1. Who is responsible for your data

Mario Vastola, freelance photographer, P.IVA 12348100962, Naples, Italy Email: mariovastola@rusalkoe.com

I am the data controller under the EU General Data Protection Regulation (GDPR, Regulation 2016/679).

2. What I collect

• What you send me: name, email, phone, and whatever you write in the inquiry form or by email or WhatsApp. –

• Booking and billing data: name, address, tax code or VAT number where an invoice requires it.

• Images and drone footage made during a session.

• Technical data from the website: IP address, browser, pages visited, cookies (see the Cookie Policy).

3. Why, and on what legal basis

• To answer your inquiry and prepare a quote: steps taken at your request before a contract (Art. 6(1)(b) GDPR).

• To deliver the session and the images: performance of the contract (Art. 6(1)(b)).

• To issue invoices and keep accounting records: legal obligation (Art. 6(1)(c)).

• To show images in my portfolio or on social media: your consent (Art. 6(1)(a)). You can withdraw it at any time.

• Website analytics and advertising cookies: your consent via the cookie banner (Art. 6(1)(a)).

• Website security: legitimate interest (Art. 6(1)(f)).

4. Who handles data on my behalf

I use trusted providers that process data for me under data-processing agreements: Squarespace (website and forms), Google Workspace (email and storage), Adobe (editing and cloud storage), SumUp Fatture (electronic invoicing via the Italian SDI), and my accountant.

Some of these are based outside the EU. Transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. I never sell or rent your data.

5. How long I keep it

• Inquiries that don't become bookings: up to 24 months after the last contact.

• Contracts, invoices and accounting records: 10 years, as Italian law requires.

• Client galleries stay online for 30 days. Delivered files are archived for up to 12 months, unless you ask for earlier deletion or longer storage.

6. Your rights

You can ask to access, correct or delete your data, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time.

Write to mariovastola@rusalkoe.com and I'll reply within 30 days. You can also complain to the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or to the data-protection authority of your own EU country.

7. Security

Data is stored on encrypted drives and password-protected cloud services. Boudoir and intimate images are kept in restricted folders and never shared with third parties.

8. Changes

If this policy changes, the new version is published here with its date.