Back to Pistaclub

Photo Consent & Auto-Tagging Policy

Last updated: 2026-09-01

1. Overview

Trackday events are photographed. Organizers upload those photos to their gallery on for participants and the public to view. Under EU law (GDPR + national likeness rights), a photograph of an identifiable person is personal data. This policy explains what happens with your image, who's responsible, what consent you're giving, and how to change your mind.

It applies alongside our Privacy Policy and — for the organizer's obligations — our Data Processing Agreement.

2. Who is responsible for your photos

The event organizer is the controller of photos taken at their event — they decided to run the event, they (or their photographer) took the pictures, and they chose to publish them. Pistaclub is the processor — we host the files and run auto-tagging on the organizer's behalf under the DPA. That means:

  • Requests to remove a photo go to the organizer first.
  • Pistaclub forwards your request and gives the organizer 48 hours to act.
  • If they don't, we hide the photo ourselves — see §6 below.

3. What is collected and how

At every trackday you register for, the organizer or their photographer may take photos of participants on-track, in the paddock, or at podium. Those photos are uploaded to the event's gallery on Pistaclub. When the organizer opts in to auto-tagging, our pipeline analyses each photo to detect race numbers, helmet colours, and other visible identifiers, and matches them to registered participants of that event so the photo appears on the matched rider's profile.

The auto-tagging pipeline is documented in more detail in the Privacy Policy §"Automated decisions". No facial recognition or biometric templates are stored — matching is based on visible race numbers and colours plus the participant list of the specific event.

4. Who can see your photos

  • Always: the organizer of the event and their staff.
  • By default: other registered participants of the same event (event gallery).
  • If the organizer publishes the gallery publicly: anyone on the internet (including via search engines) can view the gallery. Individual photos may then be indexed and cached by third parties (Google, archives) — a takedown from Pistaclub does not automatically remove third-party cached copies.

4a. Photographs may be sold

An organizer may offer photographs taken at their event for sale, including photographs of you, and may sell them to you or to other participants who appear in the same photograph. The organizer is the seller; we receive a percentage of the sale for operating the platform and processing the payment.

You can have a photograph of you removed. Ask the organizer, or use the report option on the photograph (§5). A photograph you object to is withheld from sale while the request is being looked at, and the takedown SLA in §6 applies to it exactly as it does to any other photograph.

Copies that have already been sold and downloaded cannot be recalled — a buyer keeps the file they paid for. What removal stops is any further sale, any further download, and the photograph's appearance in the gallery. Buyers' terms are in the Photo Licence.

5. Your rights and controls

You have four independent controls, all in Profile → Settings → Photo consent:

Photo consent (global)

Master switch. When withdrawn, your profile is flagged as "do not photograph" on every event you register to. Organizers see this on their participant list, and the auto-tag pipeline silently excludes you (equivalent to the legacy "auto-tag opt-out" toggle).

Auto-tagging

Even if you agree to be photographed, you can turn off automatic tagging to your Pistaclub profile. Photos still appear in the organizer's gallery, but the auto-tag pipeline will not match them to you. You can still tag yourself manually.

Per-photo "wrong tag"

Existing button on every auto-tagged photo card. Tells the organizer this specific photo is misattributed — used for fixing a mis-tag, not for takedown.

"Remove photo of me"

Formal takedown request. Forwards to the organizer with a 48-hour SLA. If they miss the deadline, Pistaclub hides the photo from the gallery. Note that removing the tag does NOT delete the original file from the organizer's control — they are the controller and retain their own copy under their retention policy.

6. Takedown SLA — 48 hours

When you file a "Remove photo of me" request:

  1. The request is timestamped and forwarded to the organizer.
  2. The organizer has 48 hours from receipt to remove the photo from their gallery or to reply with a lawful reason to keep it (e.g. the photo is required as evidence in an insurance or safety investigation — GDPR Art. 6(1)(f) legitimate interest).
  3. After 48 hours without a response, Pistaclub hides the photo from the gallery automatically. The file may remain in the organizer's own storage — you can address further removal directly with them or via the supervisory authority (Czech ÚOOÚ or the DPA of your country of residence).

8. Questions and complaints

First stop: contact the organizer directly (their contact details are on their profile page).

For Pistaclub-side issues (the auto-tag pipeline, a takedown that has passed its 48-hour SLA, general privacy questions):
privacy@pistaclub.app or, for our Data Protection Officer, dpo@pistaclub.app.

Pistaclub s.r.o. (pending incorporation) · Prague, Czech Republic (registered address pending) · Czech Republic · IČO: (pending)