CHRISFA PHOTOGRAPHY

Effective Date: October 01, 2026

Chrisfa Photography is committed to safeguarding your privacy and ensuring the security of your personal data. All personal data is collected and processed strictly in accordance with applicable data protection regulations, notably Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act (Loi Informatique et Libertés).

1. Who is responsible for processing your personal data (Data Controller)?

The Data Controller is:

• Chrisfa Photography
• Contact: Data Protection Officer
• Email: rgpd@chrisfa-photography.fr

2. Which personal data do we process?

We may collect and process the following personal data:

• Contact Details: Full name, email address, telephone number.
• Booking & Event Details: Event date, event location, type of session (e.g., Wedding, Birthday, Baptism, Corporate), and specific scheduling requests.
• Visual Media: Photographs and video recordings captured during contracted assignments.
• Billing Information: Billing address and payment transaction history (excluding sensitive banking or card numbers, which are processed through secure external payment channels).

3. Why do we process your data?

Your personal data is processed for the following purposes:

• To process booking requests, inquiries, and customer consultations.
• To carry out contracted photography services, post-production retouching, and physical media fulfillment (USB drive and print packages).
• To comply with French accounting, tax, and legal record-keeping obligations.
• To feature selected imagery in our portfolio, website, or social media showcases (strictly subject to prior image-rights consent/model release).

4. Who has access to your data?

Access to personal data is restricted to authorized team members and technical staff on a strict need-to-know basis:

• Photographers and studio management team members handling your assignment.
• IT and web administration providers maintaining website infrastructure and security.
• Trusted professional print labs and courier services strictly for fulfillment of your print orders.

We do not sell, rent, or trade your data to third parties. All external service providers are bound by strict contractual data protection agreements.

5. How long do we retain your data?

• Inquiry & Communication Data: Kept for 3 years from the date of collection or last contact.
• Client Accounting & Contractual Files: Retained for 10 years in compliance with French commercial and accounting laws.
• Photographic Media (RAW & Retouched Files): Archived securely for a minimum of 2 years post-delivery to allow backup or replacement requests, after which files may be deleted or archived permanently depending on contractual terms.

6. What are your rights concerning your personal data?

Under the GDPR, you have the following rights:  

• Right of Access: Request a copy of your personal data.
• Right to Rectification: Request corrections to inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): Request the deletion of your personal data (“right to be forgotten”), subject to statutory record retention rules.
• Right to Restriction / Objection: Request limits on how your data is handled.
• Right to Data Portability: Receive your data in a structured, commonly used format.
• Right to Withdraw Consent: Where processing is based on consent (such as portfolio publication), you may withdraw it at any time without affecting past lawful processing.

To exercise any of these rights, contact: rgpd@chrisfa-photography.fr.  

7. Who can you contact in case of a complaint?

If you have concerns regarding our processing of your personal data:

• Contact our Data Protection Officer directly at rgpd@chrisfa-photography.fr
• You also have the right to lodge a complaint with the French Data Protection Authority (CNIL): Commission Nationale de l’Informatique et des Libertés, https://www.cnil.fr.

8. What is the legal basis for processing?

The processing of your data relies on:

• Article 6(1)(b) GDPR: Necessary for the performance of a service contract or pre-contractual steps requested by you.
• Article 6(1)(c) GDPR: Compliance with legal and statutory obligations (invoicing, taxation).
• Article 6(1)(a) GDPR: Based on your explicit consent (e.g., contact submissions, marketing, or public portfolio displays).