Privacy Policy

This policy describes how Ondřej Šrámek, Company ID (IČO) 21732761, registered office at Brno, Czech Republic, registered in the Czech Trade Licensing Register, not a VAT payer (referred to below as "I" or "the controller"), processes personal data in connection with running the website ondrejsramek.cz and providing my services.

Contact for data protection matters: ondrej@ondrejsramek.cz

I have not appointed a Data Protection Officer; please contact me directly in all matters.

When I am a controller and when a processor

For most of the processing described below I act as a controller – I decide why and how the data is processed.

It is different for analytical and consulting work (DFIR, threat intelligence). When I analyse a client's logs, network captures, disk or memory images, I work with data entrusted to me by the client and belonging to the client – in that scope I act as a processor and follow the client's instructions and the data processing agreement concluded under Art. 28 GDPR. The client remains the controller of that data, so please address any requests concerning data contained in such an analysis to them.

The same applies to lecturing delivered on behalf of a course organiser (for example Czechitas): the organiser is the controller of participants' data, and I access it only to the extent necessary and on their instruction.

What data I process

Enquiries by e-mail
Name, e-mail address, possibly phone number and the content of your message. I process these so that I can reply and arrange possible cooperation.

Analytical, consulting and lecturing engagements
Identification and contact details of the client and their contact persons, correspondence, materials provided for the engagement, and deliverables (reports, recommendations). Client data submitted for analysis is processed in the role of processor, see above.

Photography

• name and surname, e-mail, possibly phone number,
• verification that you are at least 18 years old (I photograph adults only; for boudoir, glamour and nude work I verify age from an identity document and record only a note that verification took place – I do not keep a copy of the document),
• your likeness and the images taken, including images of an intimate nature in boudoir and nude work,
• the scope of consent to use the images as given in the completed Model Release form,
• the content of our arrangements for the shoot (date, location, your idea of the result).

Invoicing
Billing name, address, company and tax ID and other details required to issue and keep records of tax documents.

Cookies and similar technologies
The website uses strictly necessary cookies required for its basic operation. With consent given through the cookie banner I also use Google Analytics to understand which pages people visit and how the site is used. Google Analytics will not run without your consent – the script stays inactive until you approve the relevant category in the banner. You can change or withdraw consent at any time via the "Cookie settings" link in the footer. The current overview of what each category stores is available directly in the cookie banner.

Why I process the data and on what legal basis

I do not process data relating to enquiries and engagements on the basis of consent – that processing is directly connected with negotiating or performing a contract. I rely on consent for analytics cookies and for using photographs beyond delivering them to you.

Photographs and your privacy

Photographs are personal data by their nature, and in boudoir, glamour and nude work they are exceptionally sensitive content. Therefore:

• I never publish images anywhere without your consent. You decide the scope of publication in the Model Release form and you can limit it (for example only non-identifiable images, print portfolio only, or without your name).
• You can withdraw consent to publication at any time – an e-mail to ondrej@ondrejsramek.cz is enough. After withdrawal I remove the images from the website, social media and my online portfolio without undue delay. For material already printed, published, or further distributed by third parties, removal may not be factually possible; withdrawal therefore takes effect going forward.
• I do not pass images to third parties for their own purposes, do not sell them to stock agencies, and do not use them to train artificial intelligence models.
• Security: images are stored on encrypted storage accessible only to me. Backups are kept in the pCloud service in its European data region. The galleries serve solely to deliver the images to you – they are not public, not discoverable, and are protected by a private link and a password.
• Evidence of consent (the completed Model Release and the age verification record) is retained even after consent is withdrawn, so that I can demonstrate the conditions under which the images were created and used up to that point.

How long I keep the data

• Enquiries that did not lead to cooperation: 12 months from the last contact.
• Engagement materials and correspondence: for the duration of the cooperation and thereafter for the limitation periods applicable to claims arising from it.
• Client data submitted for analysis (processor role): for the period agreed with the client, after which it is returned or deleted per their instruction.
• Photographs: for as long as your consent to their use lasts; after withdrawal I remove them from publication channels and delete them from my archive unless we agree otherwise.
• Delivery galleries: a Pixin gallery stays available for 14 days from the moment it is shared, after which it is removed. A Zonerama gallery is kept without a time limit unless we agree otherwise – typically for weddings, where you come back to the images years later. You can ask me to delete a gallery at any time.
• Model Release and age verification record: 10 years from the date of the shoot.
• Tax documents: 10 years from the end of the tax period, as required by law.
• Record of your cookie choice: for the period needed to demonstrate consent under Art. 7(1) GDPR.

Who I share data with

I do not routinely share data with third parties. The exceptions are:

• Active24 s.r.o. – provider of website and e-mail hosting, acting as my processor,
• Google Ireland Limited – operator of Google Analytics, only if you give consent through the cookie banner; data may be transferred outside the EU/EEA including to the USA, on the basis of standard contractual clauses approved by the European Commission,
• Pixoly s.r.o., Company ID 17496586, Nádražní 831, 393 01 Pelhřimov, Czech Republic – operator of the Pixin gallery (pixin.gallery) used to deliver your finished images, acting as my processor,
• ZONER a.s., Company ID 49437381, Nové sady 583/18, 602 00 Brno, Czech Republic – operator of the Zonerama gallery, where images are delivered through that channel, acting as my processor. Under its terms of service the operator reserves the right to store content on servers anywhere in the world and runs its own analytics and marketing tools on the gallery pages, which I have no control over,
• pCloud AG – provider of backup storage; backups are kept in its European data region,
• an accountant or tax adviser and the operator of my invoicing system, to the extent necessary for keeping records,
• public authorities, where required by law.

If you order prints or other photo products yourself through the Pixin gallery, you enter into a purchase contract directly with the shop operator and the manufacturer; they process your order and delivery details as separate controllers under their own policies, and I access them only to the extent needed to keep track of the order.

I do not myself transfer personal data from enquiries, engagements or photo shoots outside the EU/EEA. The exceptions are backups held with pCloud AG, a Swiss company – Switzerland benefits from a European Commission adequacy decision and the data itself is kept in the European data region –, the Zonerama gallery, whose operator reserves the right in its terms to locate servers without territorial restriction, and website traffic measured through Google Analytics, as described above.

Your rights

You have the right to access your personal data, to have it corrected, erased or its processing restricted, to object to processing based on legitimate interest, and to data portability where processing is based on a contract or consent. Any consent you have given – whether to the use of photographs or to analytics cookies – can be withdrawn at any time; withdrawal does not affect the lawfulness of processing carried out before it.

To exercise your rights, write to ondrej@ondrejsramek.cz.

If you believe I am not handling your data properly, you may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz.

Effective date

This policy is effective from 1.9.2026 and replaces the previous privacy statement. The current version is always available on this page.

This is a translation of the Czech version. In case of any discrepancy, the Czech version prevails.