Privacy Policy

1. Data Controller

Light & Film is the data controller responsible for processing your personal data in accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data.

2. Data Protection Principles

All personal data processing complies with the following principles established by GDPR:

• Lawfulness, Fairness, and Transparency: Your data is processed lawfully, fairly, and in a transparent manner.
• Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes only.
• Data Minimisation: We only collect data that is adequate, relevant, and limited to what is necessary.
• Accuracy: We ensure your personal data is accurate and kept up to date.
• Storage Limitation: Data is kept only for as long as necessary for the purposes for which it was collected.
• Integrity and Confidentiality: We implement appropriate technical and organizational measures to protect your data.

3. Personal Data We Collect

Depending on your interaction with our services, we may collect the following categories of personal data:

A) Contact and Inquiry Data:

• Full name(s)
• Email address
• Phone number
• Wedding date and location preferences

B) Contractual and Service Data:

• Complete contact details (address, postal code, city)
• Identification data (ID/passport for contract formalization)
• Payment and billing information
• Wedding timeline, venue details, and guest information
• Visual content (photographs and videos captured during your event)

C) Web Navigation Data:

• IP address and browser information
• Navigation patterns and pages visited
• Technical data collected through cookies (see Section 11)

4. Purpose of Data Processing

Your personal data is processed for the following purposes:

• Managing inquiries and providing information about our photography services
• Contract formalization and service delivery (photography, videography, editing, and album creation)
• Billing, invoicing, and accounting obligations
• Communication regarding your event (scheduling, logistics, delivery timelines)
• Creation and delivery of your personalized photo and video gallery
• Portfolio and marketing purposes (only with your explicit consent)
• Compliance with legal obligations (tax, labor, and commercial regulations)

Marketing Communications: We will only send promotional materials, newsletters, or use your images for marketing purposes if you have provided explicit consent. You may withdraw this consent at any time.

5. Legal Basis for Processing

The processing of your personal data is based on the following legal grounds:

• Consent: When you submit a contact form or provide explicit consent for specific purposes (e.g., marketing, portfolio use).
• Contractual Necessity: To execute and fulfill the wedding photography services contract you have entered into with us.
• Legal Obligation: To comply with accounting, tax, and commercial regulations applicable in Spain.
• Legitimate Interest: For administrative management, fraud prevention, and improvement of our services.

6. Data Retention Period

Your personal data will be retained for the following periods:

• Inquiries without contract: 12 months from last communication, unless you request deletion earlier.
• Contractual data: Duration of the contract plus 6 years for legal, tax, and accounting obligations.
• Photographic content: Original files retained for 2 years after delivery; portfolio images indefinitely with consent (revocable at any time).
• Marketing communications: Until consent is withdrawn.

7. Data Recipients and Third Parties

Your personal data may be shared with the following categories of recipients:

• Service Providers: Cloud storage providers (AWS, Google Cloud), email marketing platforms (Mailchimp), and payment processors (Stripe, PayPal) acting as data processors under our instructions.
• Tax and Legal Authorities: Spanish Tax Agency (AEAT), Social Security, and other regulatory bodies as legally required.
• Professional Collaborators: Second shooters, videographers, or album designers who assist in service delivery (subject to confidentiality agreements).
• Venues and Vendors: Coordination with wedding venues or planners when necessary for service execution.

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

8. International Data Transfers

Some of our service providers (e.g., cloud storage, email platforms) may be located outside the European Economic Area (EEA). In such cases, we ensure adequate safeguards through Standard Contractual Clauses (SCCs) approved by the European Commission, or verify that recipients are certified under adequacy decisions. Your data rights remain fully protected.

9. Your Data Protection Rights

Under GDPR and Spanish data protection law, you have the following rights:

• Right of Access: Obtain confirmation of whether we process your data and access to your personal information.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): Request deletion of your data when no longer necessary or when you withdraw consent.
• Right to Restriction of Processing: Limit processing under certain circumstances (e.g., while verifying accuracy).
• Right to Data Portability: Receive your data in a structured, commonly used format and transmit it to another controller.
• Right to Object: Object to processing based on legitimate interest or for direct marketing purposes.
• Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing.

10. Security Measures

We implement robust technical and organizational security measures to protect your personal data, including:

• SSL/TLS encryption for data transmission via our website
• Encrypted storage of sensitive data (passwords, payment information)
• Regular security audits and vulnerability assessments
• Access controls and authentication systems to limit data access to authorized personnel only
• Regular backups and disaster recovery protocols

11. Cookies and Tracking Technologies

Our website uses cookies to enhance user experience and analyze traffic. Cookies are small text files stored on your device.

We use essential cookies (necessary for site functionality) and analytical cookies (to understand user behavior via Google Analytics). You can manage cookie preferences through your browser settings. For more details, please refer to our Cookie Policy (available separately).

12. Minors' Data

Our services are intended for individuals over 18 years old. We do not knowingly collect personal data from minors without parental or guardian consent. If we photograph minors at your event, we require explicit consent from their parents/guardians before including their images in any portfolio or promotional material.

13. Policy Updates

We reserve the right to update this Privacy Policy to reflect changes in our practices or legal requirements. The 'Last Updated' date at the top indicates the most recent revision. Significant changes will be communicated via email or prominent website notice. Continued use of our services after updates constitutes acceptance.

14. Governing Law and Jurisdiction

This Privacy Policy is governed by Spanish law, specifically Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of Spanish courts.