Privacy Policy

1. Data Collected

When using the lanaphoto.art website and its services, we collect the following data:

• Identification data: first name, last name, email address, phone number
• Booking data: date, island, time slot, chosen services
• Payment data: processed directly by Stripe — we never store banking details
• Photos: images uploaded or delivered within client galleries
• Messages: content submitted through contact forms

2. Purpose of Processing

Your data is collected and processed for the following purposes:

• Managing and tracking photo session bookings
• Delivering photos through the secure client area
• Processing payments (deposit and balance)
• Sending order-related emails (confirmation, reminders, delivery)
• Improving our service

Your data is not used for advertising purposes and is not sold to third parties.

3. Legal Basis

The processing of your data is based on the performance of a contract (Art. 6.1.b GDPR): providing the photography service requires the collection of this information.

The processing of gallery photos is based on your explicit consent at the time of booking.

4. Retention Period

• Booking and contact data: 3 years from the last service
• Client gallery photos: duration defined in your client area, after which they are automatically deleted
• Accounting data: 10 years in accordance with legal obligations

5. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of your data
• Right of rectification: correct inaccurate data
• Right to erasure: request the deletion of your data
• Right to portability: receive your data in a structured format
• Right to object: object to certain processing activities

To exercise these rights, contact us via the contact form. We will respond within 30 days.

6. Sub-processors

We use the following sub-processors, all GDPR-compliant:

• Supabase — database and photo storage (EU servers)
• Stripe — secure payment processing (PCI DSS certified)
• Resend — transactional email delivery
• Vercel — website hosting

These sub-processors only use your data as strictly necessary to provide their services.

7. Cookies

The lanaphoto.art website uses only strictly necessary cookies:

• Authentication session cookie: keeps you logged in to the client area. This cookie is deleted upon logout.

We do not use any tracking, advertising, or behavioural analytics cookies. No cookie consent banner is therefore required.

8. Contact

For any questions about the protection of your personal data, use our contact form.

If you believe your rights are not being respected, you may lodge a complaint with the relevant data protection authority in your country.