Privacy Policy

The data controller for this website is Andrea Emiliana Boggio, trading as NikEmily Photography, VAT number 05467760756, based at Via IV Novembre 97, Lequile (LE), Italy. You can reach us at nikemilyphotography@gmail.com for any question about how your data is handled.

We collect personal data in two situations: when you fill in the booking request form, and — only if you accept it — when we measure how visitors use this site.

• Booking requests. When you submit the form, we collect your name, email address, the date and location you're interested in, where you're travelling from, and anything else you choose to tell us. We use this to reply to your enquiry and, if you go ahead, to organise your shoot. The legal basis is our legitimate interest in responding to enquiries and, once you become a client, the performance of the contract between us.
• WhatsApp. Several buttons on this site open a WhatsApp chat with a message already typed in for you. Clicking one sends nothing anywhere by itself — it just opens WhatsApp with that draft ready to send. If you do send it, we collect your name and phone number as shown in WhatsApp, and the content of that conversation, for the same purpose and under the same legal basis as a booking request.
• Site analytics, only with your consent. If you accept analytics cookies in the banner, we use Google Analytics to see which pages and calls-to-action get used, so we can improve the site. This only happens after you actively accept it; the legal basis is your consent, which you can withdraw at any time (see "Cookies" below).

WhatsApp is provided by WhatsApp Ireland Limited and its parent company, Meta Platforms, Inc. Unlike the providers listed below, WhatsApp isn't a processor acting purely on our instructions — once you send us a message there, Meta also processes it as an independent controller, under WhatsApp's own privacy policy and terms, which we don't control.

We keep and use the resulting conversation the same way we handle a booking enquiry received by email (see "How long we keep your data" below).

We use a small number of outside providers to run this website. Each only processes the data described here, on our instructions, under the safeguards described below:

• Resend (resend.com) delivers the booking-request email from this site to our own inbox. Resend is based in the United States and processes this data under a GDPR data processing addendum (in force automatically on every account) backed by Standard Contractual Clauses; it keeps message data on its own systems for 30 days, purely for delivery and troubleshooting.
• Vercel (vercel.com) hosts this website and, as part of standard web hosting, automatically processes basic technical data about visitors — IP address, the approximate location derived from it, and browser/device details. Vercel is based in the United States; this processing is governed by Vercel's own privacy notice, under which it commits to Standard Contractual Clauses and its certification under the EU-U.S., UK, and Swiss Data Privacy Frameworks for transfers of this data to the US. We currently use Vercel's free plan, which does not include a bespoke, individually-signed data processing agreement — only its Pro and Enterprise plans do; if this website's traffic or data handling ever calls for that stronger contractual footing, we'll move to a hosting arrangement that includes one.
• Google Analytics (Google Ireland Limited / Google LLC), only if you accept analytics cookies, measures how the site is used. Transfers to the US are covered by the EU–U.S. Data Privacy Framework. We keep IP anonymisation on and don't enable advertising or cross-site tracking features.

Some of the providers above are based in, or transfer data to, the United States. In every case this is covered by Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework, mechanisms the European Commission recognises as adequate safeguards under GDPR Articles 45–46.

Booking enquiries that don't turn into a shoot are kept for up to 12 months after our last exchange, then deleted.

If you become a client, we keep our correspondence and any contractual or invoicing documents for as long as Italian law requires — currently 10 years, for accounting and tax purposes.

Analytics data collected via Google Analytics is retained for up to 14 months, Google's own maximum setting, and only for as long as you haven't withdrawn consent.

This site uses only two kinds of cookies:

• Strictly necessary — a single cookie that remembers your language choice (Italian or English) so you don't have to reselect it on every page. It doesn't require consent, since the site can't work as intended without it.
• Analytics (Google Analytics) — set only if you accept them in the banner: _ga and _ga_* cookies, used to understand site usage. Duration: up to 2 years, or until you withdraw consent.

You can change your choice at any time using the "Cookie settings" link in the footer.

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data (the "right to be forgotten")
• Ask us to restrict, or object to, processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting processing carried out before the withdrawal

To exercise any of these rights, write to nikemilyphotography@gmail.com. If you believe your data hasn't been handled properly, you also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) — garanteprivacy.it.

We may update this policy from time to time — for instance, if we start using a new tool or service. The "last updated" date at the top always reflects the latest version.