Privacy Policy

Who is responsible for your data

• Data controller: Thomas Jacob Bedwin

• NIF: Y1763094C

• Address: Calle federico Garcia Lorca 75, Miraflores de la Sierra, Madrid, 28792

• Email: hello@tjbedwin.com

I am established in Spain, so this site is governed by Regulation (EU) 2016/679 (GDPR), Ley Orgánica 3/2018 (LOPDGDD) and Ley 34/2002 (LSSI-CE), regardless of where you are reading it from.

What data is collected, and why

When you contact me

Data: your name, email address, and anything you include in your message, such as your wedding date, venue and plans.
Purpose: to answer your enquiry and, if we go ahead, to prepare a quote and manage your booking.
Lawful basis: performance of a contract or steps taken at your request before entering one (art. 6.1.b GDPR), and my legitimate interest in responding to enquiries (art. 6.1.f GDPR).
Retention: enquiries that do not lead to a booking are kept for up to twelve months. Where a booking follows, contract and billing records are kept for the periods required by Spanish tax and commercial law, generally six years.

When you request the price guide

Data: your email address, and your first name if you give it.
Purpose: to send you the price guide and a short series of follow-up emails about the service, which ends after the third email.
Lawful basis: your consent (art. 6.1.a GDPR), given when you submit the form.
Retention: up to twelve months from your last interaction, unless you become a client.
Withdrawing: reply to any of those emails asking to be removed, and you will be, immediately. There is no ongoing newsletter.

When you check a date on the availability checker

Data: the date you enter. It is checked in your browser against a list of already-booked dates. The date is not stored or sent anywhere.

When you visit the site

Data: technical data including IP address, browser, device and pages viewed, processed by Squarespace, and, if you consent to analytics cookies, by Google Analytics.
Purpose: keeping the site running and secure, and understanding how it is used.
Lawful basis: legitimate interest in security and proper functioning for essential processing (art. 6.1.f GDPR); your consent for analytics and advertising (art. 6.1.a GDPR).

Your cookie choice

Data: a record of the consent choice you made, stored by CookieYes.
Purpose: to remember your choice and to demonstrate that consent was properly obtained.
Lawful basis: legal obligation (art. 6.1.c GDPR).
Retention: 365 days, or until you change your choice.

Photographs of clients and their guests

Data: photographic images of identifiable people.
Purpose: delivering the photographs commissioned, and, separately and only with explicit permission, use in portfolio, website, social media and marketing.
Lawful basis: performance of the contract for delivery; explicit consent for promotional use, given separately in the booking contract and withdrawable at any time.
Note: portfolio use is never a condition of booking. Declining it changes nothing about the service you receive.

Who your data is shared with

Your data is not sold. It is shared only with the service providers needed to run the business:

• Squarespace Inc., which hosts this website and processes form submissions.

• Google LLC, for email (Google Workspace), website analytics (Google Analytics) and advertising measurement (Google Ads), the latter two only where you have consented to the relevant cookies.

• CookieYes, which records your cookie consent choice.

• Netlify, where your delivered photograph gallery is hosted, if you are a client.

• My gestoría and the Spanish tax authorities, where required by law.

Each acts as a data processor under a written agreement, or processes data under its own legal obligation.

Transfers outside the European Economic Area

Squarespace and Google are established in the United States and process data there. These transfers are made under the EU-US Data Privacy Framework or, where that does not apply, under Standard Contractual Clauses approved by the European Commission.

Your rights

You have the right to access your data, rectify inaccurate or incomplete data, erase it where no legal obligation requires it to be kept, restrict processing in certain circumstances, object to processing based on legitimate interest, receive your data in a portable format, and withdraw consent at any time without affecting processing carried out beforehand.

To exercise any of these, write to hello@tjbedwin.com stating which right you wish to exercise. You may be asked to confirm your identity.

If you believe your data has been handled improperly you may complain to the Agencia Española de Protección de Datos, Calle Jorge Juan 6, 28001 Madrid, www.aepd.es.

Security

Appropriate technical and organisational measures are in place, including encrypted connections, access controls and secure storage. No system is perfectly secure, but the measures taken are proportionate to the data held.

Changes

This policy may be updated. The version in force is the one published here.

Last updated: [DATE]