Privacy Policy

Who is responsible?

Francisco Maia, a photographer based in Porto, Portugal, is responsible for the personal information handled through this website (the data controller).

For privacy questions or requests, email franciscomaiafoto@gmail.com. You can use this address directly even when the contact form is temporarily unavailable.

What information is collected?

When you send an enquiry, the form collects your name, email address and message. These fields are required to send the enquiry and allow Francisco to respond. Visiting the website does not require submitting the form. Please include only information relevant to your request and avoid sensitive personal details.

Hosting and security services also process technical information, such as your IP address, request time and browser information. The website uses a random browser identifier and coded versions of that identifier and your IP address to limit repeated submissions. These coded values are pseudonymous, rather than fully anonymous.

How is it used?

• Photography enquiries: to discuss your request, provide a proposal and arrange a service. Where you ask about booking a service for yourself, the legal basis is taking steps at your request before entering a contract (Article 6(1)(b) GDPR).
• Other correspondence: to answer general questions or business enquiries. The legal basis is a legitimate interest in communicating with people who contact Francisco (Article 6(1)(f) GDPR).
• Website security: to prevent spam, repeated submissions and misuse. The legal basis is a legitimate interest in protecting the website and its contact service (Article 6(1)(f) GDPR).

Enquiry details are not used for mailing lists or advertising. The website does not make automated decisions with legal or similarly significant effects, or profile visitors for marketing.

Who receives the information?

Your enquiry passes through the website's hosting service and its email-delivery service before reaching Francisco's inbox. The services involved are:

• Cloudflare: website hosting, request processing, security and submission limits. See its privacy policy and data processing terms.
• Web3Forms, operated by Web3Creative: receiving, processing and forwarding enquiries by email. Its infrastructure and spam-filtering providers may also process relevant data. See its privacy policy and data processing agreement.
• Google (Gmail): receiving and storing messages in Francisco's email account and handling replies. See Google's privacy policy.

Personal information is not sold. Information may also be disclosed where required by law.

How long is it kept?

Enquiries in Francisco's inbox

Requests that do not lead to a booking are kept for up to six months after the last contact, then deleted. If a request leads to a booking, necessary records are kept for the duration of the service and afterwards only as needed to meet legal obligations or deal with legal claims.

Copies held by Web3Forms

On 12 October 2026, this form was configured to delete new submissions after 90 days (three months), counted from submission. Submissions received before this change are not covered by the new setting and may remain subject to the provider's previous maximum of three years, unless deleted earlier. Backup copies are subject to the provider's deletion procedures. This setting does not delete emails from Francisco's inbox, where the six-month period above applies. You can contact Francisco to request deletion, including assistance with copies held by the service.

Submission-limit records

The website's security store holds coded browser and IP identifiers and submission times, not your name, email or message. Records are used for a rolling 24-hour limit. An hourly cleanup removes expired records even if no further enquiries are submitted, normally within 25 hours of the attempt. Infrastructure outages may delay cleanup; provider backups follow the provider's retention terms.

Technical logs

Cloudflare Workers request and error logs are retained for up to seven days, depending on the hosting plan. Other infrastructure logs follow the providers' published retention terms.

Cookies and browser storage

This website does not include advertising cookies, visitor analytics or embedded social-media trackers. The form uses local browser storage to remember a random browser identifier and the time of a successful submission.

The browser identifier expires 24 hours after the latest submission attempt or successful delivery. Older identifiers without an expiry date are given a final 24-hour period on the next visit. Expired identifiers and submission timestamps are removed when the website next checks them; if you do not revisit, stored entries may remain on your device until you clear them. These entries do not contain your name, email or message. Hosting security services may use necessary cookies when providing abuse protection.

You can clear stored data in your browser settings. Server-side security limits still apply.

International processing

The services above may process information outside the European Economic Area, including in the United States and, for Web3Creative, India. Their published terms describe applicable transfer safeguards, including European Commission Standard Contractual Clauses and, where applicable, adequacy decisions. The linked provider terms explain these safeguards; you can also contact Francisco for further information or copies relevant to your enquiry.

Your choices and rights

Subject to the conditions in the GDPR, you can request access, correction, deletion or restriction of your information, and data portability where applicable. You can object to processing based on legitimate interests.

Send requests to franciscomaiafoto@gmail.com. Requests are normally answered within one month. If an extension is allowed for a complex request, you will be told why and when to expect a response. Reasonable information may be requested to verify your identity.

You can complain to Portugal's data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or the supervisory authority where you live or work.

Security, external links and updates

The website uses HTTPS and controls designed to reduce misuse of the contact form. No online service can guarantee absolute security.

Social-media links take you to separate platforms whose own privacy policies apply. This policy covers website visits and enquiries; any additional processing needed for a photography assignment will be explained when arranging that service.

This page will be updated if the website's data handling changes. The date at the top shows the latest revision.