REGISTER OF PROCESSORS AND RECIPIENTS OF PERSONAL DATA

1.1. The controller of personal data within the meaning of Art. 4(7) GDPR (the “Operator”) is the fotonapassport organization.

1.2. Contact for inquiries regarding personal data: support@fotonapassport.ru. No data protection officer is appointed (not mandatory under Art. 37 GDPR).

2.1. The Operator transfers personal data to third parties only to the extent necessary for the provision of the service, performance of the agreement, acceptance of payment, authorization, communication with the User, analytics (unless the User has refused analytics cookies), ensuring security, compliance with legal obligations or protection of the Operator’s rights, and only on a legal basis under Art. 6(1) GDPR.

2.2. The Operator does not sell Users’ personal data to third parties.

2.3. The Operator does not transfer uploaded photographs, final files, payment data or support requests to advertising partners for their own use.

2.4. When transferring data to processors, the Operator applies the principle of minimization: only the data that a specific recipient needs to perform the entrusted function is transferred.

2.5. Background removal (silhouette extraction) is performed on the Operator’s own infrastructure without transferring the image to third parties.

2.6. Roles of recipients. A processor processes personal data on behalf of the Operator and only on its documented instructions under a contract meeting the requirements of Art. 28(3) GDPR. An independent controller determines the purposes and means of its own processing (for example, payment services and public authorities) and is responsible for it under its own terms and applicable law.

2.7. Transfers outside the EEA. The Service’s main infrastructure (hosting, database, file storage and the Operator’s own background-removal service) is located in the Russian Federation, a third country for which the European Commission has not adopted an adequacy decision. AI image processing providers may process images outside the EEA, including in the USA. Where personal data is transferred to a recipient outside the EEA, the transfer is based on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR) where such clauses have been concluded with the recipient; otherwise the transfer is necessary for the performance of the agreement with the User (Art. 49(1)(b) GDPR) and/or is based on the User’s explicit consent given after having been informed of the possible risks of such transfer (Art. 49(1)(a) GDPR). The transfer of data collected through analytics and marketing cookies (clauses 3.8 and 3.9) is not based on the User’s consent: Standard Contractual Clauses apply only where they have been concluded with the provider, and the Operator does not claim that such clauses or other appropriate safeguards are in place for these transfers; a User who does not wish such data to be transferred may refuse analytics and marketing cookies in the cookie banner or via the “Cookie settings” link on the website.

3.1. Beget / hosting provider.

Purpose: hosting of the website, backend, database, file storage and technical infrastructure in the territory of the Russian Federation.

Data: account, sessions, uploaded photographs, generated images, final files, order information, technical logs, IP address, User-Agent, cookie consents, security logs.

Legal basis: performance of the agreement with the User (Art. 6(1)(b) GDPR); legitimate interests in ensuring the operation and security of the Service and protecting the Operator’s rights (Art. 6(1)(f) GDPR).

Role: processor.

Location: Russian Federation (third country). Transfer safeguards: clause 2.7.

3.2. Platega (platega.io) and UnitPay / payment services (Russian bank cards and SBP; Platega is the primary service, UnitPay is the backup).

Purpose: acceptance of payment, confirmation of payments, refunds, payment notifications, generation of payment identifiers, generation and sending of fiscal receipts.

Data: amount, plan, payment method (bank card or SBP), payment status, payment identifier, technical payment information, the buyer’s email address (the buyer identifier at Platega and the address for sending the fiscal receipt).

Legal basis: performance of the agreement with the User, including acceptance of payment (Art. 6(1)(b) GDPR); accounting and tax obligations (Art. 6(1)(c) GDPR).

Role: independent controller with respect to the payment services it provides under its own terms and regulatory obligations.

Location: Russian Federation (third country). Transfer safeguards: clause 2.7.

3.3. Norelio / payment service (payments by foreign bank cards).

Purpose: acceptance of payments by foreign bank cards on the Norelio payment page (pay.lis-system.eu / norelio.store), confirmation of payments, refunds, payment notifications, generation of payment identifiers.

