Privacy policy

The data controller is:

Nando Spiezia, sole proprietorship trading as Nando Spiezia Photography
Via Guglielmo Marconi, 3 – 80059 Torre del Greco (NA), Italy
VAT IT08557451211
Email info@nandospiezia.com · Phone +39 081 19516143

• When you fill in the contact form: your names, email, phone or WhatsApp number (optional), wedding date, venue, number of guests, what you are interested in, the collection, how you found me and your message.
• When you write to me by email, WhatsApp or Instagram: the data in your message and your contact details.
• If you book: the data needed for the contract and invoices, such as full names, addresses, tax codes, event details and payments.
• Browsing data: the technical data every website receives, such as IP address, browser and pages visited, used by the hosting provider to deliver and protect the site.
• Statistics and advertising data: only if you accept them in the cookie banner. See the cookie policy.

Only your names and email are required to reply to you; everything else is optional.

• To reply to you and prepare a proposal: steps taken at your request before a contract (art. 6.1.b GDPR).
• To send you a reminder about the proposal you asked for: legitimate interest (art. 6.1.f). You can ask me to stop at any time.
• To carry out the contract and photograph your wedding (art. 6.1.b).
• To meet tax and accounting obligations (art. 6.1.c).
• To keep the site secure and working: legitimate interest (art. 6.1.f).
• Statistics and measuring advertising: only with your consent (art. 6.1.a), which you can withdraw at any time.

I do not send promotional emails or newsletters, I do not sell data and I make no automated decisions about you.

• Requests that do not become a booking: 24 months from our last contact, then deleted.
• Clients: for the whole contract and then for 10 years for contracts and invoices, as required by Italian law (art. 2220 of the Civil Code).
• Technical browsing data: only for the short time the hosting provider needs for security.
• Statistics: for the period set in Google Analytics, never more than 14 months.

Your data is handled only by services I use to run the studio, bound by data protection agreements:

• Cloudflare: hosts the site, passes the contact form to my management system, streams the wedding films (Cloudflare Stream) and stores the photographs of the fast galleries (Cloudflare R2, in Western Europe).
• Supabase: the database of my management system, on servers in London (United Kingdom).
• Zoho: my email service, in its European data centre.
• Google Analytics and Google Ads (Google Ireland), Microsoft Clarity (Microsoft Ireland) and Meta Pixel (Meta Platforms Ireland): only if you accept them. Google Ads tells me when a request comes from one of my adverts on Google. Clarity shows me, anonymously, how the pages are used (clicks, scrolling) so I can improve the site; what you type in the forms is always hidden.
• Google (Google Ireland), only if you sign in to the client area with your Google account: Google tells me your email address and that it is verified, nothing else.
• Google Ads (Google Ireland), only if you accept marketing cookies and send a request: your email address (and phone number, if you give it) is encrypted in your browser (SHA-256) before it reaches Google, and is used only to measure whether my ads led to your request.
• WhatsApp and Instagram (Meta): only if you choose to write to me there.

When needed for your wedding, some data is also shared with my accountant and with the trusted professionals who work with me, such as second photographers, filmmakers and the album lab. They are bound to confidentiality.

The United Kingdom is recognised by the European Commission as offering adequate protection. Some providers, such as Cloudflare, Google and Meta, may process data in the United States: in that case the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

The photographs I take at your wedding may be used for my portfolio, website and social media, as described in the contract. If you prefer that I do not publish them, tell me in writing before the wedding. You can also ask me to remove a published photo at any time, and I will do so.

Client area. Once your wedding is confirmed, you can sign in to the client area with your Google account or with a personal link that I send by email (from info@nandospiezia.com, valid for 14 days). I use your email address only to recognise your wedding in my management system and show you your contract, plan and photographs: I do not store it again and I never receive your password. You stay signed in until you close the browser tab.

Fast gallery. A first selection of photographs that the couple can share with their guests through a link and a password. The photographs are visible only to people who know the password; to remember that you entered it, the site saves a technical cookie for 60 days. Photos you mark as favourites stay only in your browser. If you appear in a photo and would like it removed, write to me.

You can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to withdraw your consent at any time. Just write to info@nandospiezia.com: I reply within 30 days.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

This site is not meant for people under 16, and I do not knowingly collect their data. If this happens, I delete it as soon as I become aware of it.

If the way I handle data changes, I will update this page and the date at the top.