Privacy policy

1. Data Controller

The controller of your personal data is the operator of the Pixchoose service, available at pixchoose.com (hereinafter: the "Service"). For data-protection inquiries, contact us at: kontakt@pixchoose.com.

2. Data We Collect

2.1. Data provided during registration

• Customers: name, e-mail address, password (stored in hashed form).
• Agencies: additionally company name, tax ID (NIP), registered address (street, postal code, city), phone number (optional), website (optional), billing e-mail (optional).

2.2. Data provided by guests (without registration)

Visitors who browse and select photos without creating an account may provide their name and e-mail when submitting a selection. They are identified by an anonymous token (UUID) stored in a cookie.

2.3. Data collected automatically

• IP address and browser information (User-Agent) — recorded in the session table and when legal consents are given (acceptance of terms of service, privacy policy, and cookies policy).
• Language preference — saved in the user profile and/or a cookie.

2.4. Event and photo data

• Photos — uploaded by agencies; may contain EXIF metadata (camera model, date taken, possibly GPS coordinates). The Service retains this metadata for technical purposes.
• Photo selections — information about photos chosen by the customer, ratings (1–5), text notes, and comment threads on photos.

2.5. Payment and billing data

• Card / bank-account details — are never stored in the Service. Payments are processed by the external operator PayU S.A.; the Service stores only the transaction identifier, amount, currency, and payment status.
• Invoices — contain a frozen snapshot of the agency's billing data (company name, tax ID, address) at the time of issuance.

3. Purposes and Legal Bases for Processing

Purpose	Legal basis (GDPR)
Providing the Service (registration, account management, gallery sharing, photo selection)	Art. 6(1)(b) — performance of a contract
Billing, invoicing, bookkeeping	Art. 6(1)(c) — legal obligation
Payment processing (data transfer to PayU)	Art. 6(1)(b) — performance of a contract
Recording legal consents (IP, User-Agent, acceptance date)	Art. 6(1)(f) — legitimate interest (proof of consent)
Session security and protection against unauthorized access	Art. 6(1)(f) — legitimate interest
Technical support and communication	Art. 6(1)(f) — legitimate interest

4. Data Recipients

Your data may be shared with the following categories of recipients:

• PayU S.A. (ul. Grunwaldzka 186, 60-166 Poznań, Poland) — to the extent necessary to process online payments.
• E-mail service provider — for sending transactional messages (registration confirmations, password resets, event notifications).
• Invoicing service provider — for issuing VAT invoices.
• Hosting and server infrastructure provider — for storing data on servers.

We do not sell or share your personal data with third parties for marketing purposes.

5. Data Transfers Outside the EEA

As a rule, your data is processed within the European Economic Area (EEA). If we use service providers located outside the EEA (e.g., cloud infrastructure), transfers are carried out on the basis of Standard Contractual Clauses approved by the European Commission or another GDPR-compliant mechanism.

6. Cookies

The Service uses the following cookies:

Name / type	Purpose	Retention
Session cookie (laravel_session)	Maintaining the logged-in session, CSRF protection	120 minutes
pixchoose_guest	Identifying an anonymous customer selecting photos (UUID)	365 days
Language preference cookie	Remembering the chosen interface language	Until deleted by the user
XSRF-TOKEN	Protection against Cross-Site Request Forgery attacks	120 minutes

The Service does not use advertising or tracking cookies (e.g., Google Analytics, Facebook Pixel). We do not perform profiling.

7. Data Retention

• Account data — until the account is deleted by the user or administrator.
• Session data — 120 minutes from the last activity.
• Guest data (cookie) — up to 365 days; associated data (name, e-mail) is retained for the lifetime of the event.
• Photos and selections — for the duration of the event; after expiration, files are deleted according to the cleanup schedule.
• ZIP archives — 7 days from generation.
• Billing data and invoices — 5 years from the end of the tax year, in accordance with tax law.
• Legal consents (terms acceptances) — indefinitely, as proof of consent.
• Password-reset tokens — 60 minutes.

8. Your Rights

Under the GDPR you have the following rights:

• Right of access — you may obtain information about the data processed (Art. 15).
• Right to rectification — you may request correction of inaccurate data (Art. 16).
• Right to erasure — you may request deletion of your data, provided there is no other legal basis for processing (Art. 17).
• Right to restriction of processing — in certain situations you may request that processing be restricted (Art. 18).
• Right to data portability — you may receive your data in a machine-readable format (Art. 20).
• Right to object — you may object to processing based on legitimate interest (Art. 21).
• Right to withdraw consent — if processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing (Art. 7(3)).

To exercise any of these rights, contact us at: kontakt@pixchoose.com.

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• encrypted connections (HTTPS/TLS),
• password hashing (bcrypt),
• CSRF protection,
• need-to-know access control (agency-level data isolation).

10. Changes to This Policy

We reserve the right to amend this privacy policy. Users will be informed of material changes via the Service (by requiring re-acceptance upon login). The current version is always available at pixchoose.com/privacy.

11. Contact

If you have any questions about personal-data processing, please contact us:

• E-mail: kontakt@pixchoose.com