Privacy Policy

Your personal data is processed by Nuno G. D. Artur (tax no. 216784514), based in 4400-239 Vila Nova de Gaia, Portugal ("the Photographer").

Contact for privacy matters and to exercise your rights: nunoarturphoto@gmail.com.

No Data Protection Officer has been appointed, as this is not required given the size and nature of the activity.

Depending on how you interact with us, we may process:

• Contact form data: name, email, the type of session requested and the content of your message.
• Emails or WhatsApp messages you send us.
• For a booked session: the data needed to provide the service and to issue invoices, and the photographs featuring people (image/likeness).

• Responding to enquiries and quotes and preparing/providing the service — performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).
• Managing the relationship and service-related communications — legitimate interest (Art. 6(1)(f)).
• Publishing photographs in the portfolio, website and social media — consent and image-use authorisation (Art. 6(1)(a) GDPR and Art. 79 of the Portuguese Civil Code). This consent may be withdrawn at any time.
• Complying with legal obligations, namely tax and accounting — legal obligation (Art. 6(1)(c)).

• Contact messages that do not lead to a booking: up to 12 months.
• Client data and invoicing documents: up to 10 years, as required by tax and accounting law.
• Photographs published with your consent: until you withdraw that consent.

To provide the service we use suppliers who process data on our behalf under a processing agreement (Art. 28 GDPR):

• Vercel Inc. — website hosting and image storage.
• Pic-Time — online gallery platform used to deliver, share and sell photographs to clients.
• Resend — sending the emails generated by the contact form.
• Google (Gmail) — receiving and managing email.
• Meta Platforms (WhatsApp) — when you contact us via WhatsApp.
• Social media (Meta/Instagram, Facebook, TikTok) — only when we publish your photographs, with your consent.

We do not sell or share your data with third parties for marketing purposes.

Some of these suppliers (for example Vercel, Pic-Time, Resend, Google and Meta) may process data outside the European Economic Area. In such cases, transfers rely on appropriate safeguards, namely the Standard Contractual Clauses approved by the European Commission and/or the EU-US Data Privacy Framework.

Under the GDPR, you have the right to request access to, rectification, erasure, restriction and portability of your data, to object to processing, and to withdraw consent at any time (without affecting the lawfulness of prior processing).

To exercise these rights, contact us at nunoarturphoto@gmail.com. We will reply within the legal deadline.

If you believe the processing of your data breaches the law, you may lodge a complaint with the supervisory authority: the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt.