Privacy Statement

1. Who is responsible

This website (alr-photography.com), its client area (alr-photography.com/my-account) and the bookings made through them are run by Aaron Roberts (ALR Photography), a photographer based in Cluj-Napoca, Romania. I am the “controller” of the personal data described here. For anything to do with your data, email contact [at] alr-photography.com. ALR Photography is a small business, so you’ll always be dealing with me directly.

My bookings, invoices and client records are kept in this website’s own system, on the same server as the website.

2. Messages and quote requests

When you use the contact form or ask for a quote, I receive what you type in: your name, email address, phone number, company, the date, place and details of what you have in mind. The form also stores your IP address and browser type with the message, to stop spam and abuse.

• Why: to reply to you and, for a quote, to prepare an offer that I can follow up.
• Legal basis: taking steps at your request before a contract (GDPR Article 6(1)(b)); for the IP address and spam check, my legitimate interest in keeping the forms free of spam (Article 6(1)(f)).
• If we talk by phone, WhatsApp or email, I keep what’s needed to follow up your request.

3. Bookings, payments and invoices

When you book a session, hire the studio or send a booking request, I need your name, email address, phone number and billing address – and, if you book as a company, its name, tax number (CUI) and registration details. I also keep your answers in the booking form (for example the backdrop colour you’d like or how many people are coming), any notes you add and, for sessions on location, the address of the location.

• Why: to take and manage your booking, send you confirmations and reminders, issue invoices, take payment, handle changes, cancellations and refunds, and contact you about the session.
• Legal basis: the contract with you (Article 6(1)(b)); keeping invoices and accounting records and sending invoices to the Romanian tax authority’s e-Factura system are legal obligations (Article 6(1)(c)).
• Company details: when you enter a Romanian tax number, the company’s name and address are looked up in the public register of the National Agency for Fiscal Administration (ANAF).
• Addresses: when you type an address (for a session on location or to estimate the travel fee), what you type is sent to Google Maps to suggest matching addresses and work out the distance.
• Payments – for a booking, a gift card or an invoice in the client area – are made on Stripe’s secure payment page. I never see or store your card details; I receive confirmation that the payment went through and the payment reference. When you pay with a voucher or by bank transfer, that is recorded against the invoice.
• Studio setup: if you plan the studio’s lights and backdrop online before your session, the plan is saved with your booking so it’s ready when you arrive.
• My calendar: your booking (time, service and your name) appears in my own private booking calendar, which only my devices can read.
• Studio hire: the person hiring the studio uploads a copy of their photo ID through a secure link before arrival. It is used only to confirm who is responsible for the studio during the booking (the contract with you, Article 6(1)(b), and my legitimate interest in protecting the studio and its equipment, Article 6(1)(f)), and it is stored encrypted and deleted automatically 7 days after it is uploaded (if your session is later than that, as soon as the session has ended). A short note that an ID was received and when it was deleted – never the ID itself – stays with the booking.
• Studio Wi-Fi: the studio’s guest Wi-Fi (joined with the QR code in the studio) is kept separate from my own network. The Wi-Fi router keeps a short technical record of the devices that connect and when (the device’s network address), for security; it is deleted within 30 days.

4. Gift cards and vouchers

When you buy a gift card I need your name and email address (for the invoice and to send it to you) and, if you want it sent or addressed to someone, their name, email address and your message. You can choose to give it anonymously. Gift cards, credit from a cancelled booking and personal rewards are kept as voucher codes; I record which booking or invoice a code is used on and what’s left on it.

• Legal basis: the contract with you (Article 6(1)(b)); the invoice is kept as an accounting record (Article 6(1)(c)). For the person receiving the gift, my legitimate interest in delivering the gift you bought for them (Article 6(1)(f)).

5. The client area, galleries and downloads

After your session you get an account in the client area at alr-photography.com/my-account, where you can see your bookings and invoices, pay, choose your favourite photos from a private gallery, sign agreements and download the finished images.

• Your account holds your contact details, your language, your password (stored only as a secure hash) and, if you switch it on, two-step sign-in. For security I keep a record of sign-ins and active sessions: when, the IP address and the device and browser.
• Shared accounts: a company or family account can have several people. The person who manages the account decides who is in it and whether they can see invoices; each person sees the account’s bookings and galleries.
• Galleries: the client area records your choices, any messages you send with them, and the people you invite to help choose (I receive the name and email address you give, and they get an email invitation). Each time a gallery is opened I record when, the IP address and the device. If someone tries to save a preview instead of choosing it, the attempt is recorded (when, which photo, IP address and device) – previews are small, watermarked copies, and this helps me see when someone needs help and protects the photos.
• Downloads: each visit to your download page and each download is recorded (when, which files, IP address and device), so I know your photos arrived and can help if something goes wrong. Some downloads ask you to confirm your email address or sign an agreement first.
• “Log in as”: to help with a problem I can open the client area as you see it, for up to 15 minutes. Each time is recorded (when, by whom, from which IP address). I never see your password.
• Legal basis: the contract with you (Article 6(1)(b)); for the security and activity records, my legitimate interest in keeping accounts safe, proving delivery of your photos and protecting my work (Article 6(1)(f)).
• Galleries and downloads are only available for a limited time (shown in each one). After that the files are removed from the client area.

6. Agreements and model releases

Some sessions and downloads come with an agreement – for example a model release saying how the photos may be used. When you sign one I keep the agreement text and its version, your name, email address and, where the agreement asks for them, your phone number and address, your signature, the language you signed in, the date and time, and the IP address it was signed from. You get a PDF copy.

• Legal basis: the contract with you (Article 6(1)(b)), and my legitimate interest in being able to show what was agreed (Article 6(1)(f)).

7. Booking restrictions and business protection

To protect our business, maintain a safe working environment, prevent misuse of our services and enforce our Terms and Conditions, ALR Photography may maintain confidential internal records relating to customers whose previous conduct has resulted in a booking restriction.

Information processed

Where necessary and proportionate, these records may include:

• The customer’s name, email address and telephone number.
• Company name and tax identification number (CUI), and billing address.
• A non-reversible card identifier provided by our payment processor (Stripe), which does not reveal the card number. While a restriction is active, this identifier and the email address may also be placed on Stripe’s fraud-prevention block list, so that a payment cannot be made with them.
• Relevant booking references and dates.
• A factual description of the incident or contractual breach giving rise to the restriction.
• The date, justification and duration of the restriction.
• Supporting correspondence or documentation, where necessary.
• The date on which the restriction must be reviewed.

Legal basis and purpose

The legal basis for this processing is our legitimate interests under Article 6(1)(f) of the General Data Protection Regulation (GDPR), subject to an assessment of necessity and the rights and interests of the individuals concerned.

The information is used solely for legitimate business protection, customer and staff safety, contractual compliance, dispute management and prevention of deliberate circumvention of justified booking restrictions.

Retention

Restriction records will be reviewed periodically and retained only for as long as reasonably necessary for their stated purpose.

As a general maximum, records will be retained for up to three years following the most recent relevant incident, unless a shorter period is appropriate or continued retention is necessary and legally justified, including in connection with ongoing legal proceedings or disputes.

Records that are no longer necessary will be securely deleted or anonymised.

Access and automated processing

Access to these records is restricted to authorised persons responsible for managing bookings and business operations.

Our booking system may flag potential matches for additional verification. A potential match does not automatically establish that a customer is subject to a restriction.

Any final decision to refuse or cancel a booking on this basis will be subject to meaningful human assessment.

Your rights

Under the GDPR, individuals may request access to their personal data, seek correction of inaccurate information, object to processing, or request erasure where applicable.

Requests or objections may be submitted using the contact details provided in this Privacy Policy.

Individuals also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

8. Photographs of you

The photos from your session are personal data. I use them to deliver your photos and, where you’ve agreed to it, to show my work on this website and on social media. The legal basis is our agreement (Article 6(1)(b)) or your consent (Article 6(1)(a)), which you can withdraw at any time for future use.

• Each session has a shoot reference – usually your initials and the date (for example AB040726) – which is on your invoice and in the photos’ file names. I keep a record of each session under it: the date, your booking, invoices, gallery, downloads and agreements, and the folder where its photos are kept, so everything about your session can be found together.
• Photos of children are only taken and shown with the agreement of a parent or guardian.
• Boudoir galleries are blurred until a visitor confirms they are 18 or over.
• If you appear in a photo on this website and want it changed or removed, email contact [at] alr-photography.com with a link to the page.

9. Reviews and client points

• Review requests: after I deliver your photos I may send one email asking how it went, with links to review sites. Those links go through this website first, so I know which site you chose; I don’t see what you write until it’s published there. Legal basis: my legitimate interest in feedback on my work (Article 6(1)(f)); just tell me if you’d rather not get these.
• Client points: clients collect points from what they pay (each payment counting less as it gets older) and from leaving a review, and can receive rewards such as credit for a future session. I keep how your points were worked out and a history of the total. Legal basis: my legitimate interest in thanking returning clients (Article 6(1)(f)). Companies don’t collect points.

10. Updates and offers

If you tick the box to receive updates (when booking, buying or in the client area), I may email you news, offers and seasonal promotions. The legal basis is your consent (Article 6(1)(a)); every email has an unsubscribe link and you can also untick the box in the client area at any time. I keep a record of when and how you subscribed or unsubscribed (including the IP address), as proof of your choice. Without that consent you only receive emails about your bookings, invoices, photos and the review request above.

