TILLASPHOTO
Privacy Notice
This notice covers the processing and online publication of photos taken by TillasPhoto at sports and recreational events, and the use of the associated online galleries and newsletter subscription requests made on the website.
1. Purpose of processing
TillasPhoto takes photos at public sports and recreational events to document the events and their atmosphere, showcase its photography and make sports photos available to participants. The likeness of an identifiable individual in a photo may constitute personal data.
2. Data processed
Processing primarily concerns the likeness of individuals shown in photos. As a general rule, TillasPhoto does not associate photos with names or direct contact details. If a visitor provides additional data, such as a name or email address, when using an online gallery, that data is processed in connection with the relevant service.
3. Image rights and legal basis for processing
The taking and use of photos are subject to the Hungarian Civil Code provisions on image rights and crowd photographs. Where the legal conditions are met, the processing of personal data associated with photos may be based on the controller's legitimate interest in documenting sports events, showcasing its photography and making photos available to participants. Reliance on legitimate interest does not replace consent where consent to the use of a person's likeness is required by law.
4. Publication of photos
Selected photos may appear on the TillasPhoto website, in its online galleries and on its social media pages. TillasPhoto aims to avoid publishing images that portray an individual in an undignified, offensive or unjustifiably disadvantageous situation.
5. Online galleries and Pic-Time
TillasPhoto uses Pic-Time to store and display online galleries. For content uploaded by TillasPhoto, including photos and related data, Pic-Time may act as a data processor on TillasPhoto's instructions. In operating the service, personal data may be transferred to providers in other countries. According to Pic-Time, these transfers are covered by safeguards under applicable data protection law, including adequacy mechanisms and standard contractual clauses where necessary.
Details of Pic-Time's processing of data in connection with its own service are set out in the Pic-Time Privacy Policy, and its processor terms are set out in the Pic-Time Data Processor Agreement .
6. Retention period
How long photos remain available in an online gallery depends on the event and the gallery's purpose. TillasPhoto regularly reviews whether published galleries are still needed. Photos removed from a public gallery may be retained in a private photo archive only while an appropriate legal basis and purpose for processing continue to exist.
7. Objections, photo removal and other data subject requests
If you are recognisable in a TillasPhoto image and do not want the photo to be publicly available, you may request a review of its use or its removal by emailing info@tillasphoto.hu .
To help identify the photo quickly, please provide the event name, photo link or file identifier, and indicate which person in the photo you are referring to, where possible. We will review the request without undue delay and respond within the time limit set by applicable law.
8. Data subject rights
Under applicable data protection rules, and depending on the circumstances of the processing, individuals may have the right to:
- request information and access;
- request rectification, erasure or restriction of processing;
- object to processing based on legitimate interest;
- lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information;
- seek a judicial remedy.
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
1055 Budapest, Falk Miksa utca 9–11.
naih.hu
9. Newsletter and new gallery notifications
Controller: TillasPhoto / Pozderka Attila; contact: info@tillasphoto.hu.
Purpose and legal basis: handling subscription requests and sending updates about new TillasPhoto galleries and photography content. Processing is based on your voluntary consent under GDPR Article 6(1)(a). Subscription is not required to use the website or galleries.
Data processed: your email address, selected language, subscription status, request and email-confirmation timestamps, the version of the consent wording, and individual identifiers associated with confirmation and unsubscribe links. Consent is requested through a separate checkbox that is not preselected.
How subscription works: after the form is submitted, we send a confirmation email. The subscription becomes active when the recipient opens the link and presses the confirmation button on the website. Without confirmation, the address is not included in the active notification list. The link is valid for 7 days. If you did not request the subscription, you can ignore the confirmation email. The controller sends updates to confirmed subscribers from a password-protected management page; recipients do not see each other’s email addresses.
Providers: Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41., Hungary; info@rackhost.hu) hosts the website and subscriber data and provides email delivery. It acts as a processor for hosting and email operations carried out on behalf of TillasPhoto. Terms: Rackhost Data Processing Agreement and Privacy Policy. The subscriber list remains on the hosting server; the subscription form does not automatically forward it to the controller’s Gmail inbox. If separate correspondence or forwarded messages enter Gmail, their data also enters Google’s email service; Google Privacy Policy. Subscribing or unsubscribing on this website does not change separate Pic-Time notification settings.
Retention: unconfirmed requests expire after 7 days. Expired records are deleted when the subscriber data is next processed; deletion does not run as a separate scheduled task. Active subscription records are retained until consent is withdrawn or the notification service ends. Completing the unsubscribe action deletes the subscription record from the live list. Receiving further updates requires a new subscription and confirmation. Previously delivered emails may remain in the recipient’s inbox; separate correspondence and provider backups may have different retention periods. They are not used as an active newsletter list.
Unsubscribing: every update contains a personal unsubscribe link. After opening it, press the unsubscribe button on the website to remove the subscription record automatically from the live list. Opening the link alone does not unsubscribe you, preventing accidental removal by automated email link scanners. Withdrawal is free and requires no reason. You may also email info@tillasphoto.hu; the controller can fulfil the request through the management page. Withdrawal does not affect the lawfulness of processing before withdrawal.
Your rights: you may request access, rectification, erasure, restriction and, where the legal conditions are met, data portability. Send requests to info@tillasphoto.hu; we generally respond within one month. You may complain to NAIH or seek a judicial remedy; authority contact details are in section 8. We do not use automated decision-making or profiling for this processing.
Technical protection: subscriber data is stored in a separate folder on the Rackhost hosting server that is blocked from direct web access. The management page is password-protected and communication between the browser and website uses HTTPS. Before using storage within the public web root, the application checks the folder’s web-access restriction; it does not save subscriber data there if the check fails. To limit abuse, forms store an IP-derived hash and attempt timestamps in the hosting server’s temporary file area using a one-hour window. Records not updated for one hour are removed on the next form request. Management-page login attempts use a separate hash and timestamps with a 15-minute window; expired login files are cleaned on the next login attempt. The legal basis for this security processing is the legitimate interest in protecting the website and subscriber data (GDPR Article 6(1)(f)). Rackhost’s separate terms govern its own access and operational logs.
Sessions: the website uses a necessary session identifier for secure form submissions and management-page login. Management access expires after 30 minutes of inactivity. The identifier and security tokens support form operation and protection against unauthorised submissions.
10. Contact
For questions about privacy, the use of your likeness or photo removal, contact: info@tillasphoto.hu.
Effective: 12 October 2026. This notice may be updated as necessary, particularly when services, processors or applicable legal requirements change.