Data: buyer’s email address, payment amount and currency, order number, plan, payment status, payment identifier, technical payment information. Bank card details are entered by the User directly on the Norelio payment page and are not transferred to the Operator.

Legal basis: performance of the agreement with the User, including acceptance of payment (Art. 6(1)(b) GDPR); accounting and tax obligations (Art. 6(1)(c) GDPR).

Role: independent controller with respect to the payment services it provides under its own terms and regulatory obligations.

Location: card payments may be processed by banks and payment networks outside the EEA. Transfer safeguards: clause 2.7.

3.4. OpenAI API / automated and neural network image processing service.

Purpose: image processing, generation or enhancement of a photo option, technical execution of an AI request.

Data: the uploaded image or the image selected for processing, the technical processing request, generation parameters and technical request metadata. The phone number, email, payment data, order history and support requests are not transferred.

Role: processor.

Location: outside the EEA, including the USA. Transfer safeguards: clause 2.7.

3.5. Higgsfield / Higgsfield CLI / automated and neural network image processing service.

Purpose: image processing, generation or enhancement of a photo option, technical execution of an AI request.

Data: the uploaded image or the image selected for processing, the technical processing request, generation parameters and technical request metadata. The phone number, email, payment data, order history and support requests are not transferred.

Role: processor.

Location: outside the EEA, including the USA. Transfer safeguards: clause 2.7.

3.6. OpenRouter platform / service for routing and executing AI requests.

Purpose: backup, legacy or internal image processing through AI providers, if the relevant environment is enabled in the Service.

Data: the image, the technical processing request, generation parameters and technical request metadata. The phone number, email, payment data, order history and support requests are not transferred.

Role: processor.

Location: outside the EEA, including the USA. Transfer safeguards: clause 2.7.

3.7. Kie.ai / neural network image generation service.

Purpose: image processing, generation or enhancement of a photo option, technical execution of an AI request.

Data: the uploaded image or the image selected for processing, the technical processing request, generation parameters and technical request metadata. The phone number, email, payment data, order history and support requests are not transferred.

Role: processor.

Location: outside the EEA, including the USA. Transfer safeguards: clause 2.7.

3.8. Yandex.Metrica and Webvisor; Google Analytics 4 / analytics.

Purpose: analytics of traffic, interface quality, referral sources, technical errors and the effectiveness of the Service.

Data: IP address, User-Agent, information about the browser, device, page, referral source and actions on the website; information about a completed payment (the order number, amount, payment time, advertising click identifier and Yandex.Metrica visitor identifier) transferred by the Operator from its server in order to assess the effectiveness of advertising. Used unless the User has refused analytics cookies (payment information is transferred only if the User has not refused marketing cookies either).

Legal basis: the Operator’s legitimate interest in measuring, improving and promoting the Service (Art. 6(1)(f) GDPR). Used by default until the User refuses analytics cookies; the User may refuse them and object at any time, with effect for the future (Art. 21 GDPR), in the cookie banner or the cookie settings.

Role: processor with respect to the statistics provided to the Operator; independent controller to the extent Yandex processes the data for its own purposes under its terms.

Location: Russian Federation (third country). Transfer safeguards: clause 2.7.

Google Analytics 4 (provider: Google), only on language versions of the website other than Russian, through the Google tag (gtag.js) with Google Consent Mode (version 2). Data: IP address, User-Agent, information about the browser, device, page (without access tokens or payment identifiers), referral source and actions on the website; for payments in a currency other than the Russian rouble on such language versions — information about the completed purchase (the payment identifier, amount and currency). Used unless the User has refused analytics cookies; if the User has made no choice and appears to be located in the EU/EEA, the United Kingdom or Switzerland, Google storage is “denied” by default and only cookieless signals are sent. Legal basis: as for Yandex.Metrica above. Role: processor with respect to the statistics provided to the Operator; independent controller to the extent Google processes the data for its own purposes under its terms. Location: outside the EEA, including the USA. Transfer safeguards: clause 2.7.

