1. Controller
The controller is Jakub Plšek, Business ID 07883315, Sídl. Olšava 2215, 688 01 Uherský Brod, Czechia. Contact: foto@kubaplsekfoto.cz, +420 735 264 992. No data protection officer has been appointed.
2. Data, purposes and legal bases
For enquiries I process your name, email, optional telephone number, event date and location, and message in order to take steps towards a contract. For booked work I also process contractual, billing and organisational data and the photographs created, as necessary to perform the contract, meet legal obligations and protect legal claims.
Recognisable photographs are published in my portfolio, on social media or for other promotion only with separate, voluntary consent. Consent may be withdrawn at any time without affecting earlier lawful use.
3. Required information
Fields marked as required are necessary to answer your enquiry. Other information is voluntary. I do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
4. Recipients and services
Data is available only to me and service providers where necessary: website hosting and technical infrastructure, Resend for delivering form messages, Google Ireland Limited for Google Analytics 4 (only after consent), Pic-Time for private client galleries, and providers of email, accounting, printing and delivery. They act under instructions or as independent controllers where required by law. I do not sell data or share it for another party’s advertising.
5. International transfers
Some technology providers may use infrastructure outside the EEA. Where a transfer occurs, it relies on an adequacy decision, Standard Contractual Clauses or another safeguard under Chapter V GDPR. Details of a specific transfer are available on request.
6. Retention
- Unsuccessful enquiries: normally up to 12 months after the last communication.
- Contract records: for the contract and normally 3 further years for legal claims; accounting and tax documents for the statutory period, commonly up to 10 years.
- Unedited photographs: normally 1 month after delivery; delivered photographs: normally 1 year, unless agreed otherwise.
- Published photographs based on consent: until consent is withdrawn or the portfolio purpose ends.
- Google Analytics data: according to the service setting and no longer than needed for statistical evaluation.
7. Cookies and analytics
Google Analytics is not loaded and analytics cookies are not stored before you consent. Your choice is saved locally in the browser as kpf-analytics-consent for no more than 180 days so the website can remember it.
After consent, Google Analytics 4 may use _ga and _ga_* to distinguish visits and measure website use, commonly for up to 2 years. Advertising storage and personalisation are disabled. You can withdraw or change consent through “Cookie settings” in the footer; declining does not restrict the website.
8. Your rights
Subject to GDPR conditions, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent. Contact me at the address above; reasonable identity verification may be required. You may complain to the Czech Office for Personal Data Protection or your local supervisory authority.
9. Security and updates
I use proportionate measures including HTTPS, restricted access, form abuse protection and vetted service providers. This notice may be updated when services or legal requirements change; the current version is always published here.