Legal
Privacy policy
How I process personal data on mihailazar.net: quote requests, client galleries, the providers I use, how long I keep data and your rights under the GDPR.
Last updated
Who I am and how to contact me
The controller of your personal data is Mihai Lazar, Bucharest, Romania. I am a photographer, videographer and web developer, working under the name Mihai Lazar at mihailazar.net, media.mihailazar.net, build.mihailazar.net and contact.mihailazar.net. This policy applies to all of these addresses.
For any question about your data, write to me at contact@mihailazar.net. I answer every request personally.
This policy follows Regulation (EU) 2016/679 on data protection (the "GDPR") and Romanian Law no. 190/2018, which supplements it.
What data I process and why
Quote requests
When you send the form on media.mihailazar.net/oferta or build.mihailazar.net/oferta, I receive your name, phone number, email address, message, preferred date, the service you chose and the language of the page. I also store the moment you ticked the box to confirm that you had read this notice, plus a pseudonymised value derived from your IP address (a hash with a secret key), used only to limit abusive submissions and kept for at most 48 hours.
The tick box in the form only confirms that you have received this notice. It is not consent: I process the data to reply to your request, on the legal basis shown in the table below.
I use this data to reply, send you a quote, agree on a date and, if we work together, prepare the contract. The form data is needed so that I can reply; without it I cannot make you an offer. You have no legal obligation to provide it.
Email, phone and WhatsApp
If you write to me directly or call me, I process what you share in the conversation (name, phone number, email address, the content of the messages) for the same purpose: to reply and to prepare our work together.
Private client galleries
For each photo or video project I may create a private gallery on media.mihailazar.net/share to deliver your files. The gallery contains the photos and clips of the project, a title, the client's name and email address and, optionally, a message from me. Access works through a long link that is hard to guess, and files are viewed and downloaded through temporary addresses that are valid for at most 24 hours. Each gallery has an expiry date, shown on the page. After that date, the gallery and its files are deleted automatically within 30 days.
People in photos and videos
Photos and footage in which a person can be recognised are personal data. I create them and deliver them to the client who orders them, under the contract with that client. I may publish a selection of work in the portfolio on my pages and on my social media accounts, unless the client and I have agreed otherwise in writing. If you appear in one of the published images and do not want it to stay there, write to me at contact@mihailazar.net and I will remove it from the portfolio and from my accounts.
Your cookie choice
When you choose which cookies to accept, your choice is saved only in your browser, in the ml_consent cookie. Details in the Cookie policy.
Admin panel
I manage requests and galleries from an admin panel that only I can access, with an email address and a password. Signing in uses necessary cookies, in the panel only.
Technical data at hosting providers
The pages reach you through the servers of hosting providers (Vercel, Cloudflare). On every visit they automatically process technical data: IP address, browser type, the page requested and the time. This data is used to deliver the pages, for security and to stop attacks, and the providers keep it for short periods under their own policies. I do not use it to identify you.
Legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your quote request, the quote, scheduling, preparing the contract | Article 6(1)(b), steps taken at your request before entering into a contract |
| Producing and delivering the photos, footage or web project, private galleries | Article 6(1)(b), performance of the contract |
| Protecting the forms against spam and abuse, page security, technical logs | Article 6(1)(f), my legitimate interest in keeping the services secure |
| The public portfolio, on my pages and on my social media accounts | Article 6(1)(f), my legitimate interest in presenting my work, except work the client has asked in writing to keep confidential, with your right to object |
| Invoicing, accounting, replying to public authorities | Article 6(1)(c), my legal obligations |
| Optional cookies (statistics, marketing), if they are ever used | Article 6(1)(a), your consent, together with Romanian Law no. 506/2004 |
Who receives the data
I do not sell or rent data. It only reaches the providers that work on my behalf and a few services that receive it as independent controllers, listed below.
