privacy policy

1. data controller

2. data we process

• contact information you provide when reaching out (e.g., name, email, phone if provided, message content).
• booking data (name, email, whatsapp number, session preferences, payment information via stripe).
• blog interactions (comments, display name, likes).
• technical data such as ip address and basic server logs necessary for security and website operation.

3. purposes of processing

• responding to inquiries and booking requests.
• providing information about sessions, pricing, and availability.
• security, abuse prevention, and technical maintenance.

4. legal basis

• your consent when you contact us.
• legitimate interest for security and abuse prevention.

5. recipients & service providers

• hosting: vercel inc. (usa) — website hosting and delivery.
• database: supabase inc. (usa) — stores booking data, blog content, comments, and customer information in a postgresql database.
• file storage: vercel blob storage — stores uploaded images.
• email: brevo (sendinblue, france) — sends booking confirmations and notifications.
• if you contact us via whatsapp, processing also occurs according to that service's policies and terms.

6. international data transfers

if service providers process data outside the eea, appropriate safeguards are implemented (e.g., standard contractual clauses) where necessary.

7. retention period

• inquiries: as long as necessary for processing and according to applicable legal retention periods.
• technical logs: only as long as needed for security and error analysis.

8. your rights

you can request access, rectification, erasure, objection, restriction, and data portability by writing to arnd@arnds.photos. you can also file a complaint with the spanish data protection authority (aepd).

9. cookies & tracking

for tracking, we use vercel web analytics and, where enabled, vercel speed insights, as well as google analytics 4 / google ads with google consent mode v2.

optional analytics/marketing processing is based on your consent only. without consent, relevant google storage states remain denied.

you can change your preferences at any time via the "cookies" link in the footer.

10. payment processing

we use stripe (stripe inc., usa) for processing deposit payments. stripe processes your payment data according to their own privacy policy. this is necessary for the performance of our booking contract. stripe may set functional cookies for fraud prevention.

11. contact

for privacy questions: arnd@arnds.photos