11. The emails I send

Emails are sent through Amazon Web Services. Amazon reports back whether each email was delivered, delayed, bounced or marked as spam (spam reports come from your email provider). I use these reports to make sure important emails – like your download link – reach you, and to stop sending to addresses that don’t work. I don’t track whether you open my emails, and their links aren’t tracked by Amazon. Links that lead to this website carry a marker saying the visit came from an email – the same marker for everyone – so, together with the link’s own code (for example your download link), I can see that you opened the page from the email. Nothing else about the click is recorded. I keep a record of the emails sent to you (to whom, what about and when). Legal basis: the contract with you and my legitimate interest in reliable delivery (Article 6(1)(b) and (f)).

12. When you browse this website

• Without your consent the website only uses what it needs to work: a cookie remembering your cookie choices, one remembering your 18+ confirmation if you give it, a temporary cookie when you open a form or book, and – when you use the client area – sign-in cookies. Details are in the cookie policy.
• With your consent (Article 6(1)(a) GDPR and Article 4(5) of Romanian Law 506/2004), Google Analytics 4 records how the site is used: pages viewed, approximate location (country/city), device and browser type and how you arrived. Google Analytics doesn’t store full IP addresses. It is only switched on if you choose “Accept” or allow statistics in the cookie settings, and you can withdraw that at any time with “Cookie settings” at the bottom of every page.
• Videos from YouTube or Vimeo only load if you allow them or press “Play video”.
• The studio map is drawn with map tiles from OpenFreeMap; like any server you load something from, theirs sees your IP address.
• Like every web server, the hosting server keeps short-term technical logs (IP address, page requested, time, browser) for security and to fix problems (legitimate interest, Article 6(1)(f)).

13. Who else handles your data

I don’t sell your data or share it for anyone else’s marketing. These service providers process some of it on my behalf, under data processing terms:

• Web hosting – the server this website, the client area and the customer management system run on, in the EU.
• Cloudflare – delivers the website securely and quickly and filters malicious traffic; it sees IP addresses. Cloudflare may transfer data to the USA under the EU–US Data Privacy Framework.
• Stripe Payments Europe Ltd (Ireland) – card payments, and its fraud-prevention block list while a booking restriction is active (see section 7).
• Google Ireland Ltd – Google Maps (address suggestions and distances), and only with your consent Google Analytics and YouTube videos. Google may transfer data to the USA under the EU–US Data Privacy Framework.
• Amazon Web Services EMEA (Luxembourg, servers in Frankfurt) – sends my emails and reports whether they were delivered (see section 11).
• ANAF (the Romanian tax authority) – receives invoices through e-Factura, as the law requires, and answers company look-ups.
• WhatsApp (Meta) – only if you choose to message me there.

I may also disclose data if the law requires it, or to establish or defend legal claims.

14. How long data is kept

• Messages and quote requests that don’t lead to a booking: 2 years.
• Bookings, invoices, payments and gift-card purchases: for as long as Romanian accounting and tax law requires (currently up to 10 years).
• Session records (the shoot reference and what belongs to it): as long as the session’s invoices are kept.
• The IP address recorded with a booking or gift-card order: 12 months.
• Studio setup plans: 12 months after the session.
• Copies of ID for studio hire: 7 days after the upload, or until the session has ended if that is later.
• Studio Wi-Fi connection records: up to 30 days.
• Client area account and its people: while you’re a client; you can ask me to close it at any time (invoices are still kept as above).
• Client-area sign-in records: until the sign-in expires (12 hours, or 30 days with “keep me signed in”).
• Gallery and download activity (openings, visits, downloads, save attempts): 12 months after the gallery or download ends, and at most 2 years.
• “Log in as” records: 12 months.
• Galleries and downloads themselves: for the time shown in each one; I keep my own archive copies of your photos so I can help if you need them again.
• Signed agreements: for as long as the photos may be used under them, and afterwards until any legal claims about them are time-barred (generally 3 years).
• Client points and their history: while you’re a client.
• Records of your updates-and-offers choice: while you’re subscribed and for 3 years after you unsubscribe.
• Email delivery reports: 12 months. Records of the emails sent to you: 2 years. Visits that came from an email’s link: 12 months. Email opens: not kept.
• Booking restriction records: reviewed periodically, and at most three years after the most recent relevant incident (see section 7).
• Technical logs: up to 90 days.
• Google Analytics data: 14 months.

When a period ends, the data is deleted or anonymised automatically.

15. Your rights and how to complain

Under the GDPR you can ask for a copy of your data (access), have it corrected, deleted or restricted, receive it in a portable format, object to processing based on legitimate interests, and withdraw consent at any time (this doesn’t affect anything done before you withdrew it). Email contact [at] alr-photography.com – it’s free and I’ll answer within one month. Some data I must keep by law (for example invoices) can’t be deleted before that period ends. No decision about you is made by automated means alone.

If you’re unhappy with how I’ve handled your data, you can complain to the Romanian data protection authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro, or to the authority in the EU country where you live. I’d appreciate the chance to sort it out first.

Last updated 1 November 2026. If this statement changes, the new version will be published here.