Privacy Policy
Last updated: August 25, 2026
This policy describes how PiTrio processes personal data in accordance with Regulation (EU) 2016/679 (GDPR).
1. Data controller
The controller is Tomáš Smékal, Company ID: 04695984, registered at Zvoncovitá 1974/1, Stodůlky, 155 00 Praha 5.
Contact e-mail: info@pitrio.cz.
For data of the photographer's clients and visitors of shared galleries (including uploaded photos), the photographer is the controller and I process the data on their behalf as a processor — governed by the data processing agreement under Art. 28 GDPR.
2. Data I process
- Photographer (user) data: name, e-mail, password (encrypted), subscription and payment data.
- Uploaded content: photos and related metadata you upload.
- Gallery visitor (client) data: name and e-mail entered when accessing a shared gallery, favourite photo marks (hearts), comments and submitted photo selections.
- Technical data: IP address, browser type, logs and essential cookies for operation and security.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the service and account management | Performance of a contract (1(b)) |
| Payment and subscription processing | Contract and legal obligation (b, c) |
| Security, abuse prevention, logs | Legitimate interest (f) |
| Anonymous traffic statistics (cookieless, no personal data) | Legitimate interest (f) |
| Marketing retargeting (Seznam.cz Sklik, Google Ads) on the website | Consent (a) — can be withdrawn anytime |
| Behaviour analytics on the website (Microsoft Clarity — session recordings, heatmaps) | Consent (a) — can be withdrawn anytime |
4. Recipients and processors
I use vetted providers as data processors:
- Cloudflare R2 (Cloudflare, Inc.) – cloud photo storage; EU-jurisdiction bucket, photos are stored within the European Union,
- Render (Render Services, Inc.) – application hosting and database,
- e-mail service provider (Resend, Inc.) – transactional e-mails,
- Stripe (Stripe, Inc.) – subscription payment processing.
I have a data processing agreement under Art. 28 GDPR with each processor.
5. Transfers outside the EU
Some providers may process data outside the EU/EEA. In such cases, transfers are safeguarded under Art. 46 GDPR (in particular the European Commission's Standard Contractual Clauses).
6. Retention
I retain data for the duration of the account and afterwards for as long as necessary to meet legal obligations (in particular accounting and tax, typically 10 years for tax documents). Uploaded content and galleries are deleted after account closure or gallery expiry.
7. Your rights
- access to your data and a copy of it,
- rectification of inaccurate data,
- erasure ("right to be forgotten"),
- restriction of processing,
- data portability,
- objection to processing based on legitimate interest,
- withdrawal of consent (where processing relies on consent).
Contact info@pitrio.cz to exercise your rights. You also have the right to lodge a complaint with the supervisory authority (in the Czech Republic, the Office for Personal Data Protection, uoou.cz).
8. Cookies
The site uses essential technical cookies and — only with your consent — Seznam.cz and Google marketing cookies for retargeting (more relevant ads) and Microsoft Clarity analytics cookies (session recordings and heatmaps). You can withdraw your consent anytime on the cookie policy page. For traffic statistics I use cookieless analytics (Cloudflare Web Analytics), which sets no cookies and collects no personal data, and therefore needs no consent.
9. Security
I apply appropriate technical and organizational measures (encrypted transfer, access control, private storage with temporary signed links) to protect data against unauthorized access or loss.
10. Changes
I may update this policy. The current version is always available on this page with its effective date.