Privacy policy

DRAFT – Fill in everything in square brackets, verify the provider details and have this text legally reviewed before publishing. Then delete this paragraph.

1. Controller

The controller responsible for data processing on this website is:
[Please fill in: first and last name]
Priya's Photography
[Please fill in: address]
Email: [Please fill in]

2. Overview

This website does not use cookies, analytics or tracking services, or social media plugins. Personal data is only processed as far as necessary to run the website, deliver its content and answer your enquiries.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the website, Vercel processes technically necessary data, in particular your IP address, the date and time of access, the page requested, the previously visited page (referrer) and information about your browser and operating system (server log files).

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is the secure and stable operation of the website. A data processing agreement is in place with Vercel. For transfers to the USA, Vercel relies on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. [Please verify]

4. Images and content (Sanity)

The texts and images on this website are managed with the content management system Sanity (Sanity Inc., San Francisco, USA). Images are loaded directly from the image server cdn.sanity.io, which means your IP address is transmitted to Sanity. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is fast and reliable delivery of the images. [Please verify: data processing agreement and basis for transfers to the USA]

5. Fonts

The fonts on this website are loaded from our own server. No connection is made to Google or any other font provider.

6. Contact form and email

If you write to me using the contact form, I process the information you provide (name, email address, type of session, message and, optionally, phone number and preferred date) to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR.

Emails are sent via Resend (Resend, Inc., San Francisco, USA), using its EU region (Ireland). You receive an automatic confirmation at the email address you provide. Enquiries arrive in my email inbox at Google (Gmail, Google Ireland Limited, Dublin, Ireland). [Please verify]

I delete your data once your enquiry has been fully dealt with, unless statutory retention obligations apply, for example for quotes and invoices.

7. Protection against misuse

To protect the contact form from spam, your IP address is briefly stored and counted when you submit the form (at most five enquiries in ten minutes). For this I use Upstash (Upstash, Inc., USA) with a database in the EU. The entries are deleted automatically after ten minutes at the latest. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is protection against abusive requests.

8. Encryption

This website uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). Simply write to me at the email address given above.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.