Privacy policy

Summary

This website is run by the photographer named above. It shows no advertising, loads no third-party scripts, fonts or trackers, and does not sell or share your data. Visitors are counted without cookies, and only as anonymous daily totals.

Contact form

When you use the contact form we process your name, your e-mail address, your message and the date it was sent.

• Purpose: to read and answer your inquiry and, if you ask for a quote or booking, to prepare it.
• Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) where your message concerns a commission; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering messages sent to us).
• A copy of your message is sent by e-mail to the site owner's mailbox, operated by Proton, Switzerland.
• Retention: inquiries are deleted automatically 12 months after they were received, or earlier on request. If your inquiry leads to a contract, the related correspondence is kept outside this website for as long as accounting and tax law requires.
• Messages that look automated, for example sent faster than a person can type, are kept apart and deleted after 30 days. Submissions caught by our hidden anti-spam field are discarded immediately and never stored.
• Providing these details is voluntary, but without a valid e-mail address we cannot reply.

Hosting and technical data

The website is hosted by Gandi SAS, France, which processes data on our behalf as a processor (Art. 28 GDPR) within the European Union.
Every time you load a page, your browser sends your IP address, the requested address, the time and a description of your browser (the "User-Agent"). We need this to deliver the page and to protect the site (Art. 6(1)(f) GDPR). The application itself does not write IP addresses or User-Agents to disk or to its logs. To prevent abuse, it keeps short-lived request counters keyed by IP address in memory only, for at most one hour. The hosting provider's network equipment may keep technical security logs under its own retention rules.

Audience statistics without cookies

We count visits in a way that does not identify you and does not follow you around the web:

• No cookie, no local storage, no tracking script and no fingerprint are stored on your device. We only use the request your browser already makes to load the page.
• For each day a new random secret ("salt") is created and kept only in the server's memory. From the salt, this site's domain, your IP address and your User-Agent we compute a one-way hash, also only in memory, to tell whether today's visit is a repeat visit. At midnight (Luxembourg time), and whenever the server restarts, the salt and all hashes are discarded. Visits on different days can therefore not be linked.
• The only data written to disk are daily totals: the date, the page address (without any query string), the domain of the website that linked to us, the device category (desktop, mobile or tablet) and the number of page views and visitors. Your IP address, User-Agent and the hash are never stored.
• The statistics are used only by the site owner to understand which pages interest visitors. They are not shared with anyone, not combined with other data, and not used to track individuals.
• Not counted at all: the site owner while logged in, search engines and other bots, browser link prefetching, and any browser that sends a Global Privacy Control (Sec-GPC) or Do Not Track signal. Turning on one of these settings in your browser is enough to object (Art. 21(5) GDPR).
• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in anonymous audience measurement). This follows the CNPD's conditions for audience measurement that does not need consent.
• Retention: the daily totals are deleted after 24 months.

Cookies

We set one strictly necessary first-party session cookie, stored together with a second cookie that holds its integrity signature. Browsing the portfolio sets no cookie: it is only set when you open the contact form (or the administration login). For visitors it contains only a random security token that protects the contact form against cross-site request forgery. For the site owner it also carries the administration login. It expires after 8 hours at the latest and is not used to recognise or count you. Because it is strictly necessary, no consent is needed (Art. 5(3) of Directive 2002/58/EC, as transposed in Luxembourg). We use no analytics, advertising or social media cookies.

Photographs and administration data

Photographs on this site may show people. If you appear in a photograph and want it removed, or you have other concerns about it, please contact us. Internally the site keeps the original file names of uploaded photographs for as long as the photograph is in the library, and the administrator's username and password hash for as long as the account exists.

Recipients

Your data is processed only by the site owner and by the providers named above (Gandi SAS, France for hosting, Proton, Switzerland for e-mail), acting on our instructions. We do not sell personal data and we do not use it for automated decision-making or profiling.

Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, write to luxophoto.dripping950@passfwd.com. We answer within one month (Art. 12(3) GDPR).

Complaints

You can lodge a complaint with the Luxembourg data protection authority:
Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg. Website: https://cnpd.public.lu
You may also contact the supervisory authority of the EU country where you live or work.