Privacy policy

01Who is responsible for your data

The controller of your personal data is Tsvetan Georgiev, Sofia, Bulgaria, working under the brand CECICAPTURE. CECICAPTURE is a photography brand and trading name, not a separate legal entity.

Personal data and privacy: legal@cecicapture.com. Everything else: hello@cecicapture.com, +359 885 402 242.

02What personal data I process

It depends on how you are in touch with me. It may include:

• your name, email address, phone number or WhatsApp;
• what you send through the enquiry form – the kind of wedding, session or project, date, place, number of guests, how you found me and your message. I also record the page it was sent from and the site you came from (the domain only);
• for a gift card order – your name, email and (optionally) phone, the recipient’s name as it should read on the card and their email if the card goes straight to them, the message and the photograph, if you upload your own;
• for a call before booking – the name, email and time you chose;
• contract, payment, invoice and accounting details;
• a delivery address when you order prints, albums or other products;
• photographs, video and aerial images in which people can be recognised – including guests and others who are not party to the contract;
• publication consents, model releases and the consent of a parent or guardian;
• client-gallery data – the access email, favourites and selections, downloads and orders;
• technical data when you use the site or a gallery – IP address, browser and device, security logs.

For guests and others who are not party to the contract, the data may have been created by photographing the event or provided by the main client, the organiser or another participant – a name on the list of people to photograph, for example.

I do not buy lists of personal data and I do not sell personal data.

Providing data is voluntary. Without a name and email, however, I cannot reply to an enquiry, and without the details a contract and invoice require, I cannot enter into or perform it.

03Why, and on what legal basis

The legal bases are those of the General Data Protection Regulation (GDPR):

• Enquiries, proposals and calls – to reply to you and take steps at your request before a contract (Art. 6(1)(b)).
• The photography service – planning, photographing, editing, storing, delivering and the client gallery: performance of the contract (Art. 6(1)(b)).
• Gift cards – the order, the payment, making and sending the card: performance of the contract (Art. 6(1)(b)). The recipient’s email is used only to send them the card.
• Payments, invoices and accounting – the contract and a legal obligation (Art. 6(1)(b) and (c)).
• Archive and backups – recovering files, re-delivery, proof of authorship, protecting copyright and defending legal claims: legitimate interest (Art. 6(1)(f)).
• Publishing photographs from commissioned work – in a portfolio, on this site, on social media or elsewhere: your consent (Art. 6(1)(a)), given separately in the contract or a release.
• Photographs in public places – documentary, travel, street and landscape work: depending on the context and purpose, legitimate interest (Art. 6(1)(f)) and the applicable rules on freedom of expression, information and artistic expression.
• Site statistics and advertising measurement, where switched on – your consent in the banner (Art. 6(1)(a)).
• Face search – explicit consent (Art. 9(2)(a)) where the law requires it.
• Legal compliance – where processing is required by law (Art. 6(1)(c)).

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before it.

04Software and AI-assisted tools

I work with professional cameras, computers, storage systems and software for editing and organising photographs. Some of them include artificial-intelligence and machine-learning functions – culling, focus and quality assessment, object and face recognition, grouping and search, masking, noise reduction, retouching and workflow automation.

Some of these functions run entirely on the device – in the camera or on my computer. Others use a cloud service where the specific function requires it. Using such a tool does not mean that the photographs are automatically sent to its maker.

Examples are Adobe Lightroom and Photoshop, Sony’s camera software, the gallery platform and tools of my own. The list changes as the work develops.

I make no automated decisions with legal or similarly significant effects on you, and I do no profiling.

I do not give clients’ photographs to public AI services to train their models. If I begin to use client photographs to train a model, I will update this policy first and ask for permission where it is required.

Photographs from boudoir and intimate sessions, and photographs whose main subject is a child, are not used to train models – including my own – without a separate, explicit permission.

05Face recognition and gallery search

Some editing software and some gallery platforms can detect and group faces, and let guests find the frames they appear in by taking a selfie. This creates a mathematical description of facial features. Where the law treats this as biometric data, it is processed only on an appropriate legal basis and after you have been given the necessary information and choice.

• these functions serve only the work on the photographs, their organisation and helping you find your frames;
• in a client gallery, face search is switched on only when it has been requested and the requirements for information, a legal basis and – where needed – individual consent are met;
• using selfie search is voluntary for every gallery visitor;
• where the settings of the gallery allow it, there is also a way to browse it without selfie search;
• it is never switched on in boudoir or intimate galleries, or in galleries whose main subject is children or newborns;
• if you do not want your face included in search or grouping, write to legal@cecicapture.com.

06Children, newborns and intimate photographs

Photographs of children, newborns, nudity, boudoir and other particularly private moments are handled with additional care.

• they may be published only with a separate written consent – of a parent or guardian for children, of the person themselves for boudoir – that says where;
• boudoir and intimate galleries are private;
• such photographs are not passed to third parties unless an order you requested or approved needs it – a print or an album, for example – and then only the frames required are sent.

The other conditions for children, boudoir and publication are in the Terms, the contract and the relevant consent form.

07Client galleries

The photographs are delivered in a private online gallery. Depending on its settings, access may use a private link, a password, email verification or a download PIN. In the gallery you can mark favourites, download, order prints and albums and – where it is switched on – search by face. Access details and activity in the gallery are processed as far as needed for the service to work.

