Privacy Policy

1. Who we are

Foutzis Photoart (“we”, “us”, “our”) is a photography and cinematography business operating in Limassol and across Cyprus, trading as FoutzisPhotoart https://foutzisphotoart.com.

We are the data controller for the personal data described in this policy.

Contact for privacy matters:
Email: [email protected]
Phone: +357 96398921

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR.

2. Scope

This policy explains how we collect, use, share and protect personal data when you:

• visit foutzisphotoart.com;
• submit an enquiry through our contact form, email, phone or WhatsApp;
• subscribe to our newsletter;
• engage us for photography or cinematography services;
• access a private client gallery;
• apply for a position through our Careers page;
• appear in photographs or video we capture at an event we cover;
• interact with our profiles on Facebook, Instagram or WhatsApp.

It does not apply to third-party websites or platforms we link to, which operate under their own privacy policies.

3. What we collect and why

3.1 Website visitors

Technical data collected automatically: IP address (truncated where our analytics configuration allows), browser type and version, device type, operating system, referring URL, pages viewed, time on page, approximate location derived from IP, and cookie or similar identifiers. Used to operate the site, keep it secure, and — where you consent — to measure audience and improve content.

Legal basis: legitimate interests (site operation and security); consent (analytics and marketing cookies).

3.2 Enquiries and bookings

Name, email address, phone number, event type, event date, venue or location, budget range, and anything else you choose to include in your message. Where you proceed to a booking, we also collect billing details, contract details, and event logistics (schedule, key persons, venue contacts, shot-list requests).

Legal basis: steps taken at your request prior to entering a contract, and performance of that contract (Art. 6(1)(b)); legal obligation for invoicing, tax and accounting records (Art. 6(1)(c)).

3.3 Newsletter

Email address and, optionally, your name. Used only to send occasional updates, stories and offers. Every message includes an unsubscribe link.

Legal basis: consent (Art. 6(1)(a)), withdrawable at any time.

3.4 Client galleries

Delivered images and video, gallery access credentials, download and view activity, and any selections or favourites you mark. Galleries are private and access-controlled.

Legal basis: performance of contract.

3.5 Careers applicants

Name, contact details, CV or portfolio, work history, right-to-work information and anything else you submit. Used solely to assess your application.

Legal basis: steps prior to entering a contract; legitimate interests in staffing our team. Where we retain your details for future openings, consent.

3.6 Photographic and video subjects

Photographs and video footage of identifiable individuals are personal data. Where we photograph an event, we process images of the commissioning client, their guests and other attendees.

Legal basis: performance of our contract with the commissioning client (for capture, editing and delivery); for guests and other attendees, our legitimate interests and those of the client in documenting the event — balanced against the reasonable expectations of people attending a photographed occasion. For publication in our portfolio, website, social media or advertising, see section 4.

4. Publishing your images

We do not publish images of an event in our portfolio, on this website, on social media or in any advertising without a separate, documented permission from the commissioning client, given in the service agreement or by explicit written consent. That permission is optional. Declining it does not affect the service you receive or its price.

You may withdraw consent to publication at any time by contacting us. On withdrawal we will remove the images from our website and our own social media channels and stop using them in new materials. Content already distributed by third parties, re-shared by other users, cached by search engines, or included in printed material already produced may not be fully recoverable, and we will tell you plainly where that is the case.

If you appear in an image on this site and did not consent to it — for example as a guest at an event we covered — email us at [email protected] with enough detail to identify the image. We will remove it promptly.

4.1 Children

Our school, christening and family work involves photographing minors. We photograph and publish images of a child only with the documented consent of a parent or legal guardian (and, for school work, under our agreement with the school, which is responsible for obtaining parental permissions). We never publish a child’s full name, school, or other identifying details alongside an image, and we do not use images of children in paid advertising. A parent or guardian may withdraw consent at any time.

4.2 Special category data

Photographs taken at religious ceremonies such as christenings and church weddings may reveal religious belief, and images may reveal ethnic origin or health-related characteristics. This is special category data under Article 9 GDPR. Where we process it, we rely on your explicit consent (Art. 9(2)(a)), or on the fact that you have manifestly made such data public (Art. 9(2)(e)) where that applies. We do not deliberately seek out or catalogue this information, and we do not use it for profiling or targeting.

