Privacy Policy

LUX PHOTO PRO S.à r.l.-S

Last updated: 5 May 2026

1. Introduction

This Privacy Policy explains how LUX PHOTO PRO S.à r.l.-S (“Lux Photo Pro”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data of clients, prospective clients, website visitors, photo subjects, and other individuals who interact with us.

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Luxembourg Data Protection Act of 1 August 2018, and the ePrivacy Directive 2002/58/EC.

By using our website at luxphotopro.com, contacting us, or engaging our services, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

LUX PHOTO PRO S.à r.l.-S

13 Avenue Gaston Diderich

L-1420 Belair, Luxembourg

Numéro d’immatriculation (RCS): B290472

VAT: LU36089387

Privacy contact (Data Protection Representative):

Andre Mitin, Managing Director

Email: info@luxphotopro.com

We have not formally appointed a Data Protection Officer (DPO) as we are not legally required to do so under Article 37 GDPR. However, Andre Mitin acts as the designated person responsible for handling data protection matters and inquiries.

3. Definitions

• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data (collection, storage, use, disclosure, deletion, etc.).
• Data subject: the individual whose personal data is being processed.
• Processor: a third party that processes personal data on our behalf (e.g., hosting providers, CRM platforms).
• Controller: the entity that determines the purposes and means of processing — in this Policy, that is Lux Photo Pro.
• Photo subject: any individual whose image is captured during our photography or videography services.

4. Personal Data We Collect

4.1 Data you provide directly

When you contact us, request a quote, book a service, or otherwise interact with us, we may collect:

• Identification data: full name, surname.
• Contact data: email address, phone number, postal address (when provided for invoicing or location-based services).
• Service-related data: event date, location, type of service requested, special requirements, budget range, and any other information you share during consultations or in your messages to us.
• Payment data: invoicing details, VAT number (for business clients), bank details (for wire transfers). We do not store full payment card data. Card payments, where applicable, are processed by Stripe, and we receive only confirmation of the transaction.
• Marketing data: newsletter subscription preferences.

4.2 Data collected automatically when you visit our website

• Technical data: IP address, browser type and version, operating system, device type, referring URL, pages visited, time spent on pages, click behaviour.
• Cookie data: information stored in cookies and similar technologies. See our Cookie Policy for details.
• Advertising identifiers: when you arrive via paid advertising (Meta, Google, TikTok), we may receive campaign attribution parameters (UTM tags, click IDs).

4.3 Data we collect during photo/video services

• Image and audio data: photographs and video recordings of you and other photo subjects taken during the contracted shoot.
• Metadata: technical metadata embedded in image/video files (date, time, camera settings, GPS coordinates if enabled on the device — typically disabled on professional equipment).
• Behind-the-scenes content: in some cases, behind-the-scenes images or video used for portfolio or social media (only with consent).

4.4 Data from third parties

In limited cases we may receive your data from:

• Referrers and existing clients who recommend our services.
• Social media platforms when you contact us through Instagram, Facebook, or similar channels.
• Public business registries (for B2B due diligence).

5. Purposes of Processing and Legal Basis

We process personal data only when there is a valid legal basis under Article 6 GDPR.

6. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies, including:

• Strictly necessary cookies — required for the website to function (no consent required).
• Analytics cookies — Google Analytics 4 (GA4) — measure traffic and user behaviour.
• Advertising cookies — Meta Pixel (Facebook/Instagram), Google Ads, TikTok Pixel — used for retargeting and advertising performance measurement.
• Functional cookies — for features such as language preferences and form auto-fill.

Non-essential cookies (analytics and advertising) are loaded only after you give explicit consent through our cookie consent banner. You can change or withdraw your consent at any time via the cookie settings on our website.

For full details, see our separate Cookie Policy.

7. How We Share Your Data

We do not sell your personal data. We share data with the following categories of recipients, all bound by appropriate data processing agreements (DPAs) where applicable:

7.1 Internal team and contractors

• Employees and freelance contractors of Lux Photo Pro (photographers, videographers, retouchers, sales managers, producers, video editors, SMM managers, marketing managers).
• All contractors are bound by confidentiality agreements and, where they process personal data on our behalf, by Data Processing Agreements (DPAs) as required by Article 28 GDPR.
• Some contractors are based outside the European Economic Area (specifically in the United Kingdom, Switzerland, Ukraine, and Kazakhstan) — see Section 8 on international data transfers.

7.2 Service providers (data processors)

7.3 Other recipients

• Tax authorities and accountants — to fulfil legal accounting and tax obligations in Luxembourg.
• Legal advisors — when necessary to defend or assert legal claims.
• Public authorities — only when required by valid legal request.
• Successors in business — in case of merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, with prior notice.

8. International Data Transfers

Some of our processors and contractors are located outside the European Economic Area (EEA), specifically in the United Kingdom, Switzerland, Ukraine, Kazakhstan, United States, Canada, and (via TikTok) China.

For transfers outside the EEA, we rely on the following safeguards:

• Adequacy decisions of the European Commission for transfers to the United Kingdom, Switzerland, and Canada (commercial organisations) — which means these countries are deemed to provide an adequate level of data protection.
• Standard Contractual Clauses (SCC) approved by the European Commission for transfers to the United States, Ukraine, Kazakhstan, and other non-adequate jurisdictions.
• Supplementary technical and organisational measures (such as encryption, access controls, and contractual restrictions) where required, particularly following the Schrems II judgment of the Court of Justice of the European Union for transfers to the United States.