Galleries stay active for at least one year after publication, unless the contract sets another period. This is separate from the archive I keep (see “How long I keep data”).

08Who receives your data

The work relies on a small number of professional providers. Each receives only the data its role requires:

• hosting, email and the technical running of the site;
• a client-gallery platform – delivery, orders and the gallery’s features;
• software for editing and organising photographs;
• calendar and communication – booking calls, email, video calls and messages;
• cloud storage and backups;
• an accountant and professional advisers – for accounting, tax and legal matters;
• print and album labs – only when a physical product is ordered;
• couriers – to deliver the products ordered;
• a second photographer, videographer or other collaborator – when they are part of the booked service.

Who fills these roles today (as of 9 October 2026):

• Hostinger – website hosting, the database of enquiries and gift card orders, and email.
• Pic-Time – the client galleries at gallery.cecicapture.com: delivery, downloads, print and album orders, and face search where it is switched on.
• Cal.com – the call calendar. It loads only when you press “Choose a time” after an enquiry or on the “Book a call” page.
• Google – Gmail, Google Drive, Google Calendar and Google Meet: correspondence, files, schedule and video calls.
• Adobe – Lightroom and Photoshop: editing and organising the photographs, including face grouping where it is switched on.
• WhatsApp (Meta) – only if you choose to write or talk to me there.
• Stripe (Stripe Payments Europe, Ltd., Ireland) – card payments for gift cards. You enter your card details directly with Stripe; I receive only the name, the email, the amount and whether the payment went through. For its own legal obligations – preventing fraud, for example – Stripe also processes the data as an independent controller, under its own privacy policy.
• An accountant – for invoices and accounting records.
• A print and album lab – chosen for the specific order; it receives only the files needed and the delivery address.

The list reflects the main providers as of its date and is updated when there is a significant change.

09Prints, albums and production

When a photograph is sent for printing or an album, it leaves my technical environment and is handled by the chosen lab. I send only the files and delivery details the order needs.

For intimate, boudoir and other sensitive photographs I choose the transfer method with more care – where possible through the lab’s own upload system rather than as an email attachment – and send only the frames being printed.

No transfer, cloud service or delivery is entirely free of risk. That is why I limit third-party access to what is genuinely needed.

10Public places and aerial photography

I also make documentary, travel, street, landscape and aerial photographs in places where photography is permitted. People sometimes appear in them incidentally. Whether to publish an image in which someone can be recognised, I weigh against the circumstances, the law, the person’s privacy and dignity, and the purpose of the publication.

If you recognise yourself in a photograph I have published and have a concern, write to legal@cecicapture.com. I will look at it as quickly as I can and remove or restrict the publication where that is appropriate or the law requires it.

11Cookies and statistics

As of the date of this policy, cecicapture.com uses no statistics, advertising or marketing tracking – only what the site and the form need to work securely.

If I add statistics or any other optional tracking, I will first update the Cookie policy and ask for your consent where the law requires it.

Outside services, such as the call calendar or the client gallery, may process technical data when you use them. The details are in the Cookie policy.

12How long I keep data

• Enquiries that did not lead to work – up to 12 months after the last correspondence; then they are deleted.
• Unpaid gift card orders (a card payment left or declined) – deleted automatically after 30 days. A photograph uploaded for the card – deleted automatically after 90 days. Paid gift cards – while they are valid and in use, then as an accounting record.
• Contracts, invoices and accounting records – for as long as accounting and tax law requires.
• Client galleries – active for at least one year after publication, unless the contract says otherwise.
• The archive of finished photographs – kept without a fixed deletion date: as a backup, for re-delivery, as an archive, as proof of authorship, to protect copyright and for legal claims, for as long as those purposes apply. The need to keep it is reviewed periodically. The archive is separate from the period an online gallery stays active.
• Consents, model releases and publication permissions – for as long as needed to show the permission, its use or its withdrawal, and for the period in which a dispute could arise.
• Face-search data – only while the feature is needed, in line with the law and the provider’s retention periods.

Where the law requires deletion, restriction or a shorter period, the law comes first.

13Security

I use technical and organisational measures suited to the kind and sensitivity of the data. Depending on the work, they include:

• password-protected accounts and restricted access;
• several separate backup copies;
• private galleries and restricted links;
• separate handling of sensitive photographs and controlled transfers for printing;
• local processing where appropriate.

No method of storage or transfer can rule out every risk.

14Transfers outside the EU

Some providers may process data outside the European Economic Area – the call calendar, Google and some cloud services, for example, are US companies. Where the GDPR requires safeguards, the transfer rests on an adequacy decision of the European Commission, standard contractual clauses or another mechanism the law allows.

15Your rights

Subject to applicable law, you have the right to:

• access your personal data;
• have inaccurate data corrected;
• request erasure where the legal conditions are met;
• request restriction of processing;
• object to certain processing;
• data portability where it applies;
• withdraw consent where processing is based on consent.

These rights are not absolute – some data may have to be kept because of a legal obligation, accounting, contractual records or legal claims. Write to legal@cecicapture.com. I will reply without undue delay and normally within one month; where the GDPR allows the period to be extended, I will tell you within the first month and give the reason.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or another competent supervisory authority.

16Changes

This policy is updated when the site, the services, the software, the providers or the law change. The date at the top shows the latest revision. If a significant change affects data you have already given me, I will tell you where the law requires it.