Depo Awards — Prague 2026 Privacy Policy

Controller: Depo Place OÜ Registry code: 17357640 Registered address: Sepapaja tn 6, Lasnamäe district, Tallinn, Harju County, 15551, Estonia Contact for data protection matters: hello@depo.place Last updated:

This Privacy Policy explains how Depo Place OÜ ("Depo", "we", "us") processes personal data in connection with the Depo Awards – Prague 2026 competition and the related offline exhibition held in Prague, Czech Republic. It applies to participants who submit works, to visitors of the Prague exhibition, and to anyone who contacts us in relation to this event. It supplements, and where it conflicts prevails over, our general platform Privacy Policy for this specific event.

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus). For activities physically taking place in the Czech Republic, applicable Czech data-protection rules also apply.

For participants:

• Identity and contact data: name (or pseudonym), email address, country/place of residence.

• Account and links: social-media links and profile information you provide.

• Submitted works: photographs and other visual works, together with titles, descriptions and credits. These images frequently depict identifiable individuals (the participant and/or models and other persons portrayed).

• Transaction data: records of the organisational fee paid, payment method type, and confirmation/receipt data. We do not store full card numbers or CVV codes — payments are processed by PCI-DSS-compliant providers (see Section 6).

• Correspondence: messages you send us.

For visitors of the Prague exhibition:

• Photographic and video recordings of the event in which attendees may be identifiable (see Section 8).

• Any registration/RSVP or guest-list data, if collected for the event.

Because this competition centres on photography of people, we treat the status of images transparently:

• Photographs submitted to the competition are, as a rule, processed as ordinary personal data under Article 6 GDPR.

• We do not apply facial-recognition or other biometric identification technology to submitted or exhibition images, and therefore do not process biometric data for the purpose of uniquely identifying a natural person.

• However, a photograph may reveal information that is special-category data within the meaning of Article 9(1) GDPR (for example, data revealing racial or ethnic origin, health, or a person's sex life or sexual orientation), including in artistic-nude works. Where a participant submits a work that contains or reveals such information, our processing of that work relies on the participant's explicit consent (Article 9(2)(a)) and/or on the fact that the data has manifestly been made public by the data subject (Article 9(2)(e)).

We do not invite participants to submit special-category data that is not inherent to the artistic work itself, and we ask participants not to include unnecessary sensitive information in titles, descriptions or correspondence.

Where a submitted work depicts a person other than the participant, the participant warrants that they have obtained that person's informed consent to the photographing and to publication and exhibition by Depo Awards (including online publication, printed catalogues, and the Prague exhibition). The participant is responsible for keeping records of such consent and for providing them to us on request. We will remove a work from publication where a depicted person validly objects and the participant cannot demonstrate a lawful basis.

We process personal data to:

• administer and run the competition (registration, review, selection, notification of results);

• communicate with participants;

• publish and exhibit selected works (online gallery, Depo Magazine, the Prague exhibition, catalogues and archives) with author attribution;

• document and promote the event (reporting, press, social media);

• comply with legal, accounting and tax obligations;

• protect the platform and exercise or defend legal claims.

• Performance of a contract (Art. 6(1)(b)) — administering your participation under the Public Offer / Terms & Conditions.

• Consent (Art. 6(1)(a)) — for publication and exhibition of works and, where applicable, special-category content (Art. 9(2)(a)); consent may be withdrawn at any time without affecting prior lawful processing.

• Legitimate interests (Art. 6(1)(f)) — documenting and promoting the event and the Depo Awards brand, and securing our platform; we balance these against your rights.

• Legal obligation (Art. 6(1)(c)) — accounting, tax and other statutory duties.

We share personal data only with service providers acting on our instructions, with curators/jury members bound by confidentiality, and with partners involved in delivering the event. Our principal processors include:

• Stripe — payment processing;

• PayPal — payment processing;

• Wise — payments/payouts;

• MagCloud (HP) — print-on-demand production of printed materials, where applicable;

• [hosting / cloud provider], [email / CRM provider], [analytics provider];

• the Prague exhibition venue / local event partner [NAME], for on-site logistics.

We do not sell personal data.

Some of our processors are located outside the European Economic Area (in particular in the United States — Stripe, PayPal, MagCloud). Where personal data is transferred to a third country that is not covered by an adequacy decision, we rely on appropriate safeguards under Article 46 GDPR, principally the European Commission's Standard Contractual Clauses (SCCs), supplemented by additional measures where required. You may request information about the safeguards applied by contacting us at hello@depo.place.

NOTE: This replaces the statement in the Public Offer that data is stored "within the EU". That statement is inaccurate given the use of US-based processors and must not be republished in this form.

The Depo Awards – Prague 2026 exhibition will be photographed and filmed for documentation, reporting and promotion. Attendees may appear in such recordings.

• Legal basis: legitimate interests (Art. 6(1)(f)) in documenting and promoting the event.

• We will display clearly visible signage at the venue informing attendees that photography/filming takes place and how to object or avoid being recorded.

• Attendees who do not wish to be filmed may notify staff on site, and we will take reasonable steps to accommodate such requests.

• For activities at the Prague venue, the Czech supervisory authority (Úřad pro ochranu osobních údajů – ÚOOÚ) may also be competent.

We retain personal data only as long as necessary for the purposes above. Competition administration and contact data are retained for no longer than 5 years unless a longer period is required by law (e.g. accounting/tax records). Published works and event documentation may be retained for archival purposes for as long as they remain part of the Depo Awards archive, subject to your right to object and to withdraw consent.

Under the GDPR you have the right to: access your data; obtain rectification or erasure; restrict or object to processing; data portability; and to withdraw consent at any time. To exercise these rights, contact **hello@depo.place**.

You also have the right to lodge a complaint with a supervisory authority:

• Estonia (lead authority): Andmekaitse Inspektsioon (AKI) — [insert current contact details from aki.ee];

• Czech Republic (for the on-site event): Úřad pro ochranu osobních údajů (ÚOOÚ) — [insert current contact details from uoou.gov.cz].

Participation in Depo Awards – Prague 2026 is strictly limited to persons aged 18 or over. We do not knowingly process the personal data of minors in connection with this event. Submitted works must not depict minors in this event category, and this event is kept entirely separate from any Depo content directed at or involving children. [HIGHEST-PRIORITY ITEM — counsel must confirm the architectural and legal separation between this 18+ event and any child-related Depo activity]

The Prague 2026 pages use cookies and similar technologies as described in our [Cookie Policy / link].

We may update this Policy. The current version, with its revision date, is always available on this page. Material changes apply prospectively.

Depo Place OÜ, Sepapaja tn 6, Tallinn, 15551, Estonia — **hello@depo.place**.