Privacy policy
This notice explains how personal data submitted through photomilan.it, particularly through the quotation form, is processed under Articles 12 and 13 of Regulation (EU) 2016/679 (the “GDPR”).
Data controller
The data controller is Keyvan Jafari, a professional photographer operating from Milan, Italy.
For questions or to exercise the rights described below, email booking@photomilan.it.
Data collected and source
The website collects only what you choose to enter in the form: full name, email, optional phone number, area or city, requested service, property type and approximate floor area, message and confirmation that you have read this notice.
The data comes directly from you. The website does not buy lists, combine enquiries with advertising profiles or use profiling systems. A short-lived encrypted identifier is created to limit repeated submissions and automatically expires after five minutes.
Purpose and legal basis
The data is used to read your enquiry, contact you, prepare a quotation, organise a possible photography commission and keep a copy in the protected WordPress area in case email delivery fails.
The legal basis is taking steps at your request before entering into a contract under Article 6(1)(b) GDPR. If a contract is formed, some data may also be processed to comply with legal, tax and accounting duties.
The information is not used for newsletters or automated marketing. Any future promotional mailing service would require separate information and a separate legal basis.
Required and optional information
Name, email, service and acceptance of this notice are required to handle the enquiry. Other fields are optional but make the response more precise. If required fields are missing, the form cannot be submitted; you may still contact the controller by email.
Retention
Enquiries that do not result in a commission are retained for no more than 12 months from submission, then deleted. The website automatically removes older enquiry records.
If a commission is confirmed, data needed for the quotation, contract, invoicing, image-usage rights or legal claims may be kept for the period required by applicable law or needed to administer the relationship.
Recipients, hosting and international transfers
Data is accessible to the controller and, where needed, technical providers handling hosting, maintenance, security and email delivery as processors. The website is hosted on infrastructure in Amsterdam, the Netherlands.
If a provider processes data outside the European Economic Area, the transfer must rely on an adequacy decision or appropriate GDPR safeguards. Personal data is not sold or disclosed to third parties for advertising.
Security and automated decisions
Proportionate technical and organisational measures are applied, including HTTPS once the domain certificate is active, protected administrative access, server-side form validation and a stored copy in the restricted dashboard.
No solely automated decisions are made and no profiling takes place.
Your rights
Where the GDPR applies, you may request access, rectification, erasure, restriction, portability or object to processing. You may also lodge a complaint with the Italian Data Protection Authority.
To exercise a right, email booking@photomilan.it. Requests are handled without undue delay and normally within one month; identity verification may be required.
Changes to this notice
This page will be revised when services, tools or providers affecting the processing change. The published version states its most recent update date.
Last updated: 30 July 2026