CONSENT

1.1. The controller of personal data (within the meaning of Article 4(7) GDPR, the “Operator”) is:

Organization:

fotonapassport

Website:

https://fotonapassport.ru/

Email for inquiries:

support@fotonapassport.ru

1.2. The Operator has not appointed a Data Protection Officer, as this is not mandatory for the Operator under Article 37 GDPR. All requests concerning personal data are handled at support@fotonapassport.ru.

2.1. The data subject is a user of the fotonapassport service who:

2.1.1. uses the website https://fotonapassport.ru/;

2.1.2. creates an account or signs in to the personal account;

2.1.3. provides an email address, including when paying for an order without prior registration;

2.1.4. uploads their own photos;

2.1.5. places an order for the preparation of photos for documents;

2.1.6. pays for the service;

2.1.7. receives the final files;

2.1.8. contacts the support team of the Service.

2.2. By giving this Consent, the User confirms that the User:

2.2.1. has reached the age of 18;

2.2.2. is a legally capable person;

2.2.3. uploads only the User’s own photos;

2.2.4. does not upload photos of children, minors, or third parties;

2.2.5. understands the nature and purposes of the processing of personal data;

2.2.6. has read the fotonapassport Public Offer Agreement and the fotonapassport Personal Data Processing Policy.

3.1. The Operator processes the following personal data of the User:

3.1.1. phone number, if previously provided by the User;

3.1.2. email address;

3.1.3. photos uploaded by the User;

3.1.4. the image of the User’s face contained in the uploaded photos;

3.1.5. images created, modified, or generated as a result of automated and/or neural network processing;

3.1.6. final files, including PDF, JPG, and ZIP archives;

3.1.7. order history;

3.1.8. information about the selected plan;

3.1.9. payment information, including the amount, date, payment status, and payment identifier;

3.1.10. technical data, including the IP address, User-Agent, date and time of visits to the website, and information about actions on the website and in the personal account;

3.1.11. cookies and other technical identifiers;

3.1.12. information about consents given;

3.1.13. the content of support requests;

3.1.14. other information that the User independently provides to the Operator when using the Service or contacting support.

3.2. The Operator does not request from the User passport details, registered address, date of birth, information about children, information about health, information about political views, religious beliefs, or intimate life, or other special categories of personal data (Article 9 GDPR).

3.3. The Operator does not request from the User photos of identity documents.

4.1. Personal data are processed for the following purposes:

4.1.1. ensuring the operation of the website and the fotonapassport service;

4.1.2. registration and authorization of the User;

4.1.3. creation (including automatic creation upon payment for an order) and maintenance of the personal account;

4.1.4. acceptance and processing of an order;

4.1.5. communication with the User on matters related to the order;

4.1.6. uploading and storage of the User’s photos;

4.1.7. automated and neural network processing of images;

4.1.8. preparation of an image on a background that meets the requirements of the selected document;

4.1.9. enabling the User to independently fit the image to the face mask/oval;

4.1.10. creation of a JPG file and a PDF file for printing photos for documents;

4.1.11. creation of a ZIP archive and files for several formats, if provided for by the selected plan;

4.1.12. providing the User with access to the final files;

4.1.13. acceptance of payment for services;

4.1.14. generation and sending of a cash receipt;

4.1.15. processing of refunds;

4.1.16. consideration of the User’s inquiries, claims, and requests;

4.1.17. ensuring the security of the website and the Service;

4.1.18. prevention of fraud, abuse, and violations of the terms of the Service;

4.1.19. keeping records of the User’s consents;

4.1.20. compliance with the Operator’s legal obligations under applicable law, including Czech accounting and tax law;

4.1.21. protection of the rights and legitimate interests of the Operator;

4.1.22. analytics of the website’s operation and improvement of the quality of the Service;

4.1.23. evaluation of advertising effectiveness;

4.1.24. sending service and transactional messages related to the use of the Service.

4.2. Advertising and marketing messages are sent to the User only if the User has given separate consent to receive advertising and informational messages.

