Who is responsible for your data
The controller of the personal data described here is Tero Kauria's Photography. For any question about your data, or to use the rights below, use the contact form.
This website runs on the photographer's own server. Your data is not sold, not shared for advertising, and not used for profiling.
What we collect and why
Visiting the site
The website loads no third-party scripts, fonts, trackers or advertising. To see which pages and photos are viewed, the site keeps privacy-preserving statistics without cookies: your IP address is replaced by a hash that changes every day (so visits cannot be linked across days), together with your browser type and the website that referred you. The detailed records are deleted after 30 days; only anonymous totals are kept after that. Legal basis: our legitimate interest in understanding how the site is used (GDPR Art. 6(1)(f)).
Like any web server, the server briefly records technical request data (IP address, time, requested page) to keep the site secure and working. These logs are kept in size-limited files that are overwritten automatically. Legal basis: legitimate interest in security (Art. 6(1)(f)).
Contact form
When you send a message we store your name, email address and message so we can reply, and your IP address to block spam. The IP address is removed after 30 days and the message is deleted after 24 months. Legal basis: steps at your request before a possible contract (Art. 6(1)(b)) and our legitimate interest in answering enquiries (Art. 6(1)(f)).
Client galleries
If you are a client, we store your name and email address (and those of anyone you asked us to share the gallery with), your favourites, comments and selections, and — if you create a client account — a securely hashed password. When a gallery is opened or a photo downloaded, the IP address and browser type are recorded so the photographer can see that the delivery arrived; these are removed after 90 days. Gallery data is kept while the gallery exists and deleted with it. Legal basis: performing our contract with you (Art. 6(1)(b)).
Photos you download are copies with location data and other private metadata removed.
Emails we send
We keep a record of the emails the site sends you (address, type of message, date) for 24 months, to confirm delivery and avoid sending duplicates. Emails are delivered through our email service provider, which processes them on our behalf under a data processing agreement. If that provider handles data outside the EU/EEA, the transfer relies on an EU adequacy decision or the European Commission's standard contractual clauses.
Security
Sign-in attempts and suspected attacks are logged with the IP address involved to protect the site and your data. These logs are deleted after 12 months. Legal basis: legitimate interest in security (Art. 6(1)(f)).
Cookies
This site uses only cookies that are strictly necessary for the service you ask for, so no consent banner is needed. None are used for tracking or advertising.
- csrf_token — protects forms against forged submissions. Deleted when you close the browser.
- gallery_pin_… / gallery_otp_… — remember that you unlocked a protected gallery with its PIN or an emailed code. 30 days.
- photohost_client_session — keeps you signed in to your client account. 30 days, or until you sign out.
- journal_preview_pin_… — remembers an unlocked preview link, while that link is valid.
Your browser may also remember the gallery view you last picked. That preference never leaves your device.
Who else sees your data
Only the photographer. The email service provider mentioned above delivers our messages. We do not otherwise share your data unless the law requires us to.
Your rights
You can ask for a copy of your personal data, have it corrected or deleted, restrict or object to its use, and receive it in a portable format. Where we rely on legitimate interest, you can object at any time. Send a request through the contact form and we will respond within one month.
You also have the right to lodge a complaint with a data protection supervisory authority — in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi), or the authority where you live or work.