Privacy Policy

The data controller responsible for your personal data is:

Veritiefx Photography, Chirpan, Bulgaria — Data Protection Contact: dpa@veritiefx.com

References to “Veritiefx”, “we”, “us”, or “our” in this Privacy Policy refer to the sole trader or legal entity operating the Veritiefx Photography brand.

This Website is intended solely for persons located within the European Union. We do not knowingly collect personal data from persons located outside the EU. If you are accessing this Website from outside the EU, including from the United States of America (including the State of California), the United Kingdom, or any other non-EU jurisdiction, please exit the Website immediately. This Privacy Policy does not confer any rights under non-EU data protection frameworks, including but not limited to the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), or the UK GDPR.

2.1 Application Data — When you submit a modelling application, we collect the following information:

• Full name
• Town or city of residence
• Whether you are able to travel to Chirpan
• Email address
• Mobile telephone number
• Facebook profile URL (optional)
• Instagram profile URL (optional)
• Portfolio link (optional)
• Headshot photograph
• Full-body photograph
• Any additional information you voluntarily provide

2.2 Automatically Collected Data — When you visit the Website, we and our third-party service providers automatically collect technical and usage data, including:

• IP address
• Browser type, version, and language
• Device type and operating system
• Pages visited, time spent, and navigation path
• Referring URL
• Cookies and similar tracking technologies (see Section 7)

We process your personal data on the following legal bases under Article 6 of the GDPR:

• Consent (Article 6(1)(a)): Where you have ticked the consent checkbox on the application form or where we rely on your explicit consent to use cookies and tracking technologies.
• Legitimate interests (Article 6(1)(f)): To operate and improve the Website, prevent fraud, and ensure site security, where these interests are not overridden by your rights.
• Contract performance (Article 6(1)(b)): To process your application and arrange photography sessions where an application is accepted.

Where we process special-category data (e.g., photographs from which your identity is apparent), we rely on your explicit consent under Article 9(2)(a) GDPR.

We use the personal data we collect for the following purposes:

• To review and respond to your modelling application.
• To arrange and manage photography sessions with selected applicants.
• To communicate with you about your application or session.
• To deliver agreed Portfolio Images following a session.
• To operate, maintain, and improve the Website and our services.
• To measure the performance of advertising campaigns and content (via analytics and pixel technologies — see Section 7).
• To comply with our legal obligations.

5.1 Analytics & Advertising Technology — To improve our services and measure the delivery and effectiveness of advertisements, we use the following third-party tools. These tools may set cookies or similar tracking technologies on your device and may process your personal data on our behalf.

• Google Analytics (Google Ireland Limited, Dublin, Ireland): used to analyse Website traffic and usage patterns. Data may be processed by Google LLC in the United States under Standard Contractual Clauses. https://policies.google.com/privacy
• Meta Pixel (Meta Platforms Ireland Limited, Dublin, Ireland): used to measure the effectiveness of advertising on Meta's platforms (Facebook and Instagram), to build audiences, and to improve ad targeting. Data may be processed by Meta Platforms, Inc. in the United States under Standard Contractual Clauses. https://www.facebook.com/privacy/policy/
• Other analytics, advertising, and service-improvement tools that we may implement from time to time.

5.2 Hosting & Infrastructure — Your data is stored on secure servers operated by our hosting and infrastructure providers, bound by data processing agreements consistent with GDPR requirements.

5.3 No Sale of Personal Data — We do not sell your personal data to third parties.

Some third-party service providers (including Google LLC and Meta Platforms, Inc.) are based in or process data in the United States and other countries outside the EEA. Such transfers take place on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46 GDPR, and/or an adequacy decision by the European Commission, where applicable.

This Website uses cookies and similar tracking technologies including pixels, web beacons, and local storage.

• Strictly necessary cookies: Required for the Website to function. These cannot be disabled.
• Analytics cookies: Used to collect information about how visitors use the Website (e.g., Google Analytics).
• Advertising and measurement cookies: Used to measure the delivery and effectiveness of advertisements (e.g., Meta Pixel).

By using this Website, you consent to the use of analytics, advertising, and measurement cookies as described. You may manage or delete cookies through your browser settings at any time; doing so may affect certain Website functionality.

• Application data for unsuccessful applicants: Retained for up to 12 months from submission, then securely deleted.
• Application and session data for accepted applicants: Retained for the duration of the working relationship and up to 3 years thereafter.
• Website usage and analytics data: Retained per the third-party tool's settings (typically 14 months for Google Analytics).

Where you withdraw consent or exercise your right to erasure, we will delete your data within 30 days of a verified request, subject to any overriding legal obligation.

As a data subject under the GDPR, you have the following rights:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / “right to be forgotten” (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to withdraw consent (Article 7(3))

To exercise any of these rights, please email dpa@veritiefx.com with your full name and the email used to submit your application. We will respond within one calendar month of a verified request (Article 12(3) GDPR).

You also have the right to lodge a complaint with the Commission for Personal Data Protection (КЗЛД) — https://www.cpdp.bg — 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria — kzld@cpdp.bg.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure, in accordance with Article 32 GDPR, including encrypted data transmission (HTTPS), access controls, and secure storage practices.

No method of transmission over the internet is completely secure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected data subjects in accordance with Articles 33 and 34 GDPR.

Where an application is submitted in respect of a person under 18, the parent or legal guardian confirms they have authority to provide and consent to the processing of the minor's personal data. Such data is treated with particular care and is not processed beyond the purposes described without additional explicit consent.

We may update this Privacy Policy from time to time. Material changes will be notified by updating the effective date and, where practicable, by a prominent notice on the Website. Continued use of the Website constitutes acceptance of any updated Privacy Policy.

All data protection and privacy queries should be directed to: Veritiefx Photography — Email: dpa@veritiefx.com