For data transfers to TikTok, we acknowledge that data may be accessed from China. By giving consent to TikTok advertising cookies, you accept this transfer in accordance with Article 49(1)(a) GDPR.

You may request a copy of the safeguards applied to international transfers by contacting us at info@luxphotopro.com.

9. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes described in this Policy, or as required by law.

After the applicable retention period, data is either deleted or anonymised.

10. Photo Subjects — Use of Your Image

Photography and videography by their nature involve the processing of image data of identifiable individuals. We treat the rights of photo subjects with special care.

10.1 Use within the contracted scope

By contracting our services, you (and any other adult subjects you bring to the shoot) consent to being photographed/recorded for the purposes specified in your service agreement. Final deliverables are provided to you or to the contracting client.

10.2 Use for portfolio, social media, and advertising

We may use selected photographs and video footage in:

• Our online portfolio at luxphotopro.com;
• Our social media channels (Instagram, Facebook, TikTok, YouTube, LinkedIn);
• Paid advertising campaigns (Meta Ads, Google Ads, TikTok Ads);
• Educational and marketing materials of Lux Photo Club.

Such use requires your separate, explicit consent, given through a Photo Release clause in your service contract or via a separate consent form. You may refuse such use without affecting the delivery of your contracted services.

10.3 Withdrawal of consent

You may withdraw your consent for marketing use of your image at any time by emailing info@luxphotopro.com. Upon withdrawal, we will:

• Remove the relevant content from our website and our social media within 30 days;
• Cease using the content in active advertising campaigns;
• Note that we cannot guarantee removal of content already downloaded, screenshotted, or shared by third parties.

11. Children’s Data

We sometimes photograph children, including in family sessions, weddings, and events.

For any photo subject under 18 years old:

• We require explicit written consent from a parent or legal guardian for the shoot itself;
• For any use of a child’s image in our portfolio, social media, or advertising, we require separate explicit consent from the parent or legal guardian;
• We do not use images of children for behavioural advertising or profiling purposes.

If you are a parent or guardian and wish to withdraw consent for the use of your child’s image, please contact info@luxphotopro.com.

12. Your Rights Under GDPR

You have the following rights regarding your personal data:

1. Right of access (Art. 15) — request a copy of the personal data we hold about you.
2. Right to rectification (Art. 16) — request correction of inaccurate or incomplete data.
3. Right to erasure / “right to be forgotten” (Art. 17) — request deletion of your data, subject to legal retention obligations.
4. Right to restriction of processing (Art. 18) — request that we limit how we use your data in certain circumstances.
5. Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format.
6. Right to object (Art. 21) — object to processing based on legitimate interest, including direct marketing.
7. Right to withdraw consent (Art. 7(3)) — withdraw any consent you have given, at any time, without affecting the lawfulness of prior processing.
8. Right not to be subject to automated decision-making (Art. 22) — we do not make automated decisions with legal or significant effects.

How to exercise your rights

Send a request to info@luxphotopro.com with a clear description of your request and proof of identity (to prevent unauthorised access).

We will respond within one month of receipt of the request. In complex cases, this period may be extended by up to two further months, in which case we will inform you.

There is no fee for exercising your rights, except in cases of manifestly unfounded or excessive requests.

Right to lodge a complaint

If you believe your rights have been violated, you have the right to lodge a complaint with the Luxembourg data protection authority:

Commission nationale pour la protection des données (CNPD)

15, Boulevard du Jazz

L-4370 Belvaux, Luxembourg

Phone: +352 26 10 60 -1

Website: https://cnpd.public.lu

13. Marketing and Retargeting

We use online advertising, including retargeting through Meta (Custom Audiences, Lookalike Audiences), Google Ads, and TikTok Ads. This means that after visiting our website, you may see our advertisements on social media and other websites.

Retargeting is performed using:

• Cookies and pixel tracking on our website (only with your consent);
• Hashed email addresses uploaded to advertising platforms for matching with their user base (only when we have a legal basis to do so).

You can opt out of retargeting at any time:

• By withdrawing your cookie consent on our website;
• Via the privacy settings of Meta (https://www.facebook.com/settings?tab=ads), Google (https://adssettings.google.com), and TikTok;
• Via industry opt-out tools such as https://www.youronlinechoices.eu.

14. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• HTTPS encryption for all website traffic;
• Access controls and authentication for internal systems (CRM, file storage);
• Limited access on a need-to-know basis;
• Confidentiality and data processing agreements with all contractors and service providers;
• Regular backups and secure storage of photographic deliverables on our studio server and authorised cloud services;
• Periodic review of security practices.

Despite our efforts, no method of transmission or storage is 100% secure. In the event of a personal data breach affecting your rights, we will notify the CNPD within 72 hours and inform affected individuals where required by Article 34 GDPR.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The updated version will be posted on this page with a revised “Last updated” date.

For material changes that significantly affect your rights, we will notify you by email (where we have your address) or through a prominent notice on our website.

We recommend reviewing this Policy periodically.

16. Contact

For any questions, requests, or concerns related to this Privacy Policy or how we process your personal data:

LUX PHOTO PRO S.à r.l.-S

Attn: Andre Mitin — Privacy Contact

13 Avenue Gaston Diderich

L-1420 Belair, Luxembourg

Email: info@luxphotopro.com

Phone: +352 691 773 777

This Privacy Policy is governed by the laws of the Grand Duchy of Luxembourg. Any disputes related to data protection shall be subject to the jurisdiction of the courts of Luxembourg, without prejudice to your right to lodge a complaint with the CNPD or any other competent supervisory authority.