1. Data Controller

The entity responsible for processing personal data collected through this website is:

• Business Name / Controller: Miguel Almas Photography (Miguel Almas)
• Location: Lisbon, Portugal (based in Lisbon, available throughout Portugal)
• Contact Email: miguel.almas@miguelalmasphotography.pt
• Website: https://www.miguelalmasphotography.pt



For any questions regarding personal data protection or to exercise your legal rights, please contact us at the email provided above.

2. Personal Data Collected and Purposes of Processing

We collect and process personal data only when directly provided by you, to the extent strictly necessary to deliver our photography services, respond to inquiries, and manage business relationships.

A. Contact Forms and Quote Inquiries

• Data collected: Full name, email address, phone number (optional), session details (family, dance, or celebration), and a personalized message.
• Purpose: Responding to price inquiries, answering questions, scheduling photography sessions, and managing pre-contractual requests.
• Legal Basis: Performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) of the GDPR).

B. Invoicing and Service Performance

Upon booking a photography session, we collect:

• Data collected: Full name, Tax Identification Number (NIF), and billing address.
• Purpose: Contract execution, final digital gallery delivery, and issuing tax invoices.
• Legal Basis: Performance of a contract and compliance with legal and tax obligations (Article 6(1)(b) and (c) of the GDPR).

C. Image Capture and Usage (Right to Image)

• Data collected: Photographs and video footage captured during sessions, rehearsals, or performances.
• Purpose: Contracted work delivery and display in our digital portfolio, website, or social media. Display is conducted exclusively based on prior, explicit, and informed consent signed by the client (or legal guardians in the case of minors).
• Legal Basis: Data subject consent (Article 6(1)(a) of the GDPR).

3. Data Retention Period

Personal data collected will be retained only for as long as strictly necessary to fulfill the purposes for which it was gathered:

• Inquiry and quote data: Retained for a maximum period of 12 months if a booking is not finalized.
• Tax and billing records: Retained for the statutory period of 10 years required by Portuguese tax law.
• Digital photo archives: Maintained in archives for delivery and backups agreed upon with the client, or until erasure is requested.

4. Data Sharing with Third Parties

Miguel Almas Photography does not sell, rent, or trade your personal data to third parties for commercial or advertising purposes. Data is shared strictly with essential service providers acting as sub-processors:

• Pixieset Media Inc.: Website hosting and digital gallery management.
• Zoho Corporation: Professional email hosting.
• Google Ireland Limited (Google Analytics 4): Anonymous traffic statistics.
• Tax and Customs Authority (Autoridade Tributária e Aduaneira): Invoice issuance and statutory compliance.

5. Cookies Policy & Anonymous Tracking

This website implements a Privacy-by-Design architecture.

A. No Personal Tracking Cookies

Our website does not use persistent user-tracking cookies, advertising pixels, or cross-site profiling identifiers (such as the traditional _ga cookie). We do not conduct retargeting or share data with ad networks.

B. Strictly Necessary Cookies (System & Security)

We exclusively use strictly necessary technical cookies issued by our hosting infrastructure (Pixieset and Cloudflare) with cf_ or __cf_bm prefixes. These serve solely to:

• Ensure website security against cyber threats and malicious bot traffic.
• Guarantee proper visual loading of high-resolution photo galleries and session stability.

These cookies are exempt from prior consent under applicable laws as they are essential for service delivery.

C. Anonymous Analytics (Google Analytics 4 in Cookieless Mode)

We measure website performance using Google Analytics 4 (GA4) configured in Cookieless / Advanced Consent Mode:

• No Persistent Identifiers: No tracking cookies are written to your browser.
• IP Masking & Privacy Controls: IP addresses are masked, and granular device and city-level location tracking are disabled.
• Aggregated Metrics: Analytics reports display only anonymous, high-level traffic patterns (e.g., total page views, browser types, country of origin) without identifying individual users.

6. Rights of the Data Subject

Under the GDPR, as a data subject, you have the right to exercise the following rights at any time:

• Right of Access and Rectification: Request access to your data or correct inaccurate information.
• Right to Erasure: Request the deletion of your personal data, provided there are no legal retention duties.
• Right to Restriction and Objection: Request data processing suspension or object to data handling.
• Right to Withdraw Consent: Revoke consent previously granted for image usage at any time.

To exercise any of these rights, please send a written request to:

• 📧 miguel.almas@miguelalmasphotography.pt

You also have the right to lodge a complaint with the national supervisory authority in Portugal:

• Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt

7. Information Security

We implement technical and organizational security measures (SSL/HTTPS encryption, two-factor authentication, and secure network protocols) to guarantee the confidentiality and integrity of your personal data against unauthorized access, loss, or alteration.

8. Updates to this Policy

Miguel Almas Photography reserves the right to update this Privacy and Cookies Policy at any time. Any changes will be published on this page with an updated revision date.