Legal
Privacy & cookie policy
Last updated: 3 October 2026
This policy explains what personal data is collected through framedbykaterina.com and through the sessions booked on it, why, who receives it, and what your rights are. It follows the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Greek Law 4624/2019 and, for cookies, Article 4(5) of Greek Law 3471/2006.
Who is responsible for your data
The data controller is Aikaterini Seirli (Σεΐρλη Αικατερίνη), a sole trader working as Framed by Katerina, Tax ID (ΑΦΜ) 167935800, Tax Office (ΔΟΥ) of Attica, based in Nikaia, Attica, Greece.
For anything about your data, write to info@framedbykaterina.com or call +30 697 683 9814.
What is collected, why, and on what basis
| What | Why | Legal basis (GDPR art. 6(1)) |
|---|---|---|
| Contact form: your name, email, the occasion you pick and your message | To answer your enquiry and prepare a quote | Steps you ask for before a contract (b) |
| Booking (on Cal.com): name, email, the session address, your answers to the booking questions, the estimate and any notes | To schedule and carry out the session | Contract (b) |
| Deposit (on Stripe): card details are entered on Stripe and never reach us; we see your name, the amount and the last four digits of the card | To take the €50 deposit and keep accounting records | Contract (b); legal obligation under Greek tax law (c) |
| Photographs taken during your session | To edit and deliver your gallery | Contract (b) |
| Photographs used in the portfolio or on social media | To show my work | Your consent (a), asked separately and withdrawable at any time |
| Analytics and advertising cookies (Google Analytics, Google Ads) | To count visits and measure how ads perform | Your consent (a), given on the cookie banner |
| Technical data (IP address, browser, pages requested) logged by the hosting provider | To deliver the site and keep it secure | Legitimate interest in a secure, working website (f) |
You do not have to give any of this, but without an email address I cannot reply, and without the booking details I cannot hold a date. No decision about you is made by automated means, and nobody is profiled.
Who receives it
Your data is never sold or rented. It is shared only with the providers below, which process it on my behalf and under their data processing terms, and with authorities where the law requires it.
- Cloudflare, Inc.: website hosting and security
- Plus Five Five, Inc. (Resend): delivers contact form messages to my inbox
- Cal.com, Inc.: booking calendar
- Stripe Payments Europe, Ltd.: deposit payments
- Google Ireland Ltd.: Google Analytics and Google Ads, only if you accept cookies
- My accountant: invoices and payment records, for tax purposes
Transfers outside the EU
Cloudflare, Resend, Cal.com and Google may process data in the United States. Those transfers rely on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the Commission’s Standard Contractual Clauses.
How long it is kept
- Enquiries that do not become a booking: up to 12 months after our last message.
- Booking, invoice and payment records: as long as Greek tax law requires, generally five years from the end of the tax year they belong to.
- [DRAFT — review] Your session photographs: a backup is kept for 12 months after delivery, so a lost gallery can be sent again, then deleted. Photographs you agreed to show in the portfolio stay there until you withdraw that consent.
- Google Analytics data: 14 months, then deleted by Google.
- Your cookie choice: 180 days, whether you accepted or rejected.
Your rights
You can ask to see the data held about you, to correct it, to delete it, to restrict its use, to receive it in a portable format, and to object to its use. Where something relies on your consent, you can withdraw it at any time; that does not make earlier use unlawful.
Email info@framedbykaterina.com and you will have an answer within one month. If you think your data has been mishandled, you can also complain to the Hellenic Data Protection Authority, Kifisias 1–3, 115 23 Athens, www.dpa.gr.
Changes to this policy
If this policy changes, the new version is published here with a new date at the top.