Cookie & Privacy Policy

Data we collect

Email address. If you join the email list, we collect the email address you submit, and note which page of this site you signed up from (for example /booking), so we can see which pages bring people in. The address is used to send you new workshop dates, journal posts and the occasional offer of Fernando’s own workshops, photo walks and shoots. It is never sold or shared with third parties. If you joined the priority list before the site launched, your address is used only for what that list promised: news of workshop booking and the early-access discount.

Processor. Your email is stored and sent through Brevo, our email marketing platform, based in Paris, France, an EU company, so no international data transfer is involved for this part of the processing. Brevo acts as our processor under its own data processing agreement; see brevo.com/legal/privacypolicy.

Booking and payment details. If you book a photo walk, a photo shoot or a place on a workshop, or buy a gift voucher, we collect your name, email address and phone number, the answers you give to the booking questions, and the service and time you chose. Your card details are entered on Stripe’s own payment page and never reach this website or us. All we ever see of the card is its brand, its last four digits and whether the payment went through.

Someone else’s details, if you send them a gift. When you buy a gift voucher you may ask us to email it to the person it is for. We then collect their name and email address and the message you write, and we use them for one thing only: sending that one email. We never add them to any list, and we do not contact them again. The details travel with the payment record, so they are kept as long as it is. See Retention below. If you are that person and would rather we did not hold your address at all, say so and we will remove it.

Bookings and payments

Taking a booking means handing parts of it to three companies that do the work we cannot do ourselves. None of them is permitted to use your data for its own purposes.

Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) takes the payment, holds the card data, issues the receipt and keeps the transaction record. Stripe may transfer data to its parent company in the United States under the European Commission’s Standard Contractual Clauses. Its privacy policy applies: stripe.com/privacy.

Cal.com (Cal.com, Inc., United States) holds the calendar behind the booking, which is how the site knows a time is genuinely free and how the confirmed session reaches Fernando’s own calendar. Your name, email address, phone number and your answers to the booking questions are stored there. That transfer outside the EU is covered by the Standard Contractual Clauses. Its privacy policy applies: cal.com/privacy.

Zoho (Zoho Corporation B.V., Netherlands) hosts Fernando’s own calendar and the hello@fernandopedrosalgado.com mailbox. A confirmed booking is written into that calendar, so the name, the service and the time reach it, and anything you send through the contact form or reply to an email is held in that mailbox. Its privacy policy applies: zoho.com/privacy.

Legal basis

We process your email address on the basis of your consent (GDPR Art. 6(1)(a)), given when you voluntarily type your address into one of the site’s sign-up forms and submit it. To confirm the address is really yours, we send a one-time confirmation email; your subscription only becomes active once you click the link in it (double opt-in). You can withdraw that consent at any time; see Your rights below.

A booking is different. When you book a session or buy a voucher we process your details to perform the contract you are entering into (Art. 6(1)(b)). There is no consent to give or withdraw, because without those details there is no booking. Keeping the invoice and the accounting record behind it afterwards is a legal obligation (Art. 6(1)(c)) under Czech accounting and tax law.

Emailing a gift voucher to its recipient is the one case where we process the details of somebody who has not asked us for anything. The basis there is our legitimate interest (Art. 6(1)(f)) in doing what the buyer paid us to do, weighed against the recipient’s interests: it is a single expected email, it is not marketing, and it leads to no further contact.

Retention

We keep your email address for as long as you want to hear from us. There is no fixed expiry date: it stays on the list until you unsubscribe. You can do that from the link at the bottom of every email we send, or by emailing us. When you unsubscribe we stop sending straight away and keep nothing but a record that you opted out, so that a later import cannot add you back by mistake. You can ask us to erase that record too. See Your rights below.

Bookings and payments are different. Invoices and the accounting records behind them are kept for as long as Czech accounting and tax law requires, which is at least five years from the end of the accounting period they belong to. Because that is a legal obligation rather than a choice, these records cannot be deleted on request. Booking details held in the calendar are removed once the session has taken place and the period for any dispute about it has passed.

Cookies

Functional cookie. This site sets one cookie, cookie_consent, on pages that show a cookie banner: choosing accepted or declined there stores that choice for 12 months, so we don’t ask again on your next visit. This privacy page itself does not show that banner and sets no cookie. As a strictly necessary cookie under GDPR/ePrivacy, it may be set without prior consent. No other cookie is ever set without your consent. See Analytics (Google) below for the only cookies that consent can enable.

Analytics (Vercel). We use Vercel Web Analytics to understand traffic. It is cookieless by design: visitors are identified by a rotating, anonymised hash rather than a stored identifier, so no consent banner is required for it under GDPR/ePrivacy. We process these server logs and aggregated analytics on the basis of our legitimate interest (GDPR Art. 6(1)(f)) in operating and securing the site.

Analytics (Google). With your consent, this site also uses Google Analytics 4, run by Google Ireland Limited, to understand traffic and how visitors use the site. It sets two cookies, _ga and _ga_<container-id>, each kept for up to 2 years. It runs only if you choose Accept in the cookie banner: it never loads on Decline, and never before you’ve made a choice. You can withdraw consent at any time via Cookie settings in the footer, which stops further tracking and clears these cookies. We process this on the basis of your consent (GDPR Art. 6(1)(a)). Because Google processes this data outside the EU, that transfer relies on the European Commission’s Standard Contractual Clauses as its legal basis. Google’s privacy policy applies: policies.google.com/privacy.

Your rights

Under GDPR you have the right to access, rectify, erase, restrict or object to processing, and the right to data portability; you may withdraw your consent at any time, and withdrawing consent does not affect the lawfulness of processing before withdrawal. Opt-out: every email we send includes an unsubscribe link; you can also ask us directly at hello@fernandopedrosalgado.com and we’ll remove it from Brevo. One limit is worth stating plainly: the right to erasure does not reach invoices and accounting records, which we are required by law to keep. See Retention above. If you believe we’ve mishandled your data, you also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

Hosting

This site is hosted on Vercel (San Francisco, CA, USA), which processes standard server logs (IP addresses, request timestamps) as part of its infrastructure. Vercel is certified under the EU-U.S. Data Privacy Framework, which is the legal basis for this transfer of data outside the EU. Vercel’s privacy policy applies: vercel.com/legal/privacy-policy. We process these server logs and aggregated analytics on the basis of our legitimate interest (GDPR Art. 6(1)(f)) in operating and securing the site.