Privacy
Personal Data Processing Information for Clients
The data controller within the meaning of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR") is Michal Kašpar, ID: 08352020, registered office at Masarykovo náměstí 20, 751 03, Brodek u Přerova ("Controller").
The Controller's business activity is the provision of photography services, in the course of which personal data of the Controller's clients (also referred to as "data subjects") are processed. The Controller is not required to appoint a Data Protection Officer within the meaning of the GDPR.
Categories of personal data and purpose of processing
Clients' personal data are processed to the following extent:
- Identification data: first name, surname
- Contact data: delivery address, phone, email
- Other data: bank account number, photographs
Clients' personal data are processed for the purpose of maintaining the contractual relationship and fulfilling the obligations arising from it. The data are also processed to comply with statutory obligations, in particular tax obligations and obligations toward supervisory authorities. The data are likewise processed on the basis of the Controller's legitimate interest, in particular in connection with handling inquiries, complaints, requests, or claims of the data subjects.
Processing of clients' personal data (photographs) for the purpose of publication on the Controller's website at www.michalkaspar.com, on the Controller's social media at www.facebook.com/mchlkspr and www.instagram.com/michalkaspar.ai, or in the Controller's portfolio for the purpose of promoting the Controller's activities, is possible only on the basis of the client's express consent.
Sources of personal data
The Controller processes personal data obtained directly from its clients on the basis of contracts entered into, or, where applicable, on the basis of express consent.
Recipients of personal data
In justified cases and only to the extent necessary, the Controller may transfer clients' personal data to the following categories of recipients (or processors):
- Supplier companies
- Payment gateway providers
- IT service providers
- Print service providers
Clients' personal data will not be transferred to third parties established outside the European Union.
Rights of data subjects
A natural person who is a data subject has the right to:
- Access their personal data under Article 15 of the GDPR
- Rectification of inaccurate personal data under Article 16 of the GDPR
- Erasure of their personal data under Article 17 of the GDPR
- Object to processing under Article 21 of the GDPR
- Restriction of processing under Article 18 of the GDPR
- Data portability to the extent established by applicable law under Article 20 of the GDPR
- Lodge a complaint with the Controller or with the Office for Personal Data Protection if they believe their personal data protection rights have been violated
For any inquiries, clients may contact the Controller by email at info@michalkaspar.com or by phone at +420 778 719 597.
Duration of processing
Clients' personal data will be processed by the Controller for the duration of the contractual relationship and further for the period during which any claim arising from the contract may be asserted. After this period, the Controller will dispose of the clients' personal data, unless authorised or obliged to process the data on another legal basis.
Personal data may also be processed by the Controller for the duration of any court proceedings. Personal data processed by the Controller on the basis of the clients' consent are stored for the period for which consent to such processing was granted, i.e. for a period of five years from the granting of consent, or until consent is withdrawn, if consent is withdrawn before this period expires.
Unedited photographs (raw formats) are archived for one month from the delivery of the commission to the data subject, after which the data will be deleted by the Controller. Edited photographs delivered to the data subject in electronic form are archived by the Controller for one year from delivery.
Once the purpose of processing ceases, all data of the data subjects serving that purpose will be deleted.
Personal data security
The Controller declares that it has adopted all appropriate technical and organisational measures to secure personal data.
Cookies & analytics
This site uses Google Analytics 4 to understand how visitors interact with the site. Analytics cookies are only loaded after you accept them via the cookie banner. You can review or change your choice at any time — manage cookies.