4.3. Legal bases of the processing (Article 6(1) GDPR): the purposes in clauses 4.1.1–4.1.13, 4.1.15, 4.1.16 and 4.1.24 — performance of the contract with the User or steps taken at the User’s request before entering into it (Article 6(1)(b)); the purposes in clauses 4.1.14 and 4.1.20 — compliance with legal obligations (Article 6(1)(c)); the purposes in clauses 4.1.17–4.1.19 and 4.1.21 — the Operator’s legitimate interests in security, prevention of fraud and abuse, demonstrating consents and defending legal claims (Article 6(1)(f)); the purposes in clauses 4.1.22 and 4.1.23 — the Operator’s legitimate interests in measuring, improving and promoting the Service (Article 6(1)(f)); the related analytics and marketing cookies are used by default until the User refuses them, and the User may refuse them and object to this processing at any time, with effect for the future (Article 21 GDPR), in the cookie banner (“Customize” → “Necessary only”) or via the “Cookie settings” link at the bottom of the website pages; advertising messages under clause 4.2 — the User’s separate consent (Article 6(1)(a)). The transfers of the image described in Section 7 are based on this Consent (Article 49(1)(a) GDPR) and on their necessity for the performance of the contract (Article 49(1)(b) GDPR).

5.1. The User separately confirms that the User has been informed of the processing of the photos uploaded by the User that contain an image of the User’s face and gives explicit consent to the transfer of such photos described in Section 7.

5.2. The facial image is processed exclusively for the purpose of providing the fotonapassport service, namely:

5.2.1. preparation of photos for documents;

5.2.2. creation of an image on a background that meets the requirements of the selected document;

5.2.3. improvement of image quality;

5.2.4. preparation of the image for independent fitting to the face mask/oval;

5.2.5. creation of PDF, JPG, and/or ZIP archive files;

5.2.6. delivery of the result to the User.

5.3. The Operator does not use the image of the User’s face for:

5.3.1. establishing the identity of the User;

5.3.2. identification of a person;

5.3.3. comparison against databases;

5.3.4. identity verification;

5.3.5. making legally significant decisions;

5.3.6. granting or restricting access to rights, benefits, services, or opportunities;

5.3.7. transfer to advertising partners for their own independent use;

5.3.8. publication in the public domain;

5.3.9. placement in portfolios, social networks, case studies, advertising, or demonstration materials without the separate consent of the User.

5.4. The User understands that the processing of the facial image is necessary for the provision of the fotonapassport service and is based on the performance of the contract (Article 6(1)(b) GDPR). Without a photo being provided, the service cannot be provided.

5.5. Facial images are personal data. The Operator does not process them as biometric data for the purpose of uniquely identifying a natural person (Article 9(1) GDPR, Recital 51 GDPR): facial landmarks are used only to crop and position the photo according to the requirements of the selected document.

6.1. The User is informed that the uploaded photos are subject to automated and neural network processing, which is necessary to provide the service (Article 6(1)(b) GDPR).

6.2. Such processing may include:

6.2.1. uploading the image;

6.2.2. storing the image for the established period;

6.2.3. automated processing of the image;

6.2.4. neural network processing of the image;

6.2.5. creating an image on a background that meets the requirements of the selected document;

6.2.6. improving the quality of the image;

6.2.7. preparing the image for independent fitting by the User;

6.2.8. creating the final result;

6.2.9. deleting the image upon expiry of the retention period.

6.3. The Operator may use third-party services for automated and neural network image processing, including those that process images outside the European Economic Area, including in the USA. Such services include Kie.ai, the OpenAI API, Higgsfield / Higgsfield CLI, and the OpenRouter platform, if the relevant provider is included in the technical infrastructure of the Service.

6.4. Only the User’s image, the technical processing request, the generation parameters, and the technical metadata of the request necessary to perform the processing are transferred to external services for processing, without the User’s phone number, email address, payment data, or other contact details.

6.5. The User understands that automated and neural network processing may affect the appearance of the result, including the background, lighting, quality, color rendering, sharpness, detail, and other image parameters.

6.6. The User independently evaluates the preliminary result of the processing before paying for the order.

6.7. Background removal (silhouette extraction) is performed on the Operator’s own infrastructure, located in the Russian Federation, without transferring the image to external services.

