Protecting your personal data matters to me. This policy explains what data I process, why, for how long, and what rights you have. I comply with Regulation (EU) 2016/679 (GDPR) and Czech law.
I.
General provisions
1. The controller of your personal data under Art. 4(7) of Regulation (EU) 2016/679 (the "GDPR") is Dominika Vojtíková, Business ID (IČO) 29627222, with registered seat at Vidimská 19, 181 00 Prague 8, Czech Republic, registered in the Trade Register maintained by the Municipal District of Prague 8 Authority (the "controller").
2. Contact details of the controller:
– address: Vidimská 19, 181 00 Prague 8, Czech Republic
– e-mail: hello@bydominikavojtik.com
– web: www.bydominikavojtik.com
3. Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data or an online identifier.
4. The controller has not appointed a Data Protection Officer.
II.
Sources and categories of processed personal data
1. The controller processes the personal data you have provided, or personal data obtained on the basis of your inquiry and the performance of a contract for photography services.
2. The controller processes your identification and contact data as necessary for the purposes below, namely: first name, surname, phone, e-mail address, billing address, and where applicable Business ID and registered seat.
3. Photographs (likeness): In the course of the photography services the controller takes and processes photographs capturing your likeness. Their handling is described in Art. III.
III.
Legal basis and purpose of processing
1. The legal basis for processing is:
– performance of a contract between you and the controller under Art. 6(1)(b) GDPR,
– compliance with the controller’s legal obligations (accounting, taxes) under Art. 6(1)(c) GDPR,
– the controller’s legitimate interest under Art. 6(1)(f) GDPR – handling your inquiry and protecting legal claims,
– your consent under Art. 6(1)(a) GDPR – for publishing photographs in the portfolio and marketing, and for sending commercial communications.
2. The purpose of processing is:
– handling your inquiry and negotiating a contract,
– concluding and performing the contract for photography services and delivering the finished photographs; providing contact and billing data is a necessary requirement for concluding and performing the contract,
– publishing photographs capturing your likeness in the controller’s portfolio, on the website, on social media and in marketing – solely on the basis of your explicit consent, which is voluntary, is not a condition of the shoot, and may be withdrawn at any time,
– sending commercial communications and other marketing activities (optional, based on consent),
– fulfilling the controller’s accounting and archiving obligations.
3. No automated individual decision-making within the meaning of Art. 22 GDPR takes place.
IV.
Retention period
1. The controller retains personal data for the period necessary for the given purpose:
– data for performing the contract: for the duration of the cooperation and thereafter for the applicable limitation periods (usually 3 years after the end of the contractual relationship),
– photographs published on the basis of consent: until consent is withdrawn,
– inquiries that did not lead to a contract: no longer than 12 months,
– data for sending commercial communications: until consent is withdrawn,
– accounting and tax documents: for 10 years, unless the law requires a longer period.
2. After the retention period expires, the controller erases the personal data.
V.
Recipients of personal data (processors)
1. Recipients of personal data are parties:
– operating the website (Adobe Portfolio / Adobe Inc.),
– providing cloud storage and e-mail services,
– providing marketing and analytics services,
– the accountant / tax advisor.
(Adjust this list to the tools you actually use.)
2. The controller intends to transfer personal data to a third country outside the EU (in particular the USA), through providers such as Adobe, Google or Meta. Such transfers take place on the basis of GDPR safeguards – in particular standard contractual clauses or the EU–U.S. Data Privacy Framework.
VI.
Your rights
1. Under the conditions set out in the GDPR you have:
– the right of access to your personal data under Art. 15 GDPR,
– the right to rectification under Art. 16 GDPR, or restriction of processing under Art. 18 GDPR,
– the right to erasure under Art. 17 GDPR,
– the right to object to processing under Art. 21 GDPR,
– the right to data portability under Art. 20 GDPR,
– the right to withdraw consent in writing or electronically (by e-mail to the address in Art. I) at any time.
2. You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz, if you believe your right to the protection of personal data has been infringed.
VII.
Data security
1. The controller declares that it has taken all appropriate technical and organisational measures to secure personal data.
2. The controller has taken technical measures to secure its data storage, in particular password protection and data backups.
3. The controller declares that only persons authorised by it have access to the personal data.
VIII.
Final provisions
1. By submitting an inquiry through the contact form or by concluding a contract, you confirm that you have read this Privacy Policy and that you accept it in full.
2. You give consent to the publication of photographs and to the sending of commercial communications by ticking the relevant box in the form or contract. This consent is voluntary and may be withdrawn at any time.
3. The controller is entitled to amend this Privacy Policy. The new version will be published on its website.
This Privacy Policy is effective from 1 June 2026.