Privacy Policy

Last updated: 19 May 2026

1. Who we are

This Privacy Policy explains how Duarte Dellarole ("we", "us", "our", or "the Photographer") collects, uses, stores and protects the personal data you provide when you visit, contact or hire us through the website www.duartedellarole.com (the "Website").

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR") and Portuguese Law No. 58/2019, we act as the Data Controller of your personal data.

Our details:

Name / Legal entity: DUARTE DELLAROLE-PHOTO AND VIDEO UNIPESSOAL LDA
Tax identification number: 515754897
Registered address: Rua Garcia de Orta, nº 10, 1º B, 2780-113 Portugal

Email: duarte@duartedellarole.com

We are not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. For any data protection matter, please contact us using the details above.

2. What personal data we collect

We only collect the personal data we need to respond to enquiries, deliver our services, comply with legal obligations and improve the Website. We collect data in the following ways:

2.1 Information you provide directly

When you submit our contact form ("Let's plan your shoot"), email us, or otherwise communicate with us, we may collect:

Full name
Email address
Company or property name
Location of the shoot
Preferred shoot dates
Project type and brief description of your project
Any additional information you choose to share

2.2 Information collected automatically

When you visit the Website, our hosting provider and analytics tools may automatically collect:

IP address (anonymised where applicable)
Browser type and version
Operating system and device type
Approximate geographic location (country / city level)
Pages visited, time spent and referring URL
Cookies and similar technologies

2.3 Information from third parties

If you contact us through social media (Instagram, LinkedIn, YouTube, Facebook) or via referrals, we may receive limited profile information from those platforms in accordance with their own privacy policies.

We do not knowingly collect special categories of personal data (e.g. health, religion, political opinions). Please do not include such information when contacting us.

3. Why we use your personal data and our legal basis

Under the GDPR, every processing activity must have a lawful basis. We process your data for the following purposes:

Purpose	Legal basis (Art. 6 GDPR)
Responding to your enquiry and preparing a proposal	Pre-contractual measures at your request (Art. 6(1)(b))
Delivering the photography / videography services agreed	Performance of a contract (Art. 6(1)(b))
Invoicing, accounting and tax compliance	Legal obligation (Art. 6(1)(c))
Sending occasional newsletters or updates (only if you opt in)	Consent (Art. 6(1)(a))
Website analytics, performance and security	Legitimate interest (Art. 6(1)(f)) - to operate and improve the Website
Defending or exercising legal claims	Legitimate interest / legal obligation (Art. 6(1)(f) / (c))

You can withdraw your consent at any time where consent is the legal basis (e.g. newsletter), without affecting the lawfulness of processing carried out before withdrawal.

We do not sell or rent your personal data. We may share it with the following categories of recipients, strictly for the purposes described above:

Hosting provider
Analytics provider

All processors we engage are bound by data processing agreements (DPAs) compliant with Article 28 GDPR.

5. International transfers

Some of the processors we use may be based outside the European Economic Area (EEA), in particular in the United States. Where this is the case, we ensure that adequate safeguards are in place, namely:

The processor is covered by the EU–US Data Privacy Framework, or
We have signed the Standard Contractual Clauses (SCCs) approved by the European Commission, or
Another lawful transfer mechanism under Chapter V GDPR.

You may request a copy of the relevant safeguards by contacting us at duarte@duartedellarole.com

6. How long we keep your data

We retain personal data only for as long as necessary for the purpose it was collected, taking into account legal, accounting and reporting requirements:

Contact form enquiries that do not result in a contract: up to 12 months
Client project files and correspondence: for the duration of the project plus 10 years (legal requirement for accounting documentation under Portuguese law)
Website analytics data: as per the retention settings of our analytics provider - typically 14 to 26 months

When the retention period expires, data is securely deleted or anonymised.

You have the following rights in relation to your personal data:

Right of access (Art. 15) - obtain a copy of the data we hold about you
Right to rectification (Art. 16) - correct inaccurate or incomplete data
Right to erasure ("right to be forgotten", Art. 17) - request deletion where applicable
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20) - receive your data in a structured, machine-readable format
Right to object (Art. 21) - including objection to processing based on legitimate interests
Right not to be subject to automated decision-making (Art. 22) - we do not carry out any such processing
Right to withdraw consent (Art. 7) - at any time, where consent is the legal basis

How to exercise your rights

Send your request by email to duarte@duartedellarole.com with the subject line "GDPR - [right you wish to exercise]". We may ask you to verify your identity before responding. We will reply within one (1) month of receipt, extendable by a further two months for complex requests (in which case we will inform you within the first month).

Exercising your rights is free of charge, unless the request is manifestly unfounded or excessive.

Right to lodge a complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Portuguese Data Protection Authority - Comissão Nacional de Proteção de Dados (CNPD):

Website: www.cnpd.pt

Address: Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, Portugal

Email: geral@cnpd.pt

You may also lodge a complaint with the supervisory authority of your country of residence within the EEA.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include:

Encrypted connections (HTTPS / TLS) across the entire Website
Strong, unique passwords and multi-factor authentication on our work accounts
Reputable, GDPR-compliant providers for hosting, email and storage
Access to client data limited strictly to the Photographer
Regular backups and software updates

No system is 100% secure. If a data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the CNPD without undue delay, as required by Articles 33 and 34 GDPR.

9. Children's privacy

The Website and our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe that we have collected such data, please contact us and we will delete it promptly.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the law, in our practices, or in the technologies we use. The "Last updated" date at the top of this page indicates the most recent revision.

For material changes, we will provide a more prominent notice on the Website and, where appropriate, contact you directly. We encourage you to review this page periodically.

11. Contact us

For any question, comment or concern regarding this Privacy Policy or our processing of your personal data, please contact us at:

DUARTE DELLAROLE-PHOTO AND VIDEO UNIPESSOAL LDA; Rua Garcia de Orta, nº 10, 1º B, 2780-113 Portugal; Email: duarte@duartedellarole.com