Privacy policy
Last updated: 09.11.2026
This Privacy Policy explains how:
Gabriela Sitarz (Gabriela Photo)
Organisation number: 931105442
Business address: Nittedalsgata 21, 2000 Lillestrøm
Email: post@gabrielaphoto.no
collects, uses, stores and protects personal data.
In this Privacy Policy, the terms “we”, “us” and “our” refer to Gabriela Photo
We are the controller responsible for the processing of personal data described in this Privacy Policy.
1. Personal Data We Collect
Depending on how you interact with us, we may collect and process the following categories of personal data.
Contact and booking information
This may include:
name;
email address;
telephone number;
information provided when booking a photography session;
selected date and time;
information about the requested photography service;
information about the number of participants;
information provided through our website contact forms;
communications between you and us.
Payment and transaction information
When you purchase a photography service, payment-related information may be processed through the booking and payment services used to complete your purchase.
We may retain transaction information necessary for bookkeeping, accounting and legal obligations.
We do not intentionally collect or store complete payment card details unless such information is provided through a system that is specifically designed and authorised to process payments.
Photography and image data
When we provide photography services, we may process:
photographs of you;
photographs of other participants;
image selections;
information connected with the photography session;
gallery activity related to the selection and delivery of photographs.
Photographs may constitute personal data where an individual can be identified.
Technical and website information
When you visit our website, technical information may be processed through the website platform and strictly necessary technologies required for the operation of the website and its services.
If we introduce additional analytics, advertising or tracking technologies in the future, we will update this Privacy Policy and provide any consent mechanisms required by applicable law.
2. Why We Process Personal Data
We process personal data for the following purposes:
To respond to enquiries
If you contact us through our website, email or another communication channel, we process relevant information in order to respond to your enquiry.
To manage bookings
We process information necessary to:
manage photography bookings;
confirm appointments;
communicate with clients;
organise photography sessions;
manage changes and cancellations.
To perform our photography services
We process information and photographs where necessary to:
perform the agreed photography session;
provide image galleries;
enable image selection;
edit photographs;
deliver final digital files.
To process payments and maintain accounting records
We process relevant transaction and business information where necessary to:
receive and record payments;
maintain accounting records;
comply with applicable legal obligations.
To protect our business and resolve disputes
We may process relevant information where necessary to:
prevent fraud;
protect our legal rights;
handle complaints;
respond to legal claims;
resolve disputes.
3. Legal Bases for Processing
We process personal data on one or more of the following legal bases.
Performance of a contract
We process personal data where it is necessary to enter into or perform a contract with you.
This may include:
processing bookings;
communicating about your session;
carrying out photography services;
providing galleries;
delivering photographs.
Legal obligations
We process certain information where this is necessary to comply with legal obligations, including accounting and bookkeeping requirements.
Legitimate interests
In certain situations, we may process personal data where this is necessary for our legitimate interests, provided that those interests are not overridden by your rights and freedoms.
This may include:
maintaining business records;
protecting our services;
handling complaints and disputes;
improving administrative processes;
protecting our legal rights.
Consent
Where consent is required, we will ask for your consent separately.
For example, where required by law, consent may be requested for certain public or marketing uses of identifiable photographs or for certain cookies and tracking technologies.
You may withdraw consent at any time.
Withdrawal of consent does not affect processing that took place before the consent was withdrawn.
4. Photography and Images
Photographs may contain identifiable personal information.
We process photographs where necessary to perform the photography service requested by the Client.
The Photographer does not require Clients to agree to the public or marketing use of their photographs in order to purchase photography services.
If we wish to use photographs for purposes such as:
portfolio display;
our website;
social media;
advertising;
printed promotional materials;
we will seek any consent or other authorisation required by applicable law separately from the booking agreement.
5. Children and Minors
We may photograph children and other individuals under the age of 18 as part of family or other photography sessions.
The Client responsible for the booking must ensure that participation by a minor has been authorised by a parent or legal guardian where required.
Any public or marketing use of photographs of a minor will be handled separately and in accordance with applicable law.
6. How Long We Store Personal Data
We do not use one identical storage period for all personal data.
Different categories of data may be retained for different periods depending on the purpose and applicable legal obligations.