6.8. The automated and neural network processing of images does not involve decisions based solely on automated processing that produce legal effects concerning the User or similarly significantly affect the User (Article 22 GDPR).

7.1. The User has been informed of and gives explicit consent (Article 49(1)(a) GDPR) to the transfer of the User’s image, for the purpose of providing the service, (a) to third-party services for automated and neural network image processing, including Kie.ai, the OpenAI API, Higgsfield / Higgsfield CLI, and the OpenRouter platform, which may process the image outside the European Economic Area, including in the USA; and (b) to the Service’s main infrastructure (hosting, database, file storage, and the Operator’s own background-removal service) located in the Russian Federation (hosting provider Beget).

7.2. The transfer is carried out exclusively for the purposes of:

7.2.1. processing the image;

7.2.2. preparing the image on a background that meets the requirements of the selected document;

7.2.3. improving the quality of the image;

7.2.4. creating the result of the service;

7.2.5. ensuring the operation of the Service.

7.3. In the course of the transfer, only the User’s image, the technical processing request, the generation parameters, and the technical metadata of the request are transferred to external image processing services.

7.4. The User’s phone number, email address, payment data, order history, and other contact details are not transferred to external image processing services, unless otherwise expressly provided for by a separate consent of the User.

7.5. The User understands that the transfer of the image to these recipients is necessary for the performance of the contract with the User (Article 49(1)(b) GDPR) and that refusing or withdrawing consent to this transfer makes it impossible to provide the service if the relevant processing is necessary to create the result.

7.6. Before giving this Consent, the User has been informed of the possible risks of such transfer: the Russian Federation is a third country for which the European Commission has not adopted an adequacy decision; for the other recipients, an adequacy decision or Standard Contractual Clauses may not be in place. As a result, the level of protection of personal data in the country of the recipient may be lower than in the European Union, public authorities of that country may be able to access the data, and it may be more difficult for the User to exercise their rights and obtain effective legal remedies.

7.7. Where Standard Contractual Clauses adopted by the European Commission have been concluded with a recipient, the transfer is also based on those clauses (Article 46(2)(c) GDPR). The User may request information on the safeguards applied to a particular transfer at support@fotonapassport.ru.

8.1. The processing of personal data by the Operator may include the following operations:

8.1.1. collection;

8.1.2. recording;

8.1.3. systematization;

8.1.4. accumulation;

8.1.5. storage;

8.1.6. clarification;

8.1.7. updating;

8.1.8. modification;

8.1.9. retrieval;

8.1.10. use;

8.1.11. transfer;

8.1.12. provision;

8.1.13. access;

8.1.14. pseudonymization or anonymization;

8.1.15. restriction of processing;

8.1.16. deletion;

8.1.17. destruction.

8.2. Personal data may be processed both with and without the use of automation tools.

8.3. The main processing of data in the Service is carried out by automated means.

9.1. Personal data are disclosed to third parties (recipients) only where this is necessary to provide the service, perform the agreement, accept payment, ensure the operation of the Service, comply with a legal obligation, or protect the Operator’s rights. Processors process personal data on the Operator’s behalf under contracts pursuant to Article 28(3) GDPR.

9.2. The Operator may transfer personal data to the following categories of third parties:

9.2.1. hosting providers;

9.2.2. server infrastructure providers;

9.2.3. payment services and aggregators;

9.2.4. fiscal data operators and online cash register services;

9.2.5. authorization and messaging services;

9.2.6. automated and neural network image processing services;

9.2.7. analytics services;

9.2.8. advertising and analytics platforms;

9.2.9. technical contractors involved in the support and development of the Service;

9.2.10. government authorities, courts, law enforcement agencies, tax authorities, and other authorized persons in cases provided for by law.

9.3. The Operator uses the Platega and UnitPay payment services (Russian bank cards and SBP) and the Norelio payment service (foreign bank cards) to accept and process payments.

9.4. The Operator may use Kie.ai, the OpenAI API, Higgsfield / Higgsfield CLI, and the OpenRouter platform for automated and neural network image processing for the purpose of providing the service.