Providers that process data on my behalf
These providers process the data only on my instructions, under data processing agreements (Article 28 GDPR).
| Provider | What it does | Where |
|---|---|---|
| Vercel Inc. | hosting and delivering the pages | USA, global server network |
| Supabase Inc. | the database (requests and galleries) and signing in to the panel | data is stored in the EU, in the Frankfurt region (Germany) |
| Cloudflare Inc. | DNS, file storage (R2), form protection (Turnstile), forwarding emails sent to contact@mihailazar.net | USA, global server network |
| Resend (Plus Five Five Inc.) | sending confirmation and reply emails | USA |
| Meta (WhatsApp Business Platform) | reply messages sent automatically on WhatsApp, to the number in your request, when I also reply that way | EU and USA |
Services that receive data as independent controllers
These services process the data under their own privacy policies, not on my instructions.
| Service | What data reaches it | Where |
|---|---|---|
| Google (Gmail) | emails sent to contact@mihailazar.net and notifications of new requests, which I receive in my Gmail mailbox | USA and EU |
| WhatsApp (Meta) | WhatsApp conversations, when I reply from my own app to the number in your request or when you write to me | EU and USA |
| The social networks where I publish work (for example Instagram and Facebook, owned by Meta) | the portfolio work I publish there, unless we have agreed otherwise in writing | EU and USA |
Data may also reach public authorities, but only when the law requires it, and the advisers who help me with my legal obligations (for example accounting), who are bound by confidentiality.
Transfers outside the European Economic Area
Some providers are US companies. Transfers to them rely on the European Commission's adequacy decision for the EU and US Data Privacy Framework, for certified companies, and on the standard contractual clauses adopted by the Commission (Article 46 GDPR) where there is no certification. You can ask for a copy of these safeguards at contact@mihailazar.net.
How long I keep data
| Data | How long I keep it |
|---|---|
| Quote requests and correspondence, if no contract follows | 24 months from the last contact; requests sent through the form are deleted automatically after this period |
| The value derived from your IP address (hash) | 48 hours, then deleted automatically |
| Contract data and invoicing documents | for the duration of the contract, then as long as accounting and tax law requires |
| Private galleries | until the gallery's expiry date; after it, the gallery and its files are deleted automatically within 30 days |
The ml_consent cookie | 180 days, after which you are asked again |
| Providers' technical logs | the short periods set by each provider |
I have chosen these periods as defaults: they are the shortest that allow me to reply to you, meet my legal obligations and defend my rights. If the quote provides for keeping an archive of the project, the period in the quote applies. When a period ends, I delete the data or anonymise it.
Your rights
You have the right:
- to find out whether I process data about you and to receive a copy of it (Article 15);
- to have inaccurate data corrected or incomplete data completed (Article 16);
- to have your data erased (Article 17), within the limits set by law;
- to have processing restricted (Article 18);
- to receive the data you provided in a structured, commonly used format and to pass it to another controller (Article 20);
- to object to processing based on legitimate interest, including the use of an image in the portfolio or on social media (Article 21);
- to withdraw your consent at any time, without affecting processing carried out before then (Article 7(3)); for cookies, from Cookie settings in the footer of every page.
How to exercise your rights
Write to me at contact@mihailazar.net and tell me what you would like. I reply free of charge within one month. If the request is complex, this can be extended by two further months, and in that case I will tell you why. If I am not sure the request comes from you, I may ask for information that confirms your identity.
Complaints to the authority
If you are not satisfied with my reply, or even without contacting me first, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro (opens in a new tab), or with the supervisory authority in the country where you live or work.
Automated decisions
I do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly affect you (Article 22). The form's spam protection only stops automated submissions; I read every genuine request myself.
How I protect data
- every page loads over an encrypted connection (HTTPS);
- the admin panel requires signing in and only I can access it;
- visitors cannot read requests or galleries in the database: the form is saved through my server, and I only see the data in the panel;
- private galleries use long, random links and have an expiry date, and files are downloaded through signed addresses that are valid for at most 24 hours;
- access keys for services are kept apart from the code and have only the permissions they strictly need.
No system is completely secure. If a personal data breach occurs that may affect your rights, I notify ANSPDCP within 72 hours and I also notify you where the law requires it.
Children
My services are aimed at adults and businesses, and the form is not intended for children under 16. When I photograph or film minors, I do so only with the consent of a parent or guardian, obtained by the client or by me directly.
Changes
I may update this policy when my services, providers or the law change. The date of the last update appears at the top of the page. If a change concerns optional cookies, I will ask for your consent again.
Questions about these textscontact@mihailazar.net
Back to top