Privacy Policy

1. Introduction

Beate Marie Photography takes your privacy seriously. This policy explains how I collect, use and protect your personal data. Beate Marie Photography is the data controller.

2. What data do I collect?

2.1 Personal data

• Name and contact details, including email address, telephone number if provided, and address
• Billing and delivery address
• Order details, selected artwork, price and delivery information
• Payment status and Stripe reference; I do not receive full payment-card details
• Technical security and server-log data, including IP address
• Aggregated conversion events: clicks to discuss an artwork, contact-form starts and successful submissions, optionally with an artwork number and source path
• Anonymous website statistics: visited page, temporary session code, country, broad device type, browser family, referring domain, campaign labels and active viewing time

2.2 Local storage and cookies

• Local browser storage to remember your language preference
• A strictly necessary, secure session cookie for the protected administration area

The public website does not use Google Analytics, advertising pixels or marketing cookies. The temporary session code is not stored in cookies or local browser storage. IP addresses, full referring URLs, names, email addresses and message content are not stored in the analytics table.

3. Purposes and legal bases

• Order, payment, production and delivery: performance of a contract
• Responding to your enquiry: contract or legitimate interests
• Accounting and tax records: legal obligation
• Newsletter: your consent, which you may withdraw at any time
• Fraud prevention and website security: legitimate interests
• Improving pages and reach using limited, anonymous website statistics: legitimate interests

4. Sharing personal data

• Stripe: payment processing
• Carriers and production partners: production and delivery
• Vercel and Neon: hosting, security and database storage
• Resend: transactional email and contact messages
• OpenRouter: protected internal classification and draft replies for received email only; there is no public curator chatbot

I never sell your personal data. Where data is processed outside the European Economic Area, appropriate transfer mechanisms and contractual safeguards are used.

5. Your rights under the GDPR

• Access to your personal data
• Correction of your data
• Erasure, also known as the right to be forgotten
• Objection to processing
• Restriction of processing
• Data portability
• Withdrawal of consent without affecting earlier lawful processing

Contact me at info@beatemariephotography.art.

6. Retention periods

Order and invoice data are retained for as long as tax law requires, generally seven years. Enquiries are generally deleted no later than two years after they are resolved, unless they relate to an order or dispute. Newsletter data are retained until you unsubscribe. Security logs are kept no longer than necessary for security and troubleshooting. Raw anonymous website statistics are retained for a maximum of thirteen months.

7. Security

I use appropriate technical and organisational measures to protect your personal data, including encrypted connections, restricted administrative access, signed webhooks and not storing full payment-card details.

8. Children

This website is not intended for children under 16.

9. Complaints to the supervisory authority

You may lodge a privacy complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). I would appreciate the opportunity to address your concern first, so that I can respond as quickly as possible.

10. Contact