Last updated: October 12, 2026

1. Introduction

We value your privacy and are committed to protecting your personal data. This privacy policy describes how we collect, use, and protect your information in accordance with GDPR (EU Regulation 2016/679) and Czech data protection law.

2. Data Controller

Name: Miroslav Maršík
Email: 10mirec@gmail.com
Website: www.miromarsik.com
Location: Czech Republic

3. What Data We Collect

3.1 Data You Provide Directly

When you book a photo walk, purchase digital products, or contact us, we may collect:

• Full name
• Email address
• Phone number
• Messages and correspondence
• Payment information (processed by Stripe)

3.2 Automatically Collected Data

When you visit our website, we automatically collect:

• IP address (pseudonymized: we store only a one-way hash, never the address itself)
• Browser type and operating system
• Pages visited and time of visit
• Referral source

4. Cookies

4.1 What Are Cookies

Cookies are small text files stored in your browser. They help us improve the website's functionality and provide better services.

4.2 What Cookies We Use

Necessary Cookies

These cookies are essential for the website to function properly. They cannot be disabled.

• cookie_consent - stores your cookie consent preferences (1 year)
• session_id - session identifier

Analytics Cookies

These help us understand how visitors use our website. All data is pseudonymized.

• Page view tracking
• User behavior analysis
• Content and functionality improvements

4.3 Managing Cookies

You can change your cookie settings anytime through your browser settings.

5. Purpose of Data Processing

We use your personal data to:

• Process photo walk bookings and digital product orders
• Communicate with you (respond to inquiries, send confirmations)
• Deliver digital products and generate download links
• Improve our services
• Analyze website traffic and how visitors move through bookings and purchases (pseudonymized data)
• Comply with legal obligations

6. Legal Basis for Processing

We process your data based on:

• Consent - you voluntarily provided data (e.g., when booking)
• Contract performance - necessary to provide the service or deliver digital products
• Legitimate interest - service improvement, analytics

7. Data Sharing

We do not sell or rent your personal data to third parties. We share it only with the following processors, which process it on our behalf and only under a data processing agreement:

• Stripe (Stripe Payments Europe, Ltd., Ireland) - processes payments securely
• Render (Render, USA) - hosting: runs the website and stores its database in a data centre in Frankfurt, Germany
• Resend (Plus Five Five, Inc., San Francisco, USA) - sends booking confirmations, order emails and other emails from the website
• Cloudflare (Cloudflare, Inc., USA) - stores encrypted database backups; the provider cannot read their content

Transfers outside the EU

Render, Resend and Cloudflare are US companies, so your data may be processed in the USA or accessed from there. All three are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision. Resend and Cloudflare also use the European Commission's Standard Contractual Clauses.

8. Data Retention

• Paid orders and invoices: for the period required by tax and accounting law, usually 10 years from the end of the year of sale
• Access to purchased digital products (email, record of ownership, download links): for as long as we provide access to the product, or until you ask us to delete it. Data required for tax records is not affected
• Unpaid and cancelled orders: 3 years (limitation period for possible claims), then anonymized
• Bookings: 3 years from the booking date; billing data according to tax law
• Email communication: 3 years (limitation period for possible claims)
• Waitlist: 12 months
• Newsletter: until you unsubscribe; afterwards we keep only a record of the unsubscription so that we do not write to you again
• Reviews: while published, or until you ask us to remove them
• Analytics data: 25 months, pseudonymized (we never store your IP address, only a one-way hash of it)
• Encrypted backups: up to 12 months; data deleted from the website disappears from the backups when they expire

9. Your Rights

Under GDPR, you have the right to:

• Access - request a copy of your personal data
• Rectification - correct inaccurate data
• Erasure - request deletion of data ("right to be forgotten")
• Restriction - limit how we use your data
• Portability - receive data in a machine-readable format
• Object - object to processing based on legitimate interest
• Withdraw consent - withdraw consent at any time

To exercise your rights, contact us at 10mirec@gmail.com. We will respond within 30 days.

10. Data Security

We protect your data using:

• HTTPS encryption
• Secure database servers
• Regular encrypted backups
• Restricted access to authorized personnel only

11. Children's Privacy

Our services are not directed to persons under 16 years of age. We do not knowingly collect data from children. If you become aware that a child has provided personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through a notice on our website.

13. Contact and Complaints

If you have questions or concerns about data processing:

Email: 10mirec@gmail.com

You also have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection (ÚOOÚ)
Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
Tel: +420 234 665 111
Email: posta@uoou.cz
Website: www.uoou.cz