PRIVACY POLICY

6. Who We Share Your Data With

6.1 Data Processors

We engage third-party service providers who process personal data strictly on our behalf and in accordance with our instructions. These processors are not permitted to use your data for their own purposes. Our processors include:

• Amazon Web Services (AWS) – cloud hosting and storage of photos and contact information
• Crisp – customer support chat functionality
• Marketing and analytics tools

6.2 External Controllers

In certain circumstances, we share personal data with third parties that process it for their own purposes:

• Tax authorities – to comply with our legal obligations
• Payment providers (Mollie, PayPal) – to process your payments

6.3 Sharing Between Joint Controllers

Localgrapher s.r.o. and Smiler Photo s.r.o. share personal data between themselves as joint controllers for the purposes described in this policy. Both entities have access to the data necessary to provide and improve our services.

7. International Data Transfers

Our primary data hosting is within the European Union. However, some of our processors for services such as customer communications may be based in, or transfer data to, countries outside the EU (for example, the United States). In such cases, we ensure that personal data is only transferred to countries or parties that provide an adequate level of protection in accordance with European data protection standards, including through appropriate safeguards such as Standard Contractual Clauses (SCCs).

PART B – ALL OTHER USERS

8. Data We Collect from Other Users

This section applies to all users who interact with our website and services beyond the photoshoot experience, including visitors, registered users, and photographers.

8.1 Data You Provide

• Account information: name, email, phone number, login credentials, address, profile picture, and photos
• Demographic data: information collected through surveys or user research
• User content: information submitted through customer support, ratings, reviews, or other communications

8.2 Data Created During Use

• Location data: approximate or precise location from a photographer’s device when the Smiler app is actively in use
• Transaction data: order details, service type, dates, amounts charged
• Usage data: access dates, pages viewed, browser type, collected via cookies, pixels, or similar technologies
• Device data: hardware model, IP address, operating system, software version, language preferences

8.3 Data from Other Sources

We may receive user feedback, ratings, and reviews from external platforms or partners.

9. How We Use Your Data

Important: Smiler does not sell or share user personal data with third parties for their direct marketing purposes, except with your explicit consent.

9.1 Data Security

We are committed to safeguarding your personal data against unauthorised access, modification, disclosure, or deletion. Our security measures include:

• Encryption of all data in transit via Transport Layer Security (TLS)
• Restricted access to personal data on a need-to-know basis
• Regular security scanning for vulnerabilities
• Reliance on PCI-compliant payment providers for processing payment card data (we do not store full payment details)

9.2 Cookies

We use cookies and similar technologies to improve your experience. The types of cookies we use include:

‍‍You can withdraw your cookie consent at any time by adjusting your browser settings. Please note that disabling cookies may limit certain features of our platform.

GENERAL PROVISIONS

10. Your Privacy Rights

Under the GDPR, you (and any other individuals whose data we process) have the following rights:

• Right to access – request a copy of the personal data we hold about you
• Right to rectification – ask us to correct or update inaccurate data
• Right to erasure – request deletion of your personal data
• Right to data portability – receive your data in a structured, commonly used format, or request transfer to another controller
• Right to withdraw consent – where processing is based on consent, you may withdraw it at any time (this does not affect prior processing)
• Right to object – object to the processing of your personal data
• Right to restriction – request limitation of processing in certain circumstances
• Right to lodge a complaint – file a complaint with the Office for Personal Data Protection of the Czech Republic (Úřad pro ochranu osobních údajů, UOOU) or another relevant supervisory authority

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or business practices. If we make significant changes, we will notify you using the contact information we have on file. We recommend reviewing this policy periodically. Your continued use of our platform after amendments constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a complaint, you may contact either joint controller:

W: smiler.co

Effective: 1 April 2026 – Version 2.0