof. You issue invoices here and generate the FatturaPA XML here; filing with the exchange system and legal archiving stay with the accountant. Face recognition starts after your impact assessment. Clear boundaries, stated up front.