Privacy in the client portal
Controller
Emina Huremović, LiZa Memories Photography, Mela-Spira-Straße 32b, 8054 Graz, Austria. Privacy contact: info@liza-memories-photography.com.
Access and data
The portal processes your name, email address, protected credentials, gallery assignments, photos, favourites, assigned invoice PDFs and order, payment-status and release data. Limited security data helps restrict sign-in attempts and record administrative actions. Passwords are stored as salted hashes and are not sent by email. Setup and reset links are valid for 30 minutes and can be used once.
Purposes and legal grounds
Access, galleries, image selection, ordering, delivery and related messages serve the contract or pre-contractual steps (Article 6(1)(b) GDPR). Required order records are retained to comply with legal duties (c). Technical connection data, limited security records and access protection serve our legitimate interest in a secure portal (f). Using the portal does not constitute consent to advertising or publishing your photos.
Hosting and private photo storage
Cloudflare Pages and Workers, provided by Cloudflare, Inc., deliver the portal. The D1 database stores accounts, protected credentials, gallery assignments, favourites, orders, releases and limited security data. Previews, original photos and assigned invoice PDFs are kept in private R2 storage with EU jurisdiction and delivered after access checks. Cloudflare also processes IP addresses, requested files, timestamps and technical connection data to provide and secure the service. EU jurisdiction for photo storage does not mean all portal and provider data is processed exclusively in the EU.
Cloudflare privacy policy · Cloudflare data processing terms
Email delivery with Resend
We send invitations, setup and reset links, order confirmations with invoices attached where provided, download-release messages and withdrawal acknowledgements from info@liza-memories-photography.com using Resend (Plus Five Five, Inc.). Resend processes recipients’ email addresses, names where included, message content including invoice attachments and delivery information. The configured sending region is Ireland. According to Resend, message content, delivery logs and account data are stored in the United States regardless of the sending region.
Resend privacy policy · Resend data processing terms · Resend storage and international transfers
Bank transfer
Orders are paid by bank transfer. Your bank and the receiving bank process the necessary payment data, including names, account details, amount and payment reference, as independent controllers under their privacy notices. We store the order and its payment status in the portal; incoming payments are personally checked and confirmed.
International processing
Cloudflare and Resend may use subprocessors and process data outside the EU/EEA. Their privacy information and data processing terms linked above describe recipients and the providers’ international transfer safeguards, including Standard Contractual Clauses and the EU-US Data Privacy Framework. Contact us at the email address above for questions about safeguards applicable to your data.
Necessary session
The requested sign-in uses a necessary session cookie with a random identifier, protected by HttpOnly, Secure and SameSite. It expires within seven days and the session ends on logout. No advertising trackers or analytics beacons are integrated in the portal. New favourites and started image downloads are shown to gallery administrators with the customer, image and timestamp for up to 90 days. Older activity entries are deleted on the next portal activity request or scheduled cleanup. A started download does not confirm that the file was fully saved on the device.
Retention
We keep photos, galleries and accounts for as long as needed for the agreed availability and necessary contract processing. A displayed gallery expiry limits online access. Statutory retention duties for order records and the establishment, exercise or defence of legal claims may require longer storage. The email provider’s retention also follows its linked information.
Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction, portability and, where applicable, object. You may withdraw consent for the future. Contact info@liza-memories-photography.com for privacy requests. You may complain to the Austrian Data Protection Authority. See the main privacy policy for further details.