3.9. VK Pixel; Google Ads / advertising analytics.

Purpose: assessment of the effectiveness of advertising, retargeting and analysis of advertising referrals.

Data: technical information about visits and actions on the website. Uploaded photographs, final files, payment data and support requests are not transferred. Used unless the User has refused marketing cookies.

Legal basis: the Operator’s legitimate interest in measuring, improving and promoting the Service, including evaluating the effectiveness of its advertising (Art. 6(1)(f) GDPR). Used by default until the User refuses marketing cookies; the User may refuse them and object at any time, with effect for the future (Art. 21 GDPR), in the cookie banner or the cookie settings.

Role: independent controller with respect to the processing it carries out for its own advertising purposes under its terms.

Location: Russian Federation (third country). Transfer safeguards: clause 2.7.

Google Ads (provider: Google), only on language versions of the website other than Russian, through the Google tag (gtag.js) with Google Consent Mode (version 2), and server-side transfer of payment conversions. Data: technical information about clicks on Google advertisements, visits and actions on the website; for payments in a currency other than the Russian rouble on such language versions — the payment identifier, amount, currency, payment time and the Google advertising click identifier, transferred by the tag and by the Operator from its server. Uploaded photographs, final files, name, email, phone number and support requests are not transferred. Used unless the User has refused marketing cookies; if the User has made no choice and appears to be located in the EU/EEA, the United Kingdom or Switzerland, Google storage is “denied” by default, and the server-side payment transfer for such Users is made only if the User has accepted marketing cookies. Payments on the Russian language version and payments in Russian roubles are never transferred to Google. Legal basis: as for VK Pixel above. Role: independent controller with respect to the processing it carries out for its own advertising purposes under its terms. Location: outside the EEA, including the USA. Transfer safeguards: clause 2.7.

3.10. Mail service (SMTP) for sending emails.

Purpose: sending links to sign in to the personal account and to recover the password, links to download the result, Order notifications and other service and transactional messages.

Data: email address, text of the service message, technical delivery status.

Role: processor. Where the mail service is located outside the EEA, transfer safeguards: clause 2.7.

3.11. Authorization and user account services, including Stack Auth, if the relevant environment is enabled in the Service.

Purpose: registration, authorization, management of sessions and access to the personal account.

Data: email, technical user identifier, sessions, sign-in information and technical authorization logs.

Role: processor. Where the service is located outside the EEA, transfer safeguards: clause 2.7.

3.12. Talk-Me / online support chat on the Website, if the relevant widget is enabled.

Purpose: receiving and processing User requests via the support chat.

Data: the content of the correspondence, contact details that the User provides in the chat, and technical information about the visit (IP address, User-Agent, page address). Uploaded photographs, final files and payment data are not transferred.

Role: processor.

Location: Russian Federation (third country). Transfer safeguards: clause 2.7.

3.13. Technical contractors and support specialists.

Purpose: maintenance, diagnostics, bug fixing, handling of requests, ensuring security and development of the Service.

Data: only the information to which access is necessary to perform a specific task, subject to access and confidentiality restrictions.

Role: processors or persons acting under the authority of the Operator (Art. 28–29 GDPR), bound by confidentiality. Where located outside the EEA, transfer safeguards: clause 2.7.

3.14. Government authorities, courts, law enforcement agencies, tax authorities and other authorized persons.

Purpose: compliance with legal obligations of the Operator under EU and Czech law, judicial decisions and lawful requests, and the establishment, exercise or defence of legal claims.

Data: information to the extent provided for by applicable law or a lawful demand.

Legal basis: legal obligation (Art. 6(1)(c) GDPR); legitimate interests in protecting the Operator’s rights (Art. 6(1)(f) GDPR).

Role: independent controllers.

4.1. The Operator reviews this register when a new processor is engaged, when the purpose of the transfer changes, when the scope of the data transferred changes or when the applicable legal requirements change.

4.2. The current version of the register is published on the Website.