Privacy Policy

Data controller

The controller responsible for the personal data described in this policy is:

Data I collect

When you use the website or inquiry form, I process the following categories of personal data:

• your name, email address, and the language selected on the website;
• the wedding date and information you include about the planned event;
• the content and history of our correspondence;
• technical, security, and analytics data such as page visits, referrers, browser and device information, performance metrics, request logs, the result of Cloudflare Turnstile verification, and an anonymous per-tab identifier stored in sessionStorage for contact-funnel events.

Purposes and legal bases

I use your contact and event information to reply, check availability, prepare an offer, and take steps at your request before a possible photography agreement. The legal basis is Article 6(1)(b) GDPR.

I process necessary technical and security data to keep the website available and protect the form against spam, fraud, and other abuse. The legal basis is my legitimate interest under Article 6(1)(f) GDPR.

I use Cloudflare Web Analytics to understand aggregated visits, traffic sources, device categories, website performance, contact-funnel actions, and the number of confirmed inquiry submissions so I can improve the website. For links I share, I also record the campaign labels included in the link and the landing page, without recording the visitor's identity or the full query string. To measure the contact funnel, the website stores an anonymous identifier in sessionStorage for the current browser tab and sends it with contact-link, form-start, email-intent, and confirmed-inquiry events; it is not used to identify you or track you across websites. This service does not use cookies. The legal basis is my legitimate interest under Article 6(1)(f) GDPR.

When you arrive from Google, Bing, or DuckDuckGo without a tagged link, the website may record only that search-engine category and the landing page for the current session. It does not record your search terms, the full referrer URL, or your identity. Tagged campaign links take precedence over this coarse attribution.

If we enter into an agreement, relevant information may be processed further to perform it, meet legal or accounting duties, and establish, exercise, or defend legal claims under Article 6(1)(b), (c), or (f) GDPR, as applicable.

Inquiry data is not used for newsletters, advertising, or other direct marketing.

Is providing the data required?

Providing data is voluntary and is not a statutory requirement. The name, email address, wedding date, and message are required by the form so I can identify the inquiry, reply, and assess availability. Without them, I cannot handle the inquiry through the form.

Service providers and recipients

Personal data is available only to me and to providers that support the inquiry process where access is necessary to provide their services:

• Cloudflare, Inc. — website hosting, traffic security, privacy-first web analytics, and Turnstile bot verification;
• Plus Five Five, Inc. (Resend) — delivery of the inquiry to my mailbox and temporary access to the sent message in the Resend dashboard;
• Apple Distribution International Ltd. (iCloud Mail) — hosting the mailbox in which I receive and manage inquiries.

Transfers outside the EEA

Cloudflare and Resend process inquiry data in the United States. Apple Distribution International Ltd. is established in Ireland, but Apple may make subsequent international transfers. The following safeguards apply:

• Cloudflare relies on the EU-US Data Privacy Framework for transfers to the United States. If that framework is unavailable or does not apply, the EU Standard Contractual Clauses (Module Two) and supplementary safeguards apply. Details are available in the Cloudflare Customer DPA.
• Resend's primary processing takes place in the United States. Transfers from the EEA are made under the European Commission's 2021/914 Standard Contractual Clauses, Module Two, incorporated into the Resend DPA.
• Apple states that international transfers of personal data collected in the EEA are governed by Standard Contractual Clauses. A copy can be requested through Apple's privacy contact.

Retention

If an inquiry does not result in a booking, I delete my correspondence and its personal data 12 months after our last communication.

Resend currently retains email data used for delivery for 30 days. The working copy used for correspondence remains in my iCloud mailbox for the period described above.

If an inquiry results in an agreement, relevant correspondence becomes part of the client record. It is retained for the duration of the relationship and afterward only for periods required by accounting, tax, contractual, or legal-claims obligations.

Technical security and aggregated analytics information are retained only for the period necessary to operate, improve, and protect the service, subject to the configured retention periods of the relevant provider.

Your rights

Depending on the circumstances and the legal basis, you may request:

• access to your personal data and a copy of it;
• correction of inaccurate or incomplete data;
• erasure of data where there is no legal reason to retain it;
• restriction of processing;
• data portability where the statutory conditions apply;
• objection to processing based on legitimate interests.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).

Automated decision-making

I do not use inquiry data or website analytics for profiling or decisions that produce legal or similarly significant effects. Cloudflare Turnstile automatically assesses technical signals only to distinguish legitimate use from automated abuse.

Privacy requests

To ask a question or exercise your data-protection rights, contact me at privacy@anastasiamykhalchuk.com .

Policy updates

I may update this policy when the inquiry process, service providers, or legal requirements change. The effective date above identifies the current version.