Privacy Policy

Last updated: 15 September 2026

1. Data controller

For inquiries, bookings, contracts, client accounts and galleries of the wedding and private photography services booked on this website, the controller is:

Andrii Mitin, self-employed (AM SE), trading as André Mitin Wedding Photo Studio (RCS Luxembourg A44485, VAT LU35107862)
3 Rue Jean Schoetter, L-2523 Luxembourg
Contact: info@weddingphoto.lu

The website itself (hosting, cookies and audience measurement) is operated by its publisher, Lux Photo Pro S.à r.l.-S (RCS B290472, VAT LU36089387), 13 Avenue Gaston Diderich, L-1420 Belair, Luxembourg, info@luxphotopro.com, which is the controller for that website data.

2. What we collect

• Inquiry form / configurator: name, email, phone, wedding date, venue, guest count, budget range, language preference, message text.
• Booking flow: all of the above, plus payment processor identifiers (Stripe Customer ID).
• Technical: IP address, user agent, UTM tracking parameters, referrer URL.
• Cookies: necessary cookies for session and consent storage. We also run our own audience measurement, which sets no cookies and stores nothing on your device: our server counts page views using a code derived from your IP address and browser, salted with a secret that changes every day, so the same visitor cannot be recognised across days and the raw IP address is never stored. This data stays with us and is deleted after 14 months. Google Analytics 4 is loaded on every page in Google Consent Mode: until you accept, it is restricted and sends only cookieless, non-identifying signals that Google uses for aggregate modelling — no cookies are set and nothing is stored on your device. Cookie-based statistics (Google Analytics cookies, Microsoft Clarity, Mouseflow) and marketing cookies (the Meta Pixel and Google Ads) are switched on only after you accept via the cookie banner. You can change your choice at any time via “Cookies” in the footer, and the restricted mode is what applies if you decline.

3. Why we collect it

• To respond to your inquiry and prepare a proposal — legitimate interest, GDPR Art. 6(1)(f).
• To execute the photography services contract — necessary for contract, Art. 6(1)(b).
• To send payment receipts and contract documents — legal obligation, Art. 6(1)(c).
• To analyze website performance — legitimate interest, Art. 6(1)(f).
• To measure site usage and advertising performance. Cookies and any identification require your consent, Art. 6(1)(a) — the Meta Pixel, Google Ads and all cookie-based statistics load only after you accept. Google Analytics also receives cookieless, non-identifying signals before you answer the banner, which we rely on for aggregate audience measurement under our legitimate interest, Art. 6(1)(f); no cookies are set and nothing is stored on your device in that mode.

4. Where we store it

• Supabase (database) — Frankfurt, EU.
• Bitrix24 (CRM) — EU servers.
• Stripe (card payments) — EU-compliant payment processor.
• Resend (transactional email) — US-based but EU SCCs in place.
• Cloudflare (hosting, CDN and our content management system) — Cloudflare Ireland Ltd. / Cloudflare Inc.; connection data (IP address, request headers) is processed to deliver pages and protect the site; EU–US Data Privacy Framework and EU SCCs in place.
• Cloudinary (image CDN) — global, EU instance for our storage.
• Pixieset (client galleries) — Canada/US, contractual data protection.
• Google Analytics (Google Analytics 4, statistics) — Google Ireland Ltd.; cookies and identification only with your consent, cookieless aggregate signals also before it; data may be transferred to the US under the EU–US Data Privacy Framework.
• Meta Pixel (Meta Pixel, marketing — loads only with your consent) — Meta Platforms Ireland Ltd.; data may be transferred to the US under the EU–US Data Privacy Framework.
• Microsoft Clarity · Mouseflow (heatmaps and session replay, statistics — loads only with your consent) — page interaction is recorded with form field contents masked; we never record payment or password fields.

5. How long we keep it

• Inquiry leads without booking: 24 months, then deleted.
• Booking + contract records: 10 years (Luxembourg fiscal law).
• Photo deliverables: kept on our backup until couple requests deletion.
• Marketing email subscribers: until you unsubscribe.

6. Your rights

Under GDPR, you can request:

• Access — copy of all your data we hold.
• Rectification — correction of inaccurate data.
• Erasure ("right to be forgotten") — deletion of your data.
• Portability — your data in machine-readable format.
• Restriction or objection to processing.
• Withdraw consent at any time.

To exercise these rights, email info@weddingphoto.lu. We respond within 30 days.

7. Complaint

You can lodge a complaint with the Luxembourg data protection authority (CNPD): cnpd.public.lu.

8. Changes

We may update this policy. Material changes will be announced via email to active clients.