PRIVACY POLICY

Eugenie Smirnova Photography

Last updated: April 12, 2026

This is a courtesy English translation of the French Politique de confidentialité. In the event of any discrepancy, the French version shall prevail.

PODBELTSEVA Evgeniia (hereinafter « the Photographer »), operating under the trade name Eugenie Smirnova Photography, is committed to protecting the privacy of individuals whose personal data is collected and processed in the course of professional photography services.

This privacy policy aims to inform data subjects in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR) No. 2016/679.

1. Data Controller

Name: PODBELTSEVA Evgeniia

Trade name: Eugenie Smirnova Photography

Status: Micro-entrepreneur (France)

SIRET: 844 175 240 00010

Address: 8 Place Roger Salengro, 31000 Toulouse, France

Email: ezhphotos@gmail.com

Phone: +33 6 69 72 84 90

Website: ezh.photos

2. Personal Data Collected

In the course of business, the Photographer collects and processes the following categories of personal data:

• Identification data: name, postal address, email address, phone number

• Event data: date, location, type of service

• Financial data: banking details (via Stripe), payment history

• Images: photographs of identifiable persons (clients, guests, participants)

• Browsing data: the website ezh.photos (hosted by Wfolio) uses cookies for analytics and site functionality. A cookie consent banner is displayed upon first visit. You may accept or refuse non-essential cookies. No third-party advertising trackers are used.

Providing your identification and contact data is a contractual requirement necessary to perform the photography service. Failure to provide this data will make it impossible to conclude and execute the contract.

3. Purposes and Legal Bases

Performance of the photography service contract

Contract (Art. 6.1.b GDPR)

Quotes and invoicing

Contract + Legal obligation (Art. 6.1.b and 6.1.c)

Client communication (follow-up, delivery)

Contract (Art. 6.1.b)

Publication of photographs in portfolio / social media

Consent (Art. 6.1.a) — via image rights authorization

Accounting and tax obligations

Legal obligation (Art. 6.1.c)

Service improvement and commercial prospecting

Legitimate interest (Art. 6.1.f)

Regarding legitimate interest: the Photographer has a legitimate interest in improving services and informing existing clients of relevant offers, balanced against data subjects' rights. You may object at any time (see Section 6).

4. Data Recipients

Personal data may be shared with the following sub-processors, strictly for the purposes described above:

Stripe — Online payments — USA (EU-US Data Privacy Framework)

Wfolio — Website hosting and online gallery — Hong Kong / EU servers (SCCs)

Google Workspace — Email, document storage, calendar — USA (EU-US Data Privacy Framework)

Amazon Photos — Photo archiving — USA (EU-US Data Privacy Framework)

Notion — Internal management (CRM) — USA (EU-US Data Privacy Framework)

No data is sold to third parties. Transfers outside the EU are governed by the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs) approved by the European Commission.

5. Retention Periods

Contracts and contractual documents — 6 years

Contractual obligation + prescription civile (art. 2224 Code civil)

Photographs (client galleries) — 6 years

Contractual obligation (delivery + support period)

Contact data (email, phone, address) — 6 years

Aligned with contract retention period

Invoices and accounting documents — 10 years

Legal obligation (CGI, décret du 7 décembre 2012)

Portfolio photographs — Until consent is withdrawn

Consent (Art. 6.1.a GDPR)

Browsing data (cookies, analytics) — 13 months

CNIL recommendation

After these periods, data is deleted or irreversibly anonymized.

6. Data Subject Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15): obtain confirmation of processing and receive a copy of your data

• Right to rectification (Art. 16): correct inaccurate or incomplete data

• Right to erasure (Art. 17): request deletion of your data, subject to legal retention obligations

• Right to data portability (Art. 20): receive your data in a structured format

• Right to object (Art. 21): object to processing based on legitimate interest

• Right to restriction of processing (Art. 18)

• Right to withdraw consent at any time (Art. 7.3) for consent-based processing

To exercise your rights, send your request by email to: ezhphotos@gmail.com

The Photographer undertakes to respond within one month of receiving the request.

7. Complaint to the CNIL

If you believe that the processing of your data does not comply with applicable regulations, you may file a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL):

• Online: www.cnil.fr

• By post: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

8. Data Security

The Photographer implements appropriate technical and organizational measures to ensure the security of personal data, including:

• Storage on secure platforms with encryption

• Access limited to authorized persons only

• Regular backups on redundant storage

• Two-factor authentication on critical accounts

9. Automated Decision-Making

The Photographer does not use automated decision-making or profiling as defined in Article 22 of the GDPR.

10. Changes to This Policy

This policy may be updated at any time. The last update date is indicated at the top of the document. In case of substantial changes, clients will be notified by email.