Privacy policy
Updated: 23 October 2026
1. Controller
Emina Huremović · LiZa Memories Photography
Mela-Spira-Str. 32b, 8054 Graz, Austria
Email: info@liza-memories-photography.com
Phone: +43 681 819 427 80
2. Website delivery and hosting
GitHub Pages, provided by GitHub, Inc., hosts the public website. Delivering and securing the site involves processing IP addresses, requested pages or files, timestamps and technical connection data. The legal basis is our legitimate interest in operating a functional and secure website (Article 6(1)(f) GDPR). Hosting logs follow the provider’s retention rules; we do not assert a specific account-level retention period here.
3. Privacy choice and browser storage
The website itself sets no HTTP cookies for advertising or visitor recognition. Your optional statistics choice is stored as lizaPrivacyConsent in your browser’s LocalStorage. It contains only the version, statistics on/off and expiry date. The choice expires after 180 days. This storage is necessary to respect your decision and is not used as a visitor identifier. Only the voucher checkout additionally uses SessionStorage: a random key and a hash of the entered details prevent duplicate orders when retrying submission. The entry is removed after a successful order and otherwise ends with the browser session; the form details themselves are not stored there.
You can change or withdraw your choice through . Without a choice, statistics remain off. If storage is blocked, the choice applies only to the current page. The former lizaLanguage entry is no longer used; you can remove old entries by clearing website data in your browser. The language follows the DE, EN or BS page address.
4. Optional statistics: Cloudflare Web Analytics
After your consent, the homepages may load Cloudflare Web Analytics, provided by Cloudflare, Inc., to measure visits, loading speed and stability. Its script reads technical browser performance data and sends measurements, page information and, where applicable, referring-page information to Cloudflare. Our website does not send form contents to this analytics service.
According to Cloudflare, Web Analytics is cookie-free, uses no LocalStorage or SessionStorage identifiers and creates no persistent visitor identifier. The IP address inherently received with a network connection is discarded at the nearest data centre and is not stored in core RUM databases or logs, according to the provider. Reports are available for up to six months; this does not describe every other retention period of the company.
We load this optional measurement on the basis of consent (Article 6(1)(a) GDPR; section 165(3) Austrian TKG 2021). Without consent, neither the script nor analytics transmissions are initiated. On withdrawal, analytics are stopped and any page with an active beacon reloads. This does not undo earlier lawful transmissions.
5. Contact form and Formspree
Only when you submit the form are your details sent over HTTPS to Formspree, Inc. These include name, email, phone, photography service and, where provided, date, location, benefit code, gift voucher code, message, package, source page and language. Processing serves your inquiry and potential pre-contractual steps (Article 6(1)(b) GDPR); general communication is based on our legitimate interest (Article 6(1)(f) GDPR).
No Formspree script, CAPTCHA or embed is loaded before submission. Formspree also processes data in the United States. Its privacy policy describes processing, recipients, retention and international transfers. We keep inquiries as long as needed to handle them; statutory duties or legal claims may require longer retention.
6. Private client portal
In the client portal, we process names, email addresses, protected credentials, gallery assignments, photos, favourites, assigned invoice PDFs and order, payment-status and release data. Access, image selection, ordering, delivery and related messages serve the contract or pre-contractual steps (Article 6(1)(b) GDPR). Required order records are retained to comply with legal duties (c). Technical connection data, limited security records and access protection serve our legitimate interest in a secure portal (f). Using the portal does not constitute consent to advertising or publishing your photos.
Cloudflare Pages and Workers, provided by Cloudflare, Inc., deliver the portal. The D1 database stores accounts, protected credentials, gallery assignments, favourites, orders and releases. Previews, original photos and assigned invoice PDFs are kept in private R2 storage with EU jurisdiction and delivered after access checks. Cloudflare also processes IP addresses, requested files, timestamps and technical connection data to provide and secure the service. EU jurisdiction for photo storage does not mean all portal and provider data is processed exclusively in the EU.
We send invitations, setup and reset links, order confirmations with invoices attached where provided, download-release messages and withdrawal acknowledgements from info@liza-memories-photography.com using Resend (Plus Five Five, Inc.). Resend processes recipients’ email addresses, names where included, message content including invoice attachments and delivery information. The configured sending region is Ireland. According to Resend, message content, delivery logs and account data are stored in the United States regardless of the sending region. Cloudflare and Resend may use subprocessors and process data outside the EU/EEA. Their privacy information and data processing terms linked below describe recipients and the providers’ international transfer safeguards, including Standard Contractual Clauses and the EU-US Data Privacy Framework.
