Privacy Policy

This page explains what data this website collects about you, why, where it is stored and how to have it deleted. In short: we take what you write in the contact form and in the pre-shoot questionnaire, use it only to prepare and run your shoot, never sell it and never show you advertising.

1. Who is responsible for your data

The data you leave on this website is collected and used by Korol Ivanna, Gießen (a private individual) — the «Photographer». The Photographer decides why and how your data is processed and is, in GDPR terms, the data controller.

The site runs on the Litecta platform, operated by LEARNING HORIZONS HUB LLC, 7 Navy Pier Ct, Unit 5066, Staten Island, NY 10304, USA. The platform gives the Photographer the technical means to store data and acts only on the Photographer's instructions: it is the data processor. The platform does not use your data for its own purposes.

For any question about your data, contact the Photographer at hello@ivannakorol.com, +4917689767685. Questions for the platform: privacy@litecta.com.

2. What data we collect

What you write yourself. When you submit the contact form we receive your name, the way to reach you (phone, email or messenger handle — whatever you choose to give) and the text of your message. The form has no required fields beyond these; everything else you share later, in conversation, of your own accord.

What you write in the pre-shoot questionnaire. If the Photographer has sent you a personal link to your shoot's page, it may hold a short questionnaire: who will be at the shoot, what the photos are for, the mood you want, where and when is convenient, what you plan to wear, examples you like, and anything you feel is worth adding. You fill in only the answers you wish to. They are seen by the Photographer running that shoot and by no one else. You can return to the same link and change what you wrote at any time while the link is active.

When the questionnaire touches something sensitive. Some shoots are about health or about children by their very nature: a pregnancy and how far along it is, the age of a newborn, how you are feeling, limits on movement, an allergy to a prop, the names and ages of children. In law this is a special category of data (Article 9 GDPR), and we treat it differently from everything else. No field of the questionnaire asks for it: you write it only if you think it matters, and only as much as you want to. The basis is your separate, explicit consent (Article 9(2)(a) GDPR), given by ticking the box before you send the questionnaire. These answers are seen only by the Photographer running that shoot. You can delete them at any time, yourself through the same link or with one email to the Photographer.

What the Photographer records about you. Some of the data is entered not by you but by the Photographer: your name, your contact and what was agreed after a phone call or a message, the date and place of the shoot, the amount and payment status, working notes. The source of such data is your own communication with the Photographer, or the public contacts of your venue or company if we approached you on business. You have the right to know what is recorded there and to ask for it to be corrected or deleted — see section 8.

What your browser sends. Together with your request we automatically store the IP address, the name of your browser and operating system (the User-Agent), the page you sent the request from and the page you arrived from, plus the date and time. This serves one purpose: to protect the form from automated spam. We do not use this data to identify you or track you across sites.

What we do not collect. We do not ask for or store payment-card details, identity-document numbers, religious or political views, biometric data used to identify a person, or criminal-record data. We do not ask about health in separate fields and we draw no conclusions from it: it reaches us only when you describe something about your own shoot in the questionnaire. The contact form is not meant for that — sensitive things are better left for a conversation.

3. Why we need this data

The only purpose is to reply to your request, discuss the shoot, agree the date, scope and price, and then carry out what we agreed. The answers from the questionnaire serve exactly one end: to prepare your particular shoot — the light, the location, the pace and the props that match what you described. We do not use your data for advertising, we do not build profiles, we make no automated decisions about you, and we do not pass your contacts to third parties for their marketing.

4. Our legal basis

The basis is your consent, given when you tick the box under the form and submit your request (Article 6(1)(a) GDPR). If, after your request, we move on to agree a shoot, processing your contact details is also necessary to perform the contract between us (Article 6(1)(b) GDPR).

If you have written something about health or about a child in the questionnaire, the basis for those particular answers is your separate, explicit consent (Article 9(2)(a) GDPR). That is why the questionnaire is not sent until you tick the box.

Together with your consent we store the date and time, the IP address, the name of your browser and the edition mark of this document that was shown to you. This exists for one reason: so that a year later we can still say which text you agreed to. It is a record of consent, not an electronic signature.

You can withdraw your consent at any time — just tell us. Withdrawal does not affect the lawfulness of processing carried out before it.

5. How long we keep your data

Requests that did not lead to work together — up to 12 months, then deleted.
Data of clients we have worked with — up to 3 years after the last engagement: this period is needed so that any dispute about the work done can be resolved.
Answers from the pre-shoot questionnaire — together with the data of that shoot; if the shoot never happened, they are deleted along with the request.
Technical records (IP, User-Agent) — up to 12 months, together with the request.

You can ask us to delete your data sooner — see section 8.

6. Where your data is physically stored and who can access it

The website and its database are hosted in the European Union:

Website server — Hetzner Online GmbH, Фалькенштайн, Німеччина.
Database — Supabase (AWS eu-central-1), Франкфурт-на-Майні, Німеччина.

Your requests can be accessed by the Photographer (through their own cabinet) and by the technical staff of the Litecta platform, solely for support and troubleshooting. The company operating the platform is registered in the United States, so in individual support cases access to data may take place from the US, under appropriate safeguards. We do not disclose your data to the authorities of other countries except where the law expressly requires it.

We do not sell, rent or trade your data. The only third parties involved in processing are the hosting providers named above, who act under contract and may not use the data for their own purposes.

7. Cookies, analytics and advertising

This website has no analytics counters, advertising pixels, social-network trackers or advertising cookies. We place no tracking files in your browser, which is why you see no tiresome cookie banner here — there is simply nothing to warn you about.

Technical cookies are used only inside the Photographer's private cabinet, to keep them signed in after login. As a visitor to the site, this does not concern you.

8. Your rights

You have the right to:

find out exactly what data of yours we hold and receive a copy of it;
have inaccurate data corrected;
request erasure of your data (the «right to be forgotten»);
restrict processing or object to it;
withdraw your consent at any time;
receive your data in a readable format to pass it to someone else.

To exercise any of these rights, write to the Photographer at hello@ivannakorol.com. We reply within 30 calendar days. There is no charge for this.

If you believe your rights have been breached, you may lodge a complaint with the data protection authority in your country, or go to court.

9. Children

The site is not intended for children under 16, and we do not knowingly collect their data directly. If a shoot involves a child, the request and the questionnaire are filled in by a parent or other legal guardian, who decides what to write about the child and how much. A child's name and age reach us only to the extent an adult entered them. If you believe a child has left their data here on their own, tell us and we will delete it.

10. Security

The site runs over a secure connection (HTTPS), database access is restricted per account, and passwords are stored in encrypted form. That said, we will be honest: no system on the internet offers a hundred-per-cent guarantee. If a breach occurs that threatens your rights, we will notify you and the competent data protection authority within the time limits set by law.

11. Changes to this policy

We may update this document — for example, if the way the site works changes. The current version is always on this page, with its date shown below. We will inform those whose data we hold at the time about any significant change.

Version of 2026-08-20.