Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data is:

2. Information We Collect

We collect information you provide directly to us when you:

• Fill out contact or booking forms on our website
• Send us an email, WhatsApp message, or call us
• Subscribe to our newsletter or request our book
• Book a photography session
• Access a private client gallery to review and select images

This information may include your name, email address, phone number, company name, and any other details you choose to provide. When you use a client gallery, we also store your image selections, favorites, and any comments you leave on photographs.

We also automatically collect limited technical data when you visit our website, such as IP address, browser type, device information, and pages visited — used for analytics, security, and bot protection.

3. Legal Basis for Processing

Under the GDPR, we process your personal data on the following legal bases:

• Consent — for newsletter subscriptions, optional analytics cookies, and use of your images for marketing
• Contract performance — to schedule sessions, deliver photographs, and operate client galleries
• Legitimate interest — to respond to inquiries, secure our website against bots and abuse, and improve our services
• Legal obligation — to comply with tax, accounting, and other regulatory requirements

4. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and provide customer service
• Schedule and manage photography sessions
• Deliver your photographs through private client galleries
• Send you our newsletter and the book you requested (if subscribed)
• Improve our website, services, and user experience
• Protect our website from spam, abuse, and security threats
• Comply with legal and tax obligations

5. Cookies and Analytics

We use cookies and similar technologies for the following purposes:

• Essential cookies — required for the website to function, including session management and form security
• Security — Cloudflare Turnstile protects our forms from automated abuse and may process your IP address and browser characteristics
• Analytics — Google Analytics 4 (measurement ID G-1C4DTRE6DY) helps us understand how visitors use our website, including pages visited, time on page, referral source, and device/browser information. This runs only with your consent

You can manage your cookie preferences through our cookie consent banner at any time, or through your browser settings.

6. Service Providers and Data Sharing

We do not sell, trade, or rent your personal information. We share data only with the following processors, who are contractually bound to protect it:

• Vercel (United States) — website hosting
• Resend (United States) — transactional and newsletter email delivery
• Web3Forms (Germany) — conference page form submissions
• Google (United States) — analytics via Google Analytics 4
• Cloudflare (United States) — bot protection on forms
• Upstash — database storage for client gallery selections and comments
• Vercel Blob (United States) — image storage for client galleries
• Professional collaborators — hair and makeup artists for sessions, only when you have requested or consented to their involvement
• Legal authorities — when required by law

Some of these providers are based outside the European Economic Area, primarily in the United States. International transfers are safeguarded through Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Contact and inquiry data — up to 2 years after our last contact, unless you become a client
• Client records and session photographs — retained for the duration of our professional relationship and for up to 6 years after the final session for accounting and legal purposes
• Client gallery data — selections, favorites, and comments are retained for up to 12 months after gallery finalization, after which galleries may be archived or deleted
• Newsletter subscribers — until you unsubscribe, plus a short period to honor the unsubscribe request
• Analytics data — anonymized and retained according to Google Analytics defaults (14 months)
• Invoices and tax records — retained as required by Spanish tax law (currently 4–6 years)

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encrypted connections (HTTPS), secure password-protected admin access, bot protection on public forms, and processors with industry-standard security practices. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights (GDPR)

If you are a resident of the European Economic Area, the United Kingdom, or Switzerland, you have the following rights regarding your personal data:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data, where applicable
• Restriction — request that we limit the processing of your data
• Objection — object to processing based on legitimate interest
• Portability — request transfer of your data in a structured, machine-readable format
• Withdraw consent — withdraw consent at any time, without affecting the lawfulness of prior processing
• Lodge a complaint — with a supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es

To exercise any of these rights, please contact us at slava@slavatimoshenko.com. We will respond within 30 days.

10. Use of Photographs

Photographs created during sessions are protected works owned by Slava Timoshenko Photography. Once you purchase your selected images, you receive a license to use them for personal and professional purposes, including LinkedIn, websites, business materials, and press use.

We do not use photographs of identifiable individuals for portfolio, marketing, or promotional purposes without separate, explicit written consent. If you wish to be featured in our portfolio or marketing, we will ask you to sign a separate model release. You may withdraw this consent at any time by contacting us, and we will remove your images from future marketing materials.

Unedited and unselected files from sessions are deleted after the project is delivered and are not retained beyond the purposes described in this policy.

11. Newsletter and Marketing

When you subscribe to our newsletter or request our book, we store your email address and the source of your subscription to send you relevant content and updates. Every email includes an unsubscribe link, and you can opt out at any time. Unsubscribing removes your email from our active marketing list.

12. Minors

Our website and newsletter are directed to adults. We do not knowingly collect personal data from individuals under 14 (the age of digital consent in Spain) through our online services. When photographing minors as part of professional sessions, we require the consent of a parent or legal guardian, and any use of those images is subject to the same consent requirements described in Section 10.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us: