1. Who is the data controller
The data controller is Evgenia Trofimchuk.
Privacy contact: .
At an organised event, the organiser may receive copies of photographs as agreed for that event. Where the organiser independently determines the purposes and means of using those copies, it is responsible for their legal basis, retention, publication, disclosure and deletion and should inform participants under its own privacy policy. In those cases, Photo Event does not determine retention periods or subsequent use of copies outside our systems. The respective roles depend on the actual activities and arrangements; providing copies does not remove our obligations for processing carried out by us.
2. What this policy covers
This policy describes personal data processing when you visit myphotoevent.com, inquire about photography services, are photographed or receive photos through a protected gallery. The event organiser sells the photos and receives payments. The website does not accept online orders or payments.
3. Data we may process
Name and contact details, such as an email address and, where necessary, a telephone number.
Operational preparation and delivery data: number or identifier, selected photos, status and delivery information.
Photographs and related technical information, such as date and time or an event or folder identifier.
Protected gallery data: gallery token or identifier, secure session, access status and technical security records.
Contents of inquiries and correspondence sent through a contact form or by email.
Technical security data: IP address, user agent, timestamps, abuse prevention events and limited information from the security infrastructure.
Consent and preference data relating to personal data processing, such as cookie choices.
4. Purposes and legal bases for processing
4.1. Providing photography services
We process the data needed to photograph, select, prepare, deliver and provide technical support for photos under the agreed photography service. The usual legal basis is performance of a contract or steps requested by the client before entering into a contract.
4.2. Protected client gallery
We create a private gallery, manage access and provide purchased digital content. The bases are performance of a contract and legitimate interests in secure delivery and system protection.
4.3. Security and abuse prevention
We may process limited technical data to detect unauthorised access, automated attacks, fraud, misuse of codes and other violations. The basis is our legitimate interest in protecting our systems, clients and content.
4.4. Contact, inquiries and complaints
We use data to respond to photography service inquiries, technical support for files and galleries, and requests to exercise data protection rights. The basis may be steps before a contract, performance of a contract, a legal obligation or legitimate interests in communication and support.
4.5. Marketing and public use of photos
Buying a photo or participating in an event does not automatically authorise use of the image in advertising, social media or a public portfolio. Such use requires a separate appropriate legal basis and, where necessary, separate consent.
5. Facial recognition
We do not use client galleries for facial recognition or biometric profiling.
6. Protected client galleries
Client galleries are not intended for public indexing. Each gallery is provided through an individual address or token and a separate access code. A secure session may be created after successful verification.
Recipients may voluntarily share the link, code or downloaded photos with people they trust. After such sharing, Photo Event cannot control the recipient's actions outside our systems.
7. How long we retain data
Online client gallery: normally up to 30 days after activation or provision, after which the content may be automatically deleted and become irrecoverable.
Correspondence about photography services, technical delivery and personal data: as long as needed to resolve the matter and protect legal rights.
Security and technical logs: for a short, proportionate period, unless needed longer for an incident investigation or legal requirement.
Evidence of consent or refusal: as long as necessary to demonstrate lawful processing.
Technical backups, caches or security logs may retain limited residual data briefly after primary deletion where necessary for security and reliability.
8. Who may receive data
Hosting, CDN, security, storage and web service providers, including Cloudflare where used.
Email and communication providers, including Google where used for business correspondence.
Event organisers, only where necessary for the event and with an appropriate legal basis.
Competent public authorities where required by law.
We do not sell personal data or provide client galleries to advertising intermediaries.
9. Transfers outside the EEA
Some technical providers may process data outside the European Economic Area. Where this happens, an applicable safeguard is used, such as an adequacy decision, standard contractual clauses or another mechanism permitted by the GDPR.
10. Cookies and similar technologies
We use strictly necessary technologies for security, sessions and protected galleries. Optional analytics, functional or marketing technologies are activated only with valid consent where required. Details are in the separate Cookie policy.
11. Your rights
Subject to the GDPR, you may have rights of access, rectification, erasure, restriction of processing, objection, portability and withdrawal of consent. Withdrawal does not affect the lawfulness of earlier processing.
To exercise a right, write to . We respond without undue delay and within one month of receiving the request. Where necessary, taking account of the complexity and number of requests, this period may be extended by two further months; we inform you of the extension and its reasons within the first month. Exercising your rights is generally free of charge. If we have reasonable doubts about your identity, we may request additional information necessary to confirm it.
You also have the right to complain to the Bulgarian Commission for Personal Data Protection.
12. Automated decisions
We do not make decisions with legal or similarly significant effects on clients solely through automated profiling.
13. Changes
We may update this policy when the service, infrastructure or law changes. The current version and last updated date are published on the website.
14. Contact
Email: