Privacy policy

The data controller is:

Nando Spiezia, sole proprietorship trading as Nando Spiezia Photography
Via Guglielmo Marconi, 3 – 80059 Torre del Greco (NA), Italy
VAT IT08557451211
Email info@nandospiezia.com · Phone +39 081 19516143

• When you fill in the contact form: your names, email, phone or WhatsApp number (optional), wedding date, venue, number of guests, what you are interested in, the collection, how you found me and your message.
• When you write to me by email, WhatsApp or Instagram: the data in your message and your contact details.
• If you book: the data needed for the contract and invoices, such as full names, addresses, tax codes, event details and payments.
• Browsing data: the technical data every website receives, such as IP address, browser and pages visited, used by the hosting provider to deliver and protect the site.
• Statistics and advertising data: only if you accept them in the cookie banner. See the cookie policy.

Only your names and email are required to reply to you; everything else is optional.

• To reply to you and prepare a proposal: steps taken at your request before a contract (art. 6.1.b GDPR).
• To send you a reminder about the proposal you asked for: legitimate interest (art. 6.1.f). You can ask me to stop at any time.
• To carry out the contract and photograph your wedding (art. 6.1.b).
• To meet tax and accounting obligations (art. 6.1.c).
• To keep the site secure and working: legitimate interest (art. 6.1.f).
• Statistics and measuring advertising: only with your consent (art. 6.1.a), which you can withdraw at any time.
• Cookie-free signals to Google when consent is missing (Consent Mode): legitimate interest (art. 6.1.f) in knowing, in aggregate form, how many visits and requests my adverts bring. You can object by writing to me or by blocking Google's scripts in your browser.

I do not send promotional emails or newsletters, I do not sell data and I make no automated decisions about you.

• Requests that do not become a booking: 24 months from our last contact, then deleted.
• Clients: for the whole contract and then for 10 years for contracts and invoices, as required by Italian law (art. 2220 of the Civil Code).
• Technical browsing data: only for the short time the hosting provider needs for security.
• Statistics: for the period set in Google Analytics, never more than 14 months.

Your data is handled only by services I use to run the studio, bound by data protection agreements:

• Cloudflare: hosts the site, passes the contact form to my management system, streams the wedding films (Cloudflare Stream) and stores the photographs of the fast galleries (Cloudflare R2, in Western Europe). When you send the contact form, Cloudflare Turnstile checks in the background that it comes from a person and not from an automated program, without advertising cookies.
• Supabase: the database of my management system, on servers in London (United Kingdom).
• Zoho: my email service, in its European data centre.
• My emails to you: the emails I send from my management system contain a tiny invisible image that tells me whether and when the email was opened, so I know it reached you. It uses no cookies and records nothing else; you can block it by turning off automatic image loading in your email app. With the contact form I also receive the time zone set on your device, so my emails reach you during your working hours.
• Google Analytics and Google Ads (Google Ireland): the Google tag is loaded on every visit, but it saves cookies and uses advertising identifiers only if you accept them; without consent it sends Google only cookie-free signals (see the cookie policy). Microsoft Clarity (Microsoft Ireland) and Meta Pixel (Meta Platforms Ireland): only if you accept them. Google Ads tells me when a request comes from one of my adverts on Google. Clarity shows me, anonymously, how the pages are used (clicks, scrolling) so I can improve the site; what you type in the forms is always hidden.
• Google Ads (Google Ireland), only if you accept marketing cookies and send a request: your email address (and phone number, if you give it) is encrypted in your browser (SHA-256) before it reaches Google, and is used only to measure whether my ads led to your request.
• WhatsApp and Instagram (Meta): only if you choose to write to me there.

When needed for your wedding, some data is also shared with my accountant and with the trusted professionals who work with me, such as second photographers, filmmakers and the album lab. They are bound to confidentiality.

The United Kingdom is recognised by the European Commission as offering adequate protection. Some providers, such as Cloudflare, Google and Meta, may process data in the United States: in that case the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

The photographs I take at your wedding may be used for my portfolio, website and social media, as described in the contract. If you prefer that I do not publish them, tell me in writing before the wedding. You can also ask me to remove a published photo at any time, and I will do so.

Client area. Once your wedding is confirmed, you can sign in to the client area with your email address and a password that you choose yourselves, through a link I send from info@nandospiezia.com (the same link works if you forget the password). The password is stored only in encrypted form (hashed), so not even I can read it. I use your email address only to recognise your wedding in my management system and show you your contract, plan and photographs. You stay signed in on that device for 30 days, or until you sign out.

Fast gallery. A first selection of photographs that the couple can share with their guests through a link and a password. The photographs are visible only to people who know the password; to remember that you entered it, the site saves a technical cookie for 60 days. Photos you mark as favourites stay only in your browser. If you appear in a photo and would like it removed, write to me.

You can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to withdraw your consent at any time. Just write to info@nandospiezia.com: I reply within 30 days.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority of the EU country where you live.

This site is not meant for people under 16, and I do not knowingly collect their data. If this happens, I delete it as soon as I become aware of it.

If the way I handle data changes, I will update this page and the date at the top.