Privacy Policy

1.Introduction

This Privacy Policy (the "Policy") explains how PETER HOLDING s.r.o., a company registered in the Czech Republic, Company ID (IČO) 22175814, VAT ID (DIČ) CZ22175814, with its registered seat at Dlouhá 3403/2b, Moravská Ostrava, 702 00 Ostrava, Czech Republic (the "Operator", "we", "us", or "our"), collects, uses, stores, shares, and protects personal data of visitors and users ("you", the "User") of the website pixeltogether.online and the collaborative pixel-art application available on it (the "Service").

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data ("GDPR"), Act No. 110/2019 Coll., on the Processing of Personal Data, and other applicable Czech and EU data protection law. By using the Service, creating an Account, or purchasing Credit or Pixels, you acknowledge that you have read and understood this Policy, as also confirmed in our Terms & Conditions.

2.Data Controller and Contact Details

The controller of your personal data is PETER HOLDING s.r.o., IČO 22175814, DIČ CZ22175814, registered seat at Dlouhá 3403/2b, Moravská Ostrava, 702 00 Ostrava, Czech Republic. For any questions, requests, or complaints regarding the processing of your personal data, please use the contact details listed in Section 12 of this Policy.

3.What Personal Data We Collect

Depending on how you use the Service, we may collect and process the following categories of personal data:

3.1 Data you provide directly

• Registration data: e-mail address, password (stored only as an irreversible cryptographic hash), and nickname.
• Profile data: an optional profile photo you upload.
• Billing data (optional): full name or company name, billing address, city, postal code, country, company registration number, and VAT number, if you choose to provide them when purchasing Credit or Pixels.
• User Content: the color, hyperlink (URL), and description you associate with a Pixel.
• Correspondence: any information you provide when contacting us, including for password recovery or support requests.

3.2 Data collected automatically

• Browser identifier ("usertoken"): a randomly generated identifier stored in a cookie on your device, used to recognize your browser across visits and to associate purchased or reserved Pixels with you, independently of whether you register an Account.
• Usage and activity data: which Pixels you view, reserve, or purchase, approximate activity timestamps, and online/offline presence used to display the "users online" counter.
• Technical data: IP address, browser type, device type, and similar technical information processed as part of standard web server operation and security logging.

3.3 Payment data

We do not collect or store your payment card details. Payment card processing is carried out exclusively by our third-party payment service provider(s), who act as independent controllers or processors of your payment data under their own privacy policies. We only receive confirmation of successful or failed transactions and the amount of Credit purchased.

4.Purposes and Legal Basis of Processing

We process your personal data only for the following purposes and only on the following legal grounds under Article 6 GDPR:

We do not use your personal data for automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR.

5.Cookies and Similar Technologies

The Service uses cookies and similar browser storage technologies that are strictly necessary for its operation, in particular:

• usertoken — a randomly generated identifier that recognizes your browser and links it to Pixels you have purchased or reserved. Without this cookie, the Service cannot function.
• nickname — stores the display name you have chosen, if any.
• Session/authentication-related cookies used to keep your browser identity consistent with your registered Account, where applicable.

These cookies are strictly necessary for the functioning of the Service and, under applicable Czech and EU e-Privacy rules, do not require separate opt-in consent. We do not use third-party advertising or analytics cookies at this time. Should this change, we will update this Policy and, where legally required, request your prior consent.

The Service may embed third-party content (such as an embedded YouTube music player) which may set its own cookies governed by that third party's own privacy policy, over which we have no control.

6.Who We Share Your Data With

We do not sell your personal data. We may share personal data with the following categories of recipients, strictly to the extent necessary for the purposes described in Section 4:

• Payment service providers that process your payments and, where applicable, your billing details, acting as independent controllers of that data.
• E-mail delivery providers used to send transactional e-mails such as password-reset messages.
• Hosting and IT infrastructure providers that store and process data on our behalf as processors, under appropriate data processing agreements.
• Professional advisors (such as accountants or legal counsel) bound by confidentiality obligations, where necessary.
• Public authorities where disclosure is required by applicable law, court order, or to protect our legal rights.

Other Users of the Service may see certain data you choose to make public, such as your nickname, profile photo, the Pixels you own, their color, and any link or description you attach to them. Your e-mail address, password, and billing details are never displayed publicly.

7.International Data Transfers

Our infrastructure and service providers are, as a rule, located within the European Union / European Economic Area. If any processor we engage is located outside the EU/EEA, we ensure an adequate level of protection through appropriate safeguards recognized under GDPR, such as an adequacy decision of the European Commission or Standard Contractual Clauses. You may request further information about such safeguards by contacting us using the details in Section 12.

8.Data Retention

• Account data (e-mail, password hash, nickname, photo, billing data) is retained for as long as your Account remains active, and for a reasonable period thereafter to handle disputes, enforce our Terms, and comply with legal obligations.
• Invoicing and accounting records are retained for the minimum period required by applicable Czech tax and accounting law (generally up to 10 years).
• Usertoken and browsing-related data is retained for as long as reasonably necessary to operate the Service and may persist for the lifetime of the cookie described above.
• Password-reset tokens are single-use and automatically invalidated after use or after a short expiry period.

Where personal data is no longer necessary for the purposes described in this Policy, we will delete or anonymize it, unless further retention is required or permitted by applicable law.

9.Security of Personal Data

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction, including password hashing using industry-standard algorithms, restricted access to production systems, input validation, and secure transmission of data. However, no method of transmission or storage over the Internet is completely secure, and we cannot guarantee absolute security.

10.Your Rights

Subject to the conditions set out in the GDPR, you have the right to:

• Access — obtain confirmation of whether we process your personal data and a copy of that data (Art. 15 GDPR).
• Rectification — request correction of inaccurate or incomplete personal data (Art. 16 GDPR).
• Erasure — request deletion of your personal data where one of the grounds under Art. 17 GDPR applies ("right to be forgotten").
• Restriction of processing — request that we limit the processing of your data under certain circumstances (Art. 18 GDPR).
• Data portability — receive the personal data you provided to us in a structured, commonly used, machine-readable format, and transmit it to another controller (Art. 20 GDPR).
• Object — object to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21 GDPR).
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint — with a supervisory authority, in particular the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz), or the supervisory authority of your habitual residence or place of alleged infringement.

To exercise any of these rights, please contact us using the details in Section 12. We will respond to your request without undue delay and, in any event, within one month, which may be extended by a further two months where necessary, taking into account the complexity and number of requests.

11.Children's Privacy

The Service is not directed at, and is not intended for use by, individuals under the age of 18 or the age of legal majority in their jurisdiction, and registration requires the legal capacity to enter into binding contracts as described in our Terms & Conditions. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take reasonable steps to delete such data promptly.

12.Contact Information

For any questions, requests, or complaints regarding this Policy or the processing of your personal data, please contact:

You also have the right to lodge a complaint directly with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz.

13.Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable law. The updated Policy will be posted on the Service with a revised effective date. Material changes will, where reasonably practicable, be communicated to registered Users. We encourage you to review this Policy periodically.