Booking and communication information
Booking and client communication information is retained for as long as reasonably necessary to manage the client relationship, resolve questions or disputes and maintain relevant business records.
Accounting information
Accounting and transaction information is retained for the period required by applicable Norwegian accounting and bookkeeping legislation.
Photography files
We may retain original, working and final photography files after delivery.
We currently intend to retain photography files without a fixed deletion date in order to maintain archives, recover files where technically possible and support previous clients.
However, we do not guarantee permanent or unlimited storage of any photography files.
Clients are responsible for downloading and maintaining their own backup copies of delivered images.
We may delete or lose access to files because of technical failure, changes in storage systems, business changes, legal obligations or other circumstances.
Private online galleries
Online galleries are normally available for a minimum of three months unless otherwise stated.
After a gallery expires, access may be removed.
Consent records
Where processing is based on consent, we may retain records of that consent and related communications for as long as necessary to document compliance and manage the consent.
7. Service Providers and Recipients
We use external service providers to operate our business.
Depending on the service used, personal data may be processed by the following categories of providers.
Squarespace
We use Squarespace to operate and host our website and website forms.
Information submitted through our website may be processed through Squarespace.
Setmore
We use Setmore for online booking and appointment management.
Booking information and payment-related information required to manage bookings may be processed through Setmore and relevant payment services connected to Setmore.
Fiken
We use Fiken for accounting and bookkeeping.
Relevant client and transaction information may be processed for accounting purposes.
ShootProof
We use ShootProof to provide private online galleries and to allow clients to view, select and receive photographs.
Information relating to gallery access, image selections and delivery may be processed through ShootProof.
Adobe Lightroom and Adobe services
We use Adobe Lightroom for photography workflow and editing.
Depending on the features and synchronisation services used, photographs and related information may be processed through Adobe services and cloud infrastructure.
Local storage
Photography files and relevant business information may also be stored on local storage devices controlled by us.
8. International Transfers
Some of the service providers we use may process personal data outside Norway or the European Economic Area (EEA).
Where personal data is transferred internationally, the relevant service provider may use legally recognised transfer mechanisms and safeguards required under applicable data protection law.
For further information about international processing connected with a particular service provider, you may contact us.
9. Sharing Personal Data
We do not sell your personal data.
We may share relevant personal data where necessary with:
service providers who help us operate our website, booking system, accounting system, photography workflow or galleries;
professional advisers where necessary;
public authorities where required by law;
other parties where necessary to establish, exercise or defend legal claims.
We only share information where there is a relevant legal basis for doing so.
10. Cookies and Similar Technologies
Our website may use cookies and similar technologies that are necessary for the operation and functionality of the website.
If we use optional analytics, advertising or tracking technologies that require consent under applicable law, we will request consent before activating them where required.
We do not currently use Meta Pixel, Google Analytics, Google Ads tracking tags or similar advertising or analytics tracking technologies.
If such technologies are introduced in the future, this Privacy Policy and the relevant cookie settings will be updated accordingly.
11. Your Rights
Depending on the circumstances and applicable law, you may have the right to:
request access to your personal data;
request correction of inaccurate information;
request deletion of personal data;
request restriction of processing;
object to certain processing;
request data portability;
withdraw consent where processing is based on consent;
lodge a complaint with the relevant data protection authority.
To exercise your rights, please contact us at:
post@gabrielaphoto.no
We may need to verify your identity before responding to certain requests.
Your rights are not absolute and may be limited where applicable law allows or requires us to retain or continue processing certain information.
12. Right to Complain
If you believe that your personal data has been processed in a way that violates applicable data protection law, you have the right to contact us.
You may also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
13. Data Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration.
However, no system can guarantee absolute security.
You should also take reasonable steps to protect your own devices, accounts and downloaded photography files.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
The latest version will be published on our website.
Where changes materially affect how we process personal data, we will provide additional notice where required by applicable law.
15. Contact
If you have questions about this Privacy Policy or how we process personal data, please contact:
Gabriela Sitarz (Gabriela Photo)
Organisation number: 931105442
Business address: Nittedalsgata 21, 2000 Lillestrøm
Email: post@gabrielaphoto.no