Privacy policy

Data controller

Angelo Di Gianfilippo, photographer.

Email: foto@angelodg.photo

What I collect and why

Portfolio: no personal data. No contact forms, no profiling, no third-party trackers.

Private galleries: to download photos or save favourites you enter your email and confirm it with a 6-digit code. I store the email, what you downloaded and when, your favourites with any notes you write, and a non-reversible fingerprint of your IP address (never the address itself), to prevent abuse.

Technical logs: when you visit the site, the hosting provider (Vercel) records technical data about each request, including the IP address, for security and to keep the service running. These logs are kept for a few days at most.

Purposes of processing

1. Delivering the photos in private galleries: letting you view and download them, save favourites with your notes and, when you ask, send your selection to me.

2. Verifying your email and preventing abuse of downloads and galleries.

3. Keeping the site secure and running (technical logs, IP fingerprints).

Data is never sold, never used for profiling and never shared with others beyond the providers listed below.

People in the photos

In the photos you can recognise the people who were at the event, sometimes minors too. Private galleries can only be seen by whoever receives the link: the address cannot be guessed, it can have a password and an expiry date, and it never appears on search engines. Photos stay in the gallery until I delete the album.

Photos of private events (graduations, birthdays, parties, ceremonies) and portraits appear in the public portfolio only with a written release from the people shown, signed by a parent or guardian for minors. Photos of public events, such as races, may appear in the portfolio as part of my work.

If you appear in a photo and want it removed from the portfolio or from a gallery, write to me: I take it down as soon as possible.

Legal basis

Delivering the photos you were given access to (contract or pre-contractual steps); my legitimate interest in knowing who downloaded the photos, preventing abuse and keeping the site secure.

How long I keep data

Verification codes: 10 minutes, then deleted. IP fingerprints: up to 12 months. Email, downloads, favourites and notes: 24 months from your last activity, then deleted automatically (downloads remain only as anonymous counts), or earlier if you ask me. Download archives (ZIP): 7 days. Notices of a selection you sent me: 12 months.

Backups: an encrypted copy of the database is made every night and kept for 30 days. Data deleted from the site therefore disappears from the backups within 30 days as well.

Providers and where data is stored

Data is stored on servers in the European Union, by these providers acting on my behalf: Vercel (website hosting, servers in Frankfurt), Neon (database, Frankfurt), Cloudflare (photo and file storage, R2 with EU jurisdiction), Brevo (sending the verification emails, France) and GitHub (running the nightly backup, which is encrypted before being stored).

Vercel, Neon, Cloudflare and GitHub are US companies: should data be accessed from outside the EU, the transfer is covered by the EU-U.S. Data Privacy Framework or by the European Commission's standard contractual clauses.

Your rights

You can ask to access, correct or delete your data, or object to processing, by writing to foto@angelodg.photo. On request I delete your email, favourites and notes: your downloads remain only as anonymous counts. You can also complain to the Italian Data Protection Authority (garanteprivacy.it).