5. Cookies and tracking

This site uses cookies and similar technologies. Some are strictly necessary for the site to function and to keep it secure; these are set without consent, as permitted under Cyprus Law 112(I)/2004 and the ePrivacy Directive. All others — including analytics, advertising and social media cookies — are set only after you give consent through our cookie banner.

We use Google Tag Manager to deploy tags on this site. Depending on your choices, those tags may include:

• Google Analytics — audience measurement and site performance.
• Meta (Facebook/Instagram) tools — measurement and advertising, where enabled.
• Cloudflare — security, bot mitigation and content delivery (strictly necessary).
• Embedded content — Instagram feeds, video players and maps, which may set their own cookies.

You can change or withdraw your cookie choices at any time by clearing cookies in your browser. Blocking non-essential cookies does not affect access to the site.

6. Who we share data with

We do not sell personal data. We share it only with service providers who process it on our instructions under a written data processing agreement, and with parties we are legally required to disclose it to.

We may also disclose data where required by law, court order, or a lawful request from a competent authority, or where necessary to establish, exercise or defend legal claims.

7. International transfers

Some providers listed above process data outside the European Economic Area, principally in the United States. Where that happens, transfers are protected by the European Commission’s Standard Contractual Clauses, by the provider’s certification under the EU–US Data Privacy Framework, or by another lawful transfer mechanism under Chapter V GDPR. You may request details of the safeguards applied by contacting us.

8. How long we keep data

When a retention period ends, we delete the data or irreversibly anonymise it.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access controls and multi-factor authentication on administrative accounts, password-protected client galleries, encrypted storage of master files, regular backups, and prompt patching of the website and its components. No system is perfectly secure, but in the event of a personal data breach likely to result in a risk to your rights, we will notify the Office of the Commissioner for Personal Data Protection within 72 hours and, where the risk is high, notify you directly.

10. Your rights

Under the GDPR and Cyprus Law 125(I)/2018 you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted where no overriding ground for keeping it applies.
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive data you provided to us in a structured, machine-readable format.
• Object — object to processing based on legitimate interests, and to direct marketing at any time, absolutely.
• Withdraw consent — at any time, without affecting processing carried out before withdrawal.
• Complain — to a supervisory authority.

To exercise any of these rights, email [[email protected]]. We respond within one month, extendable by two further months for complex requests, and will tell you if an extension applies. We may ask for information to verify your identity. There is no charge unless a request is manifestly unfounded or excessive.

Note that we may need to retain certain data despite an erasure request — for example invoices required by tax law, or records needed to defend a legal claim. We will explain the basis in our response.

Supervisory authority

Office of the Commissioner for Personal Data Protection
15 Kypranoros Street, 1061 Nicosia, Cyprus
P.O. Box 23378, 1682 Nicosia
Tel: +357 22818456
Email: [email protected]
Web: www.dataprotection.gov.cy

We would appreciate the chance to address your concern first, but you may complain to the Commissioner at any time.

11. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

12. Children’s data on this website

This website is not directed at children and we do not knowingly collect personal data from anyone under 16 through it. If you believe a child has provided us data through this site, contact us and we will delete it. Section 4.1 covers images of children captured in the course of our photography work.

13. External links and social platforms

This site links to Facebook, Instagram and WhatsApp, and may embed content from third parties. Once you leave this site or interact with embedded content, the receiving platform’s own privacy policy governs. For our Facebook and Instagram pages, Meta and we act as joint controllers for page insights; Meta’s terms for that arrangement apply alongside this policy.

14. Changes to this policy

We may update this policy to reflect changes in our services, technology or the law. The version and date at the top of the page indicate the current release. Material changes affecting how we use your data will be notified by email where we hold your address, or by a prominent notice on this site.

15. Contact

Questions, requests or complaints about this policy or our handling of your data:
Email: [email protected]
Phone: +357 96398921