Privacy Policy

Privacy Policy

This Privacy Policy explains how Lens & Brush Studio processes personal data in connection with its photography services, website use, bookings, consultations, image selection, and file delivery. It applies to visitors, prospective clients, and clients who interact with the studio through the website or related communication channels.

Terms of ServiceContact
Effective Date
As stated in this policy
Scope
All users of our services
Questions?
Contact
01 · Purpose

How We Use Data

We use personal data to respond to inquiries, assess project scope, prepare quotes, review product counts and shot lists, schedule sessions, manage communication, produce and edit images, deliver private galleries and final files, handle payments and records, maintain website functionality, improve service quality, and comply with legal obligations. Where image usage notes are prepared, they are used to document the agreed scope of use for the delivered work.

Processing is limited to the studio's operational and legal needs.
02 · Sharing

Service Providers

We may share personal data with trusted service providers that support website hosting, communication handling, file storage, gallery delivery, payment processing, and administrative support. These parties act under instructions or contractual obligations appropriate to their role and may not use the data for unrelated purposes. We may also share information with professional advisers where needed for accounting, legal, or operational support.

Service providers receive only the data needed to perform their functions.
03 · Legal basis

Legal Disclosure

We may disclose personal data to public authorities, courts, or other parties where required to comply with law, respond to lawful requests, protect our rights, or address fraud, security, or similar concerns. Any disclosure is limited to what is reasonably necessary for the relevant purpose.

Disclosure may occur when a legal duty or valid authority request applies.
01

Data We Collect

We may process identification and contact details, inquiry content, booking information, project brief details, product counts, shot lists, reference materials, usage notes, payment and invoicing records, gallery access data, communication records, and technical data such as device and browser information. Where relevant, we also process image files and related metadata needed to carry out the photography service and deliver edited files.

The categories collected depend on the inquiry, booking, and delivery steps used.
02

Data Sources

We receive personal data from contact forms, email, phone calls, consultation appointments, booking discussions, shot list approvals, gallery review activity, and payment interactions. We may also obtain limited technical data automatically when the website is used, and we may generate internal records from our own service workflow, such as session notes, delivery status, and communication history.

Most data is provided directly by the client during the service process.
03

Types of Cookies

We may use essential cookies for site operation, security, and form functionality; preference cookies to remember basic settings; and analytics or performance cookies to understand how the site is used. If third-party tools are enabled, they may place their own cookies subject to their respective policies and the settings available to the user.

Cookie use is limited to standard website functions and related operational needs.
04

Cookie Controls

Where cookies or similar technologies are used, users can manage them through browser controls and, where available, site-level preference tools. Disabling some cookies may affect basic website functions, form handling, or gallery-related features. We do not rely on cookie choices to override legal requirements or essential service operations.

Browser settings can be used to limit non-essential cookies.

Subject to applicable law, individuals may have rights to access their data, correct inaccurate information, request deletion, object to certain processing, and obtain restriction or portability in appropriate cases. Where processing is based on consent, that consent may be withdrawn for future processing. These rights do not apply without limit and may be balanced against legal duties and legitimate interests.

Available rights may vary depending on the legal basis and the context of processing.

To exercise a privacy right, the requester should provide enough information for us to identify the relevant record and confirm the scope of the request. We may need additional details to verify identity or to understand the request. If a request is refused in whole or in part, we will explain the reason where the law requires us to do so.

Requests are handled through the contact details listed in this policy.

We keep personal data only for as long as needed for the purpose for which it was collected, including project administration, accounting, dispute handling, and legal compliance. When data is no longer needed, we delete it, anonymize it, or archive it where retention is required by law or justified by a legitimate business need.

Retention depends on the purpose of the record and any legal obligation that applies.

We may update this Privacy Policy to reflect changes in our services, processing activities, legal requirements, or operational arrangements. The revised version will apply from the date it is published unless a different effective date is stated. Users should review the policy periodically to stay informed about current practices.

We review this notice when our practices or legal obligations change.
GDPR

Regulation

GDPR Overview

Under the GDPR, we process personal data only where we have a lawful basis, such as performance of a contract, compliance with legal obligations, legitimate interests, or consent where required. We apply data minimization, purpose limitation, and storage limitation principles to the extent relevant to our operations.

Where the GDPR applies, it governs our processing of personal data for users in the European Economic Area and, in some cases, for related processing carried out from Spain.
Reference materials
RegulationGeneral Data Protection Regulation (GDPR) - EUR-Lex
Supervisory AuthorityAgencia Española de Protección de Datos (AEPD)
This section is intended for individuals whose data is protected by the GDPR.

GDPR-aware data handling

GDPR Rights

Where the GDPR applies, individuals may request access, rectification, erasure, restriction, portability, or objection, and may withdraw consent where processing depends on consent. Some requests may be limited by legal retention duties, contractual needs, or the rights of others. We may ask for information needed to verify identity before acting on a request.

GDPR rights are assessed against the legal basis and the nature of the request.

Contact Information

Email address
[email protected]
Telephone
+34 611 59 01 44
Postal address
Calle de Blas Infante, 5, 29750 Algarrobo
Privacy contact
Use the contact details below for privacy questions, rights requests, or policy-related correspondence.
Contact Page