Privacy Policy

Privacy policy for Viktoria Photography (viktoriaphoto.es) — how we process and protect your personal data.

This Privacy Policy has been drafted in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights (LOPDGDD) and Spanish Law 34/2002 of 11 July on information society services and electronic commerce (LSSI-CE).

By providing us with your personal data, whether through the contact form, by email or by any other means, you declare that you have read and understood this Privacy Policy.

1. Data controller

  • Controller: Viktoriia Vorobiova
  • NIF / NIE: Z0495035B
  • Address: Ronda Fort Roig 15-20, P2-7, Girona, 17007 (Spain)
  • Contact email: hola@viktoriaphoto.es
  • Trading name / website: Viktoria Photography (viktoriaphoto.es)

In accordance with Article 4(7) GDPR, the controller is the person who determines the purposes and means of the processing of your personal data.

Data Protection Officer (DPO): we have not appointed a DPO, as none of the circumstances requiring mandatory appointment under Article 37 GDPR and Article 34 LOPDGDD apply. For any data protection matter you may write directly to hola@viktoriaphoto.es.

2. For what purposes do we process your data?

We process the information you provide for the following purposes:

  • To respond to your enquiries and requests, for example those received through the contact form or by email.
  • To manage the contracting and provision of our services, including preparing quotes, performing the contract, invoicing and after-sales support.
  • To send you communications related to the contracted service (technical notices, renewals, incidents, changes to the terms of service).
  • To send you commercial offers and advertising about our services, only with your prior, express and informed consent.
  • To comply with our legal obligations, in particular those of a tax, accounting and commercial nature.
  • To ensure the security of the website (see section 9).

We do not build profiles or make decisions based solely on automated processing of your data that produce legal effects concerning you or significantly affect you in a similar way (Article 22 GDPR).

3. What data do we process?

Depending on your relationship with us, we may process the following categories of data:

  • Identification and contact data: first and last name, email address, telephone, company or business name.
  • Commercial relationship data: the content of your enquiries, services requested or contracted, quotes.
  • Billing data: tax identification number (NIF/CIF), tax address, and the data needed to issue and retain invoices.
  • Minimal technical data (IP address and date and time of access) recorded by the server for security purposes, as explained in section 9.

We do not request or process special categories of data (Article 9 GDPR), such as those relating to health, ideology, religion or ethnic origin. Please do not send us such data.

The data you provide must be truthful and up to date. You are responsible for notifying us of any changes. If you provide us with data about third parties, you warrant that you have their consent or another legal basis to do so.

The legal bases that legitimise the processing of your data, in accordance with Article 6(1) GDPR, are:

  • Consent (Art. 6(1)(a) GDPR): to respond to your enquiries when you contact us, and to send commercial communications. You may withdraw it at any time, without affecting the lawfulness of processing prior to its withdrawal (Art. 7(3) GDPR).
  • Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): to manage the contracting and provision of the services you request.
  • Compliance with a legal obligation (Art. 6(1)(c) GDPR): to meet the applicable tax, accounting and commercial obligations.
  • Legitimate interest (Art. 6(1)(f) GDPR): solely to ensure the security of our website and systems, after weighing that such interest does not override your rights and freedoms.

Sending commercial communications by electronic means is carried out in accordance with Article 21 LSSI-CE, which requires your prior, express consent, or the existence of a prior contractual relationship in respect of services similar to those contracted. In all communications we will offer you a simple and free means to unsubscribe.

Minors: this website and our services are aimed at adults and professionals. In accordance with Article 7 LOPDGDD, the processing of data of minors under 14 is only lawful with the consent of their parents or guardians. If you become aware that a minor has provided us with data without such consent, please notify us so we can delete it.

Consequences of not providing the data: the data marked as mandatory in our forms is necessary to respond to your request. If you do not provide it, we will not be able to process it.

5. How long do we retain your data?

  • Enquiries with no subsequent contractual relationship: we retain your data for as long as necessary to respond to your request and, thereafter, for up to 12 months, unless you withdraw your consent earlier.
  • Clients: for as long as the contractual relationship is maintained and, once it has ended, for the limitation periods of any liabilities arising from the relationship, which are generally five years for personal actions (Article 1964 of the Spanish Civil Code).
  • Tax and accounting documentation (invoices, books): for the period required by applicable law — generally four years under Article 66 of Spanish Law 58/2003 (General Tax Law) and six years under Article 30 of the Commercial Code.
  • Commercial communications: until you withdraw your consent or request to unsubscribe.

Once these periods have elapsed, your data will be blocked in accordance with Article 32 LOPDGDD, remaining available exclusively to judges, courts and public authorities during the limitation period of any potential liabilities, and will subsequently be securely deleted.

