01

Controller

No data protection officer is required or appointed.

02

Website access and hosting

When a website is accessed, technical data may be processed automatically: IP address, date and time of the request, requested page or file, referrer URL, browser and operating-system information, device information, response status and transferred data volume. This is required to deliver the website, maintain stability and security, prevent abuse and diagnose errors.

Legal basis: Art. 6(1)(f) GDPR. My legitimate interests are the secure, reliable and efficient provision of my online services.

The portfolio website is hosted using Vercel. Delivery, security and traffic analysis may also involve Cloudflare. Separate legal-information pages may use hosting infrastructure supplied through OpenAI Sites and Cloudflare. These providers can process connection and log data on my behalf and may use infrastructure outside the EEA.

Server logs are retained only for as long as needed for operation, security and error analysis, unless an incident or legal obligation requires longer retention.

03

Privacy-friendly analytics

I use Cloudflare Web Analytics to understand aggregated website usage, such as page views and general traffic patterns. Cloudflare states that this service does not use cookies and does not collect or use visitors’ personal data. No advertising profiles are created.

Legal basis, where the information is considered personal data: Art. 6(1)(f) GDPR. My legitimate interest is to evaluate and improve my websites. I do not use Google Analytics or Meta Pixel.

04

Contact, booking and waitlist forms

When you contact me by email, Instagram or a website form, I process the information you provide. This may include your name, email address, social-media account, selected session, preferred date, message, project details and subsequent correspondence.

The booking form and gift-certificate form send the submitted information to my email inbox. The gift-certificate form records the selected amount and email address; payment is not taken through the website. If an order is accepted, payment is handled by invoice.

The workshop waitlist form is processed through Formspree. It may collect your name, email address, Instagram, Telegram or website profile, preferred workshop topics and period, your goals, consent selection, and technical information needed to submit and protect the form. Formspree receives, stores and forwards the submission to me.

Legal basis: Art. 6(1)(b) GDPR for pre-contractual steps and performance of a contract; Art. 6(1)(f) GDPR for general professional correspondence and the reliable and secure operation of online forms; Art. 6(1)(a) GDPR for emails about workshops and related announcements that you expressly request through the waitlist; and Art. 6(1)(c) GDPR where records must be retained by law. You may withdraw waitlist consent at any time by emailing maria@chevskaya.com.

If information required to prepare or perform a contract is not provided, I may be unable to respond to or fulfil the request. Providing optional waitlist information is voluntary.

05

Photography and video services

To plan, perform and deliver a commission, I may process contact and contract details, scheduling information, preferences, invoices, correspondence, photographs, video and audio recordings, edited files, gallery access information and delivery records.

Legal basis: Art. 6(1)(b) GDPR. Where processing is necessary to comply with tax, accounting or other legal duties, Art. 6(1)(c) GDPR applies. Necessary business administration and the establishment, exercise or defence of legal claims may be based on Art. 6(1)(f) GDPR.

Children

I also accept commissions involving children. A parent or legal guardian must arrange or approve the session. Children’s images and related booking information are processed only as required to perform the agreed service. Publication is not part of the photography contract and requires separate permission from the authorised parent or guardian.

Portfolio publication

Client photographs or films are published in my portfolio, website, professional profiles or promotional materials only after separate consent. The legal basis is Art. 6(1)(a) GDPR. Consent is voluntary and may be withdrawn at any time with effect for the future by contacting maria@chevskaya.com. Withdrawal does not affect processing that was lawful before withdrawal. Existing printed materials cannot always be recalled; future use will stop.

06

Service providers and recipients

I disclose personal data only where needed for the stated purposes, where required by law, or with your consent. Depending on the assignment, the following services may receive data:

• Google / Gmail — business email, communication and file exchange.
• Instagram / Meta — messages and professional communication when you contact me through Instagram.
• Formspree — receiving, protecting, storing and forwarding website form submissions.
• DocuSign — contracts and electronic signatures.
• Sorted — invoicing and accounting.
• Pic-Time Ltd. — hosting and delivery of client galleries.
• Vigbo — hosting and delivery of client galleries.
• Vercel, Cloudflare and OpenAI Sites infrastructure — website hosting, delivery, security and analytics as described above.
• Professional advisers, tax authorities, courts or other public bodies where disclosure is legally required or necessary to establish, exercise or defend legal claims.

Where a provider processes data on my instructions, it is used as a processor under Art. 28 GDPR where required. Providers may also process limited data as independent controllers under their own privacy terms.

07

International data transfers

Some providers are based in, or use systems located in, countries outside the EEA, including the United States, Israel and the United Kingdom. Data is transferred only where a lawful transfer mechanism is available, such as an EU adequacy decision, the EU–US Data Privacy Framework for participating organisations, or European Commission Standard Contractual Clauses together with supplementary safeguards where required. Further details or a copy of the relevant safeguards may be requested by email, subject to protection of confidential information.

08

Retention

• Unsuccessful enquiries and general correspondence: normally up to three years after the last substantive contact, unless earlier deletion is appropriate or a longer period is needed for legal claims.
• Waitlist submissions: until the relevant workshop communications are completed, consent is withdrawn or the waitlist is no longer needed. Copies held by Formspree are deleted when no longer required for this purpose.
• Contracts and business correspondence: for the applicable limitation period and statutory retention period, generally six years for commercial correspondence.
• Invoices and accounting records: for the statutory period applicable to the record, generally eight years for accounting vouchers and up to ten years for certain books and records.
• Photographs, video, audio, project files and delivered work: normally up to ten years after the assignment, unless a shorter period is agreed or longer retention is necessary for claims or ongoing services.
• Portfolio material: until consent is withdrawn or the material is no longer needed for the stated publication purpose.

After the relevant period, data is deleted or anonymised unless continued retention is legally required.

09

Cookies and communications

I do not use advertising cookies, Google Analytics or Meta Pixel. I do not operate a general newsletter or use unrelated automated email marketing. If you voluntarily join a workshop waitlist and consent to receive emails about those workshops and related announcements, I may send only those communications until you withdraw consent.

Essential technologies may be used where strictly necessary to provide, submit or secure a website or form. If non-essential cookies or comparable technologies are introduced later, they will not be activated without any consent required by law, and this policy will be updated.

10

Your rights

Subject to the applicable legal conditions, you have the right to access your personal data, correct inaccurate data, request deletion, restrict processing, receive data you provided in a portable format, and object to processing based on legitimate interests. You may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for Berlin is:

To exercise your rights, contact maria@chevskaya.com. I may need information to verify your identity before responding.

11

Security and automated decisions

I use appropriate technical and organisational safeguards designed to protect personal data against loss, misuse and unauthorised access. No solely automated decision-making, including profiling, is used to make decisions that produce legal or similarly significant effects.

12

Changes to this policy

I may update this policy when my services, providers or legal obligations change. The current version is the one published on this page.