Privacy policy
1. Data Controller
The controller of your personal data is Wozniak Solutions sp. z o.o. with its registered office in Warsaw, ul. Bukowińska 24C lok. 7, 02-703 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw under KRS number 0000624966, tax ID (NIP) 5542939466, REGON 364773467 — the operator of the Pixchoose service, available at pixchoose.com (hereinafter: the "Service"). For data-protection inquiries, contact us at: kontakt@pixchoose.com or in writing at our registered office.
2. Data We Collect
2.1. Data provided during registration
- Customers: name, e-mail address, password (stored in hashed form).
- Agencies: additionally company name, tax ID (NIP), registered address (street, postal code, city), phone number (optional), website (optional), billing e-mail (optional).
2.2. Data provided by guests (without registration)
Visitors who browse and select photos without creating an account may provide their name and e-mail when submitting a selection. They are identified by an anonymous token (UUID) stored in a cookie.
2.3. Data collected automatically
- IP address and browser information (User-Agent) — recorded in the session table and when legal consents are given (acceptance of terms of service, privacy policy, and cookies policy).
- Language preference — saved in the user profile and/or a cookie.
- Analytics data — through Google Analytics we collect anonymised information about how the Service is used (pages visited, time spent, device type, approximate geographic location). This data does not allow direct identification of the user.
2.4. Event and photo data
- Photos — uploaded by agencies; may contain EXIF metadata (camera model, date taken, possibly GPS coordinates). The Service retains this metadata for technical purposes.
- Photo selections — information about photos chosen by the customer, ratings (1–5), text notes, and comment threads on photos.
2.5. Payment and billing data
- Card / bank-account details — are never stored in the Service. Payments are processed by the external operator PayU S.A.; the Service stores only the transaction identifier, amount, currency, and payment status.
- Invoices — contain a frozen snapshot of the agency's billing data (company name, tax ID, address) at the time of issuance.
3. Purposes and Legal Bases for Processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service (registration, account management, gallery sharing, photo selection) | Art. 6(1)(b) — performance of a contract |
| Billing, invoicing, bookkeeping | Art. 6(1)(c) — legal obligation |
| Payment processing (data transfer to PayU) | Art. 6(1)(b) — performance of a contract |
| Recording legal consents (IP, User-Agent, acceptance date) | Art. 6(1)(f) — legitimate interest (proof of consent) |
| Session security and protection against unauthorized access | Art. 6(1)(f) — legitimate interest |
| Technical support and communication | Art. 6(1)(f) — legitimate interest |
| Analytics and Service improvement (Google Analytics) | Art. 6(1)(f) — legitimate interest (service optimisation) |
4. Data Recipients
Your data may be shared with the following categories of recipients:
- PayU S.A. (ul. Grunwaldzka 186, 60-166 Poznań, Poland) — to the extent necessary to process online payments.
- E-mail service provider — for sending transactional messages (registration confirmations, password resets, event notifications).
- Invoicing service provider — for issuing VAT invoices.
- Hosting and server infrastructure provider — for storing data on servers.
- Google LLC — for web analytics (Google Analytics). Google processes anonymised data about Service usage in accordance with its own privacy policy.
We do not sell or share your personal data with third parties for marketing purposes.
5. Data Transfers Outside the EEA
As a rule, your data is processed within the European Economic Area (EEA). If we use service providers located outside the EEA (e.g., cloud infrastructure), transfers are carried out on the basis of Standard Contractual Clauses approved by the European Commission or another GDPR-compliant mechanism.
6. Cookies
The Service uses the following cookies:
| Name / type | Purpose | Retention |
|---|---|---|
| Session cookie | Maintaining the logged-in session | 120 minutes |
| Security cookie (CSRF) | Protection against Cross-Site Request Forgery attacks | 120 minutes |
| Guest identification cookie | Identifying an anonymous customer selecting photos | 365 days |
| Language preference cookie | Remembering the chosen interface language | Until deleted by the user |
| Analytics cookies (Google Analytics) | Collecting anonymised statistics about visits and Service usage | Up to 2 years |
The Service does not use advertising cookies. We do not perform profiling.
7. Data Retention
- Account data — until the account is deleted by the user or administrator.
- Session data — 120 minutes from the last activity.
- Guest data (cookie) — up to 365 days; associated data (name, e-mail) is retained for the lifetime of the event.
- Photos and selections — for the duration of the event; after expiration, files are deleted according to the cleanup schedule.
- ZIP archives — 7 days from generation.
- Billing data and invoices — 5 years from the end of the tax year, in accordance with tax law.
- Legal consents (terms acceptances) — indefinitely, as proof of consent.
- Password-reset tokens — 60 minutes.
8. Your Rights
Under the GDPR you have the following rights:
- Right of access — you may obtain information about the data processed (Art. 15).
- Right to rectification — you may request correction of inaccurate data (Art. 16).
- Right to erasure — you may request deletion of your data, provided there is no other legal basis for processing (Art. 17).
- Right to restriction of processing — in certain situations you may request that processing be restricted (Art. 18).
- Right to data portability — you may receive your data in a machine-readable format (Art. 20).
- Right to object — you may object to processing based on legitimate interest (Art. 21).
- Right to withdraw consent — if processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing (Art. 7(3)).
To exercise any of these rights, contact us at: kontakt@pixchoose.com.
You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
9. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- encrypted connections (HTTPS/TLS),
- password hashing (bcrypt),
- CSRF protection,
- need-to-know access control (agency-level data isolation).
10. Changes to This Policy
We reserve the right to amend this privacy policy. Users will be informed of material changes via the Service (by requiring re-acceptance upon login). The current version is always available at pixchoose.com/privacy.
11. Contact
If you have any questions about personal-data processing, please contact us:
- E-mail: kontakt@pixchoose.com
- Postal address: Wozniak Solutions sp. z o.o., ul. Bukowińska 24C lok. 7, 02-703 Warszawa, Poland