6. To whom are the data communicated?

We do not disclose your data to third parties under any circumstances, except where there is a legal obligation, for example in response to requests from the Tax Agency, the security forces, judges and courts or other competent authorities.

All data is processed internally by Viktoria Photography and stored on servers located in Girona, Spain. We do not carry out international transfers of data to third countries or international organisations (Chapter V GDPR).

If in the future we use a provider that accesses personal data on our behalf (data processor), we will do so under a corresponding contract in accordance with Article 28 GDPR and will update this policy.

7. What are your rights?

In accordance with Articles 15 to 22 GDPR and Articles 12 to 18 LOPDGDD, you may exercise the following rights:

  • Access (Art. 15 GDPR): know whether we process your data and obtain a copy of it.
  • Rectification (Art. 16 GDPR): correct inaccurate or incomplete data.
  • Erasure or “right to be forgotten” (Art. 17 GDPR): request that we delete your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
  • Restriction of processing (Art. 18 GDPR): request that we suspend processing in the circumstances provided for by law.
  • Data portability (Art. 20 GDPR): receive your data in a structured, commonly used and machine-readable format and transmit it to another controller.
  • Objection (Art. 21 GDPR): object to the processing of your data, in particular processing for direct marketing purposes.
  • Not to be subject to automated individual decision-making (Art. 22 GDPR).
  • Withdraw your consent at any time (Art. 7(3) GDPR), as easily as you gave it.

How to exercise them: send an email to hola@viktoriaphoto.es stating the right you wish to exercise and attaching a copy of your identity document, or another document accrediting your identity, to prevent third parties from accessing your data. You may also send your request in writing to the postal address indicated in section 1.

Response time: we will respond to your request without undue delay and, in any case, within one month of receipt, extendable by two further months if necessary taking into account the complexity and number of requests (Article 12(3) GDPR). Exercising your rights is free of charge, unless the requests are manifestly unfounded or excessive.

Right to lodge a complaint: if you consider that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) in accordance with Article 77 GDPR and Article 63 LOPDGDD:

  • Website: www.aepd.es
  • Postal address: C/ Jorge Juan, 6, 28001 Madrid

We would appreciate it if, before contacting the AEPD, you gave us the opportunity to resolve any incident by contacting us.

8. Cookies and tracking

This website does not use cookies of any kind. We do not install technical, preference, analytical or advertising cookies in your browser or on your device. Therefore, and in accordance with Article 22(2) LSSI-CE, it is not necessary to obtain your consent or display a cookie banner.

We do not track you. We do not use analytics, tracking, profiling or advertising tools that record your activity on our site. We do not collect browsing data for tracking purposes or share information with third parties for such purposes. Nor do we use third-party resources (such as fonts, maps, videos or embedded social media buttons) that could transmit your IP address to other operators.

External links: this website may contain links to third-party pages. We are not responsible for their privacy policies or their cookies; we recommend that you review them when accessing them.

9. Server logs and security

As with any website, our server may automatically record minimal technical data for each visit (IP address, date and time, requested page and browser type). These logs:

  • are used exclusively to ensure the security and correct functioning of the site and to detect and prevent abuse or computer attacks;
  • are processed on the basis of legitimate interest (Art. 6(1)(f) GDPR);
  • are not used to build profiles or for commercial or analytical purposes;
  • are retained for a maximum of 12 months and then deleted.

Security measures: in accordance with Article 32 GDPR, we apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration, including the use of encrypted connections (HTTPS), access controls and backups. In the event of a security breach that poses a risk to your rights and freedoms, we will notify the AEPD within 72 hours and, where the risk is high, we will communicate it to you without undue delay (Articles 33 and 34 GDPR).

10. Commercial communications and unsubscribing

We will only send you commercial communications if you have given your express consent or if there is a prior contractual relationship and the communications relate to similar services (Article 21 LSSI-CE). You may revoke your consent and unsubscribe at any time, free of charge, through the link or instruction included in each communication or by writing to hola@viktoriaphoto.es.

Before carrying out commercial communications, we will consult the applicable advertising exclusion systems, in accordance with Article 23 LOPDGDD.

11. Changes to this policy

We may update this Privacy Policy to adapt it to legislative or case-law changes or to changes in our processing activities. The current version will always be the one published on this page, indicating the date of the last update. If the changes are substantial, we will notify you by appropriate means.

12. Applicable law and jurisdiction

This Privacy Policy is governed by Spanish law and European data protection regulations. Without prejudice to your right to contact the AEPD, any dispute arising from the processing of your data shall be subject to the courts and tribunals that are competent under applicable law and, if you are a consumer, those of your domicile.

Last updated: 30/09/2026