This Privacy Policy explains how Lux Photo Pro S.à r.l.-S collects and processes personal data, in accordance with the EU General Data Protection Regulation (GDPR), Luxembourg data-protection law and the ePrivacy rules, under the supervision of the Commission nationale pour la protection des données (CNPD). Business contact data is still personal data: operating B2B does not exempt this processing from the GDPR.

1. Data controller

Lux Photo Pro S.à r.l.-S — 13 Avenue Gaston Diderich, L-1420 Belair, Luxembourg · RCS B290472 · VAT LU36089387. Privacy contact: Andre Mitin (Managing Director), [email protected]. No Data Protection Officer is appointed (not legally required).

2. Data we collect

You provide: name, business email, phone, company, postal address; project details (dates, location, requirements, budget); newsletter preferences. Payment is processed by our payment provider — we do not store full card data.

Automatically: the page you arrived on, referring URL, campaign-attribution parameters (UTM tags, gclid / fbclid), IP address and browser user-agent. The IP and user-agent are personal data and are stored with your enquiry.

During a shoot: photographs and video, technical metadata, and behind-the-scenes content (with consent).

From third parties: referrals, social-media contacts, public business registries.

3. Purposes and legal bases

Responding to enquiries and quotes — pre-contractual steps / legitimate interest.
Delivering and invoicing services — performance of a contract and legal obligation (accounting/VAT).
Website security and fraud prevention — legitimate interest.
Analytics, advertising/retargeting and newsletter — consent.
Portfolio / social-media use of images — consent (Photo Release).

4. How form data is handled

Data submitted through the quote / contact form is stored in our database (Supabase, EU / Frankfurt region) and pushed to our CRM (Bitrix24) so our team can respond, prepare a proposal and manage the engagement. Attribution parameters are forwarded with the enquiry.

5. Processors and recipients

We act as controller; the following processors act on our instructions under data-processing agreements, EU regions selected where available:

Cloudflare — hosting / CDN (EU edge, Frankfurt)
Supabase — database / storage (EU, Frankfurt)
Sanity — content management
Bitrix24 — CRM (leads, deals)
Stripe — payments
Resend — transactional email · Mailchimp — marketing email (consent)
Pixieset — client galleries · Dropbox / Google Drive — file storage
Cal.com — call booking · Crisp — live chat (loaded after consent)
Google (Analytics / Ads), Meta (Pixel), TikTok — analytics and advertising (loaded only after consent)

Some of our photographers, videographers and editors are contractors, including outside the EEA (e.g. United Kingdom, Switzerland, Ukraine), bound by confidentiality. Other recipients: accountants, legal advisers, tax authorities and, where relevant, a business successor.

6. International transfers

Where data is processed outside the EEA, transfers rely on an adequacy decision (e.g. UK, Switzerland) or EU Standard Contractual Clauses with supplementary measures.

7. Cookies and tracking

Strictly-necessary cookies are required for the site to work. Non-essential cookies and trackers — Google Analytics / Ads, the Meta Pixel, TikTok Pixel and the Crisp chat widget — load only after you opt in via the consent banner, as required by the CNPD.

8. Retention

Data	Retention
Unanswered quote requests	3 years from last contact
Active client data	Relationship + 3 years
Invoices / accounting	10 years (Luxembourg law)
RAW photo files	~2 months after delivery
Edited deliverables	At least 1 year
Portfolio / social images	Until consent is withdrawn
Newsletter subscribers	Until unsubscribe or 3 years inactivity
Analytics (GA4)	14 months
Cookie-consent records	12 months

9. People in our photographs

For contracted work, adults (or guardians) consent to being photographed for the agreed purpose. Separate explicit consent (a Photo Release) is required to use images in our portfolio, social media, advertising or educational material; refusal does not affect service delivery. To withdraw consent, email [email protected] — we remove the content within 30 days (we cannot control third-party re-shares). Children's images require written parental/guardian consent and are never used for behavioural advertising.

10. Your rights

You may access, rectify, erase, restrict or object to processing of your data, request portability, and withdraw consent at any time. Email [email protected] with proof of identity; we respond within one month (extendable by two for complex requests). You may lodge a complaint with the CNPD, 15 Boulevard du Jazz, L-4370 Belvaux, +352 26 10 60-1, https://cnpd.public.lu.

11. Security

We use HTTPS encryption, access controls on a need-to-know basis, contractor agreements, regular backups and periodic reviews. Breaches affecting your rights are notified to the CNPD within 72 hours and to affected individuals where required.

12. Changes

We may update this policy; material changes are announced by email or a prominent notice on the site.

Lux Photo Pro S.à r.l.-S — [email protected] · +352 691 773 777. Last updated: 20 June 2026.