Orders are paid by bank transfer. Your bank and the receiving bank process the necessary payment data, including names, account details, amount and payment reference, as independent controllers under their privacy notices. We store the order and its payment status in the portal; incoming payments are personally checked and confirmed.
The requested sign-in uses a necessary session cookie with a random identifier, protected by HttpOnly, Secure and SameSite. It expires within seven days and the session ends on logout. Passwords are stored as salted hashes. Setup and reset links are valid for 30 minutes and can be used once. No advertising trackers or analytics beacons are integrated in the portal. New favourites and started image downloads are shown to gallery administrators with the customer, image and timestamp for up to 90 days. Older activity entries are deleted on the next portal activity request or scheduled cleanup. A started download does not confirm that the file was fully saved on the device.
We keep photos, galleries and accounts for as long as needed for the agreed availability and necessary contract processing. A displayed gallery expiry limits online access. Statutory retention duties for order records and the establishment, exercise or defence of legal claims may require longer storage. Contact info@liza-memories-photography.com for access, rectification, erasure and the further rights described below.
Cloudflare privacy policy · Cloudflare data processing terms · Resend privacy policy · Resend data processing terms · Resend storage and international transfers
7. Gift vouchers and redemption
Voucher purchases process the buyer’s name, email and billing address, order number, language, chosen value, payment status and accepted contract terms. Records also include protected order access, voucher code, credit, reservations, redemptions, booking references and any withdrawal or refund information. These details serve the purchase, delivery and redemption (Article 6(1)(b) GDPR). The required order and contact details are necessary to process an online purchase.
The buyer supplies any optional names and personal greeting printed on the gift. We therefore receive the recipient’s details from the buyer and use them only to personalise and fulfil the gift, on the basis of our legitimate interest in providing that service requested by the buyer (Article 6(1)(f) GDPR). These fields may be left blank or contain a general greeting. The recipient does not receive an automatic email. Please pass these privacy details on when giving the gift. The voucher does not contain the buyer’s billing address.
The purchase takes place in the client portal without requiring a client account. Cloudflare processes the order and provides protected access; Resend sends the order confirmation, voucher PDF and related messages to the buyer, processing the voucher details and PDF attachments included. Provider details, international processing and bank transfers are explained in the client portal section above. The confidential order link gives access to order details and the voucher and should be shared only deliberately.
Contract and payment records are retained to comply with statutory retention duties. Outstanding credit and the data needed to administer it are retained for redemption and fulfilment. Establishing, exercising or defending legal claims may require longer storage. Gallery deletion periods do not apply to voucher balances or required payment records. Buying a voucher does not subscribe you to advertising, and there is no automated decision-making with legal effects. Details of your rights and how to contact us appear below and in the client portal privacy information.
If postal delivery is selected, we also process the recipient’s name, delivery address, delivery fee and dispatch status. The buyer provides the address, which may belong to the gift recipient. The name and address are shared with the postal carrier only for delivery. This fulfils the requested delivery (Article 6(1)(b) GDPR); details of a different recipient are processed based on our legitimate interest in providing the gift delivery requested by the buyer (f). Please inform the recipient about this processing. The delivery address is not printed on the voucher.
8. Fonts, photos and video
Cormorant Garamond and Manrope fonts, images, icons, the video preview and video are delivered locally through our website. Loading fonts does not connect to Google Fonts. There is no YouTube or Vimeo embed and the video does not autoplay.
9. Google, reviews and social media
Google Maps, Google reviews, Instagram and WhatsApp are ordinary links. The review section and Instagram photographs are local content, not widgets or social plugins. Merely loading the page does not load those services as embeds. Clicking a link opens the respective provider, whose privacy information then applies. Search metadata and structured data do not themselves load Google scripts.
10. Local inquiry events
The website may create in-memory events for a confirmed successful form submission and phone or WhatsApp clicks. No additional analytics recipient is currently connected. These events are not stored persistently and contain no names, email addresses or message contents. A contact click or form submission is not a booking confirmation.
11. International processing
The listed providers may process data outside the EU/EEA. Optional analytics consent does not replace any required contractual data protection safeguards. The linked provider policies describe transfer mechanisms and recipients. Contact us for questions about safeguards applicable to your data.
12. Your rights
Subject to the GDPR, you have rights including access, rectification, erasure, restriction, portability and objection. You may withdraw consent for the future and complain to the Austrian Data Protection Authority. Contact us at the email address above for privacy requests.