9.5. The Operator may use the Yandex.Metrica (Яндекс.Метрика), Webvisor, and VK Pixel services and, on language versions of the website other than Russian, Google Analytics 4 and Google Ads (the Google tag) for analytics of the website’s operation, evaluation of advertising effectiveness, and improvement of the quality of the Service, unless the User has refused the relevant categories of cookies. Yandex.Metrica, Webvisor and VK Pixel process data in the Russian Federation; Google may process data outside the EEA, including in the USA. The default settings of the Google tag (Google Consent Mode) are described in the fotonapassport Cookie Policy.

9.6. The Operator does not sell the User’s personal data to third parties.

9.7. The Operator does not transfer the User’s photos to advertising partners for their own independent use.

10.1. The User receives service and transactional messages necessary for the operation of the Service and the performance of the agreement (Article 6(1)(b) GDPR), including:

10.1.1. links to sign in to the personal account and to recover the password;

10.1.2. notifications about the status of an order;

10.1.3. notifications that the result is ready;

10.1.4. links to download the result;

10.1.5. support messages;

10.1.6. notifications about payment and refunds;

10.1.7. other messages necessary for the provision of the service.

10.2. Service and transactional messages are sent to the User’s email address and may also be displayed in the personal account or sent via other communication channels specified by the User.

10.3. Advertising and marketing messages are sent only if the User has given separate consent to receive advertising and informational messages.

10.4. Opting out of advertising messages does not affect the receipt of service and transactional messages necessary for the provision of the service.

11.1. This Consent is valid from the moment it is given by the User until the purposes of the processing of personal data are achieved or until the Consent is withdrawn by the User.

11.2. Source photos, generated image variants, preliminary images, intermediate processed images, and temporary files — for both unpaid and paid requests — are stored for no more than 90 calendar days: for an unpaid request, from the moment of its creation; for a paid request, from the date of payment. Upon expiry of this period, an unpaid request is deleted in full. If by that time the final files for a paid request have not yet been generated, the said data are stored until they are generated, but no longer than the period established by clause 11.3 of this Consent.

11.3. Final JPG/PDF/ZIP files of a paid order and related download links are stored for 12 months from the date of payment (if an additional payment was made for the order, from the date of the last payment), unless a longer period is required by applicable law (including Czech accounting and tax law), for the consideration of claims, or for the protection of the Operator’s rights. Upon expiry of this period, the paid request is deleted in full.

11.4. Upon expiry of the relevant retention period, photos, preliminary images, generated images, temporary files, download links, EXIF data, and cached copies are deleted irrecoverably.

11.5. The User’s account data are stored until the User deletes the account through the personal account or by contacting support, or until the account is terminated on other grounds.

11.6. Order history, payment information, cash register and accounting information, information about consents, the User’s inquiries, and other legally significant data may be stored for the periods necessary for compliance with applicable law, in particular Czech accounting and tax law, consideration of claims, protection of the Operator’s rights, and confirmation of the fact that the service was provided.

11.7. Personal data processed for advertising messages are stored until the User withdraws the separate consent to receive advertising and informational messages or until the Operator terminates the relevant mailing.

12.1. The User may withdraw this Consent at any time, free of charge and as easily as it was given, by sending a request to the Operator. The withdrawal does not affect the lawfulness of processing based on the Consent before its withdrawal (Article 7(3) GDPR).

12.2. A request for withdrawal of the Consent is sent to the email address support@fotonapassport.ru, through the personal account, the support service on the website, or the feedback widget, if such functionality is available.

12.3. In the request, the User must specify the contact details used during registration or when placing the order, as well as the substance of the request.

12.4. The Operator may request additional information necessary to confirm that the account or data belong to the person making the request.

12.5. In the event of withdrawal of the Consent, the Operator ceases the processing based on the Consent and deletes the personal data without undue delay, except in cases where the Operator is entitled to continue processing on another legal basis under Article 6(1)(b), (c) or (f) GDPR.

12.6. Such grounds may include:

12.6.1. compliance with legal obligations under applicable law (Article 6(1)(c) GDPR);

12.6.2. maintenance of accounting, tax, or cash register records;

12.6.3. confirmation of the fact that the service was provided;

12.6.4. consideration of claims and disputes;

12.6.5. protection of the rights and legitimate interests of the Operator;

12.6.6. performance of obligations to government authorities.

