Data Controller
Tostaco Photography is the data controller responsible for your personal data.
What We Collect
We only collect personal data you actively provide — nothing is collected silently without a reason. This includes:
- Your name and email address when you use the contact form or subscribe to the newsletter.
- The message content you submit via the contact form.
- Basic analytics data (page views, approximate location) if you consent to analytics cookies.
We do not collect sensitive personal data, payment details, or any data from children under 18.
Why We Use It
Your data is used only for the purpose it was provided:
- To reply to your enquiry or booking request.
- To send the newsletter if you subscribed (you can unsubscribe at any time).
- To understand how visitors use the website and improve it.
- To comply with legal obligations where required.
Legal Basis
Under the GDPR we process your data on one or more of the following grounds:
- Consent — for newsletter subscriptions and analytics cookies.
- Legitimate interest — for responding to contact form submissions.
- Legal obligation — where required by applicable law.
Security
We use HTTPS encryption on all pages, store no personal data on our own servers beyond what is strictly necessary, and keep third-party access limited to the minimum required to deliver the service. No transmission over the internet is 100% secure, but we take reasonable precautions.
Your Rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Erase your data (the right to be forgotten).
- Restrict or object to how we process your data.
- Portability — receive your data in a machine-readable format.
- Withdraw consent at any time without affecting prior processing.
To exercise any of these rights, email contact@tostaco.cc. We will respond within 30 days.
Changes to This Policy
If we make material changes we will update the effective date at the top of this page. Continued use of the website after changes are posted constitutes acceptance of the revised policy.
Questions?
If anything here is unclear or you want to exercise your rights, just email us.