Legal

Privacy & Cookie Policy

Last updated: 25 October 2026

I'm Andrea Santi, a photographer trading as 35mmbyandrea. I take your privacy seriously: this page explains, in plain language, what I collect, why, and what you can do about it.

1. Who is responsible for your data

The data controller is Andrea Santi, trading as 35mmbyandrea, London, United Kingdom (also working in Venice, Italy). For any privacy question or request, email [email protected].

2. What I collect and why

• Enquiries you send me. If you email me or use the enquiry form, I receive the details you choose to share — typically your name, email address, wedding or shoot date, location and a description of what you're looking for. I use them only to answer your enquiry and, if we work together, to provide my photography services.
• Technical data from my host. My site is hosted on Cloudflare Pages, which processes standard server logs (such as IP address, browser type and requested page) to deliver the site and keep it secure.
• Anti-spam verification. The enquiry form uses Cloudflare Turnstile to tell real visitors apart from bots. To do this, Turnstile runs a short check in your browser and sends Cloudflare your IP address and limited technical details about your device and browser. It is not used to track you, to build a profile of you, or for advertising, and it places no advertising cookies. A one-time token is passed to my server so the enquiry can be accepted, then verified with Cloudflare and discarded.
• Measurement and advertising data — only with your consent. If you choose "Accept all", the Meta Pixel is loaded and may collect your IP address, the pages you visit, your referrer, browser and device information, and identifiers stored in Meta cookies. I use this to understand how visitors find my work and to show my photography to people who may be interested in it, including advertising to people who have previously visited my packages pages. If you also send an enquiry, and my server has successfully emailed it to me, I send a server-side MailToClick event through Meta's Conversions API. That event contains your IP address, browser and device details, the page the enquiry came from, any Meta cookie identifiers present, and a one-way SHA-256 hash of your email address. Meta does not receive your name, your message, your shoot date or your email address in readable form. The event is sent only after you choose "Accept all"; if you reject optional cookies, no server-side event is sent.

3. Legal bases

• Consent (UK GDPR Art. 6(1)(a); EU GDPR Art. 6(1)(a)) for the Meta Pixel, the Meta Conversions API, Meta cookies and any similar technologies. You can withdraw it at any time.
• Steps taken at your request and performance of a contract (Art. 6(1)(b)) when I reply to your enquiry or provide photography services.
• Legitimate interests (Art. 6(1)(f)) in keeping the site secure, preventing abuse and responding to messages. These interests never override your rights.

Under the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy Directive, non-essential cookies and similar technologies are only used after you consent. Advertising cookies are never justified by legitimate interest alone.

4. Cookies and similar technologies

Your choice is also stored in your browser's local storage under cookie-consent-v1, together with the date and version of the notice you saw, so I can demonstrate that consent was given. This record is deleted or overwritten when you make a new choice. If you accept, a session-only record under meta-events-sent-v1 notes which conversion events were already sent in this tab, so the same action is not counted twice.

You can change or withdraw your choice at any time using Cookie Settings. Withdrawing consent stops all future Meta events and deletes the Meta advertising cookies on this site.

5. Who else receives your data

• Meta Platforms Ireland Ltd (and other Meta group companies) as the provider of the Meta Pixel and the Conversions API, when you accept optional cookies.
• Cloudflare, Inc. as my hosting provider, and as the provider of Turnstile, the anti-spam check on my enquiry form.
• Google LLC / Google Ireland Ltd as the provider of my email account, when you send an enquiry through the form or email me directly. Fonts are served from this site, so simply browsing it does not contact Google.

I do not sell your personal data, and I do not share the contents of your enquiry with advertisers. With your consent, Meta receives the limited measurement data described above, including a hashed form of your email address.

6. International transfers

Some providers are based in the United States. Where data leaves the UK or the EEA, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or on the UK International Data Transfer Addendum / European Commission Standard Contractual Clauses.

7. How long I keep things

• Enquiry emails: up to 24 months after our last exchange, then deleted unless we're working together.
• Client and project records: for as long as needed to deliver the work and to meet legal, tax and insurance obligations.
• Consent records: for as long as your choice applies, plus a short period afterwards so I can demonstrate it.
• Server logs at Cloudflare: according to Cloudflare's own retention periods.
• Meta measurement and advertising data: according to Meta's own retention periods.
• Turnstile verification tokens: single use and expire within minutes, so they are never kept.

8. Your rights

You have the right to:

• access the personal data I hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how your data is used;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing that happened before withdrawal.

Email [email protected] and I'll respond within one month. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

9. Changes to this policy

If I change how I use cookies or personal data, I'll update this page and, where the change is significant, ask for your consent again.

← Back to the site