12.7. Withdrawal of the Consent before the provision of the service is completed may make it impossible to provide the service or create the result, since the transfer of the image described in Section 7 is necessary for this.

12.8. The User also has the right of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15–22 GDPR). The Operator responds to requests within one month of receipt; this period may be extended by two further months where necessary (Article 12(3) GDPR). Requests are free of charge unless they are manifestly unfounded or excessive.

12.9. The User may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.cz) or with the supervisory authority of the EU/EEA member state of their habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).

13.1. The User may contact the Operator with a request to delete the account.

13.2. The account is deleted by the User independently in the personal account or upon request to support at support@fotonapassport.ru or through the feedback widget, if such functionality is available.

13.3. Upon deletion of the account, the Operator deletes photos, preliminary images, generated images, temporary files, download links, EXIF data, cached copies, and session data, if they have not been deleted earlier.

13.4. After deletion of the account, the Operator may continue to store certain data if such storage is necessary for compliance with legal obligations under applicable law, record-keeping, consideration of claims, confirmation of the fact that the service was provided, or prevention of abuse, fraud, or repeated registration of violators.

13.5. To prevent abuse, the Operator may store minimal anti-fraud markers, including a salted hash of the phone number and a salted hash of the email. Such data are not used to restore deleted photos or the generation history.

14.1. By giving this Consent, the User confirms that the User:

14.1.1. has reached the age of 18;

14.1.2. is not a minor;

14.1.3. uploads only the User’s own photos;

14.1.4. does not upload photos of children, minors, or third parties;

14.1.5. does not use the Service for unlawful purposes;

14.1.6. has read the fotonapassport Public Offer Agreement;

14.1.7. has read the fotonapassport Personal Data Processing Policy;

14.1.8. understands that the processing of the facial image is necessary for the provision of the service;

14.1.9. understands that automated and neural network image processing may be applied in the course of the provision of the service;

14.1.10. understands that the Operator may use third-party services for automated and neural network image processing, including Kie.ai, the OpenAI API, Higgsfield / Higgsfield CLI, and the OpenRouter platform, which may process the image outside the European Economic Area, including in the USA, and that the Service’s main infrastructure is located in the Russian Federation;

14.1.11. understands that only the image is transferred to external services for processing, without the phone number, email, payment data, or other contact details;

14.1.12. understands that refusing this Consent makes it impossible to provide the service;

14.1.13. has been informed of the possible risks of transferring the image to third countries described in clause 7.6.

15.1. This Consent is given by the User by an express affirmative action (Article 4(11) GDPR), in particular by:

15.1.1. ticking the relevant checkbox on the website;

15.1.2. ticking the relevant checkbox before uploading a photo to the Service;

15.1.3. ticking the relevant checkbox before placing an order;

15.1.4. ticking the relevant checkbox when creating an account;

15.1.5. ticking the relevant checkbox before paying for the service;

15.1.6. confirming this Consent in another express manner offered in the interface of the Service.

15.2. The fact that the Consent has been given may be recorded by the Operator with an indication of:

15.2.1. the date and time the Consent was given;

15.2.2. the version of the Consent;

15.2.3. the IP address;

15.2.4. User-Agent;

15.2.5. the account or order identifier;

15.2.6. other technical information necessary to confirm the fact that the Consent was given.

15.3. Silence, inactivity, pre-ticked boxes, or mere continued use of the Service do not constitute consent.

16.1. This Consent is an integral part of the fotonapassport documents and applies together with the Public Offer Agreement, the Personal Data Processing Policy, and the Cookie Policy.

16.2. The Operator may update the text of this Consent. A new version enters into force upon publication on the website, unless a different effective date is specified in the new version. If the new version extends the scope of the Consent, the Operator will ask the User for consent again.

16.3. The User shall independently monitor changes to this Consent.

16.4. If the User does not agree with the terms of this Consent, the User shall stop using the Service and shall not upload photos.

Organization:

fotonapassport

Website:

https://fotonapassport.ru/

Email:

support@fotonapassport.ru