Privacy Policy

Paschalis SerafeimPhotography

Last updated: [26.01.2026]

This Privacy Policy explains how Paschalis Serafeim Photography (“we”, “us”) collects and processes personal data when you visit our website, contact us, book a shoot, or receive photographic services. It is intended to meet transparency requirements under the EU General Data Protection Regulation (GDPR) (notably the information duties in Art. 13 GDPR).

1) Controller (Data Controller)

Controller: [Paschalis Serafeim Photography / Owner:Paschalis Serafeim]
Address: [Mbrapa postes Nr. 4, Zogu I Blvd, 1001 Tirana, Albania]
Email: [lightandlegacy.studio@gmail.com]
Phone: [+355696011004]
Website: https://www.lightandlegacy.photography

2) What personal data we process

Depending on how you interact with us, we may process:

A. Website and technical data

  • IP address, device and browser information, date/time of access, referrer URL, pages visited, log files.

B. Enquiries and communication

  • Name, email address, phone number, message content, and any information you provide (e.g., shoot ideas, references, availability).

C. Booking and contract data

  • Name, contact details, billing details, booking details (date/location), correspondence related to the job.

D. Photos and videos

  • Photographs/videos that may identify individuals (personal data under GDPR when a person is identifiable).

E. Social media interactions

  • Public profile information and messages when you contact us via social platforms.

3) Purposes and legal bases (GDPR)

We process personal data for the following purposes and rely on these legal bases (Art. 6 GDPR):

A. To provide our services and perform a contract

  • Preparing offers, scheduling, executing shoots, delivering galleries/products, handling revisions.
    Legal basis: performance of a contract / steps prior to entering a contract (Art. 6(1)(b) GDPR).

B. To communicate with you

  • Responding to enquiries, customer support.
    Legal basis: legitimate interests (efficient communication) (Art. 6(1)(f)) or contract steps (Art. 6(1)(b)), depending on context.

C. To comply with legal obligations

  • Accounting, tax, and record-keeping duties.
    Legal basis: legal obligation (Art. 6(1)(c)).

D. Marketing (portfolio, website, social media)

  • Publishing photos for our portfolio and promotion (only when permitted).
    Legal basis: usually consent (Art. 6(1)(a)) or, in limited contexts, legitimate interests (Art. 6(1)(f))—this depends on the jurisdiction and the specific use. Consent can be withdrawn at any time.

E. Analytics and cookies (if used)

  • Measuring website performance and improving user experience.
    Legal basis: consent where required (especially for non-essential cookies/trackers).

4) Cookies, consent, and similar technologies

Our website may use cookies and similar technologies. Some are strictly necessary for the website to function; others (e.g., analytics/marketing) may require your consent depending on applicable law (EU ePrivacy rules and national implementations).

If we use a cookie banner/consent tool, you can manage your choices there. Where processing is based on consent, you can withdraw it at any time.

5) Where we get personal data from

  • Directly from you (forms, email, phone, messages).

  • Automatically from your device/browser when you use the website (technical data).

  • From third parties you use to contact us (e.g., social networks) according to your settings and their policies.

6) Who we share data with (recipients)

We only share personal data when necessary, for example with:

  • Website hosting and site platform providers (e.g., Squarespace, if you run the site there). Squarespace provides a Data Processing Addendum for GDPR-related processing.

  • IT and communication providers (email, cloud storage, gallery delivery services, customer support tools).

  • Payment and invoicing providers / banks (to process payments and bookkeeping).

  • Professional advisors (tax advisors, legal advisors) where needed.

  • Public authorities where required by law.

No sale of personal data: We do not sell your personal data.

7) International transfers

If service providers process data outside the EEA/UK/Switzerland, transfers may occur. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) as provided by the relevant service provider arrangements. (Squarespace describes GDPR-related safeguards in its GDPR guidance and contractual documents.)

8) How long we keep data (retention)

We keep personal data only as long as necessary for the purposes described above, including:

  • the duration of our relationship and project delivery,

  • legal retention duties (e.g., accounting/tax),

  • and to establish, exercise, or defend legal claims where applicable.

Retention periods depend on the type of data and the applicable laws in the relevant jurisdiction(s). Art. 13 GDPR requires that you are informed about retention periods or the criteria used to determine them.

9) Your rights under the GDPR

If the GDPR applies, you have the right to:

  • Access your personal data (Art. 15 GDPR),

  • Rectification of inaccurate data,

  • Erasure (“right to be forgotten”) in certain cases,

  • Restriction of processing in certain cases,

  • Data portability where applicable,

  • Objection to processing based on legitimate interests,

  • Withdraw consent at any time (if processing is based on consent), without affecting prior lawfulness.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise your rights, contact us at: [privacy email].

10) Portfolio and publication of photos

Photos can be personal data when individuals are identifiable. We clarify publication rules in our agreements and/or obtain consent where required, especially for:

  • publication on our website,

  • Instagram/social media posts,

  • advertising materials,

  • model calls / TFP publications.

If publication is based on consent, you can withdraw it, but note that withdrawal generally affects future use rather than past lawful processing.

11) Contact forms and email enquiries

When you contact us, we process the data you provide to respond and manage the request. This is typically necessary for pre-contract steps or based on our legitimate interest in communicating efficiently.

12) Security

We use appropriate technical and organizational measures to protect personal data (e.g., access controls, secure passwords, and limiting access to those who need it for service delivery).

13) Changes to this policy

We may update this Privacy Policy when our processing changes or when required by law. The “Last updated” date indicates the latest revision.

14) Contact

Paschalis Serafeim Photography
Email: [lightandlegacy.studio@gmail.com]
Address: [Mbrapa postes Nr. 4, Zogu I Blvd, 1001 Tirana, Albania]
Phone: [+355696011004]