Andre Blunt Photography

Privacy Policy

Last updated: 11 July 2026

This policy explains what personal data we collect when you use photo.andreblunt.com, why we collect it, who we share it with, and the rights you have over it. We have tried to write it in plain language. If anything is unclear, write to us and we will explain.

1. Who we are

The site photo.andreblunt.com is operated by Andre Blunt Kft(“we”, “us”, “Andre Blunt Photography”). We are the data controller for the personal data described here, which means we decide why and how it is processed.

• Company: Andre Blunt Kft
• Registered address: József körút 69. Fsz. 1. ajtó, 1085 Budapest, Hungary
• Company registration number: 01-09-451918
• EU VAT number: HU32967656
• Contact for privacy questions: photo@andreblunt.com

2. What we collect

We keep data collection to a minimum. Depending on how you use the site, we may process:

Information you give us through the inquiry form

• Your name
• Your email address
• An optional message or project brief (anything you choose to type in)

Information collected automatically

• Basic, aggregated traffic data through Vercel Analytics (for example, which pages are viewed and roughly where visits come from). This is cookieless and is not used to identify you. See section 5.
• If, and only if, you accept marketing cookies: data collected by the Meta Pixel about your visit, used for advertising measurement and retargeting. See section 6.

Information you give us if you book a session

If we agree to work together, we collect what we need to arrange and deliver your session: the details on your booking and invoice (for example your name, billing details, and the date and location of the shoot) and, once your images are ready, an account on our own client-gallery platform so you can view, select, and download your private gallery. We host this ourselves now and no longer use Pixieset. Where this data sits, and who helps us run it, is set out in sections 4 and 8.

We do not ask for special-category data (health, religion, and so on). Please do not send it through the form.

3. Why we process it and our lawful basis

Under the General Data Protection Regulation (GDPR), every use of your data needs a lawful basis. Here is ours.

Where the basis is consent, you can withdraw it at any time (see section 9). Withdrawing consent does not affect anything we did lawfully before you withdrew it.

4. Who we share it with (our processors and partners)

We do not sell your data. We share it only with the service providers we need to run the studio, and only for the purposes above. Each is bound by its own data terms.

5. Analytics (cookieless)

We use Vercel Analytics to count visits and see which pages are used. It does not use cookies and does not build a profile of you. Visitors are counted using a temporary hash derived from the request, not a stored identifier, and the session data is discarded within 24 hours. Because it does not identify you, it runs without a consent banner and relies on our legitimate interest (section 3).

6. Cookies and the Meta Pixel (consent-gated)

The site does not load advertising or tracking cookies by default.

The Meta Pixel loads only after you give explicit consent through the cookie banner. If you do nothing, or decline, the Pixel does not run and no data goes to Meta. If you accept, the Pixel fires standard events (a PageView when you load a page, and a Lead event when you submit the inquiry form) and shares that activity with Meta Platforms Ireland for advertising measurement and retargeting.

You can change your mind at any time:

• Use the cookie settings on the site to withdraw consent, which stops the Pixel from loading on future visits.
• Clear cookies in your browser to remove what is already stored.
• Manage ad personalisation in your Meta account settings.

7. How long we keep it

We keep personal data only as long as we need it.

• Inquiries that do not become a booking: kept while we are in contact and for a reasonable period afterward, then deleted, and in any case within 24 months of our last contact.
• Bookings and client work: kept for the duration of the engagement and for as long as we are required to keep related business records. Hungarian tax and accounting law requires retention of accounting documents for 8 years; records tied to an invoice are kept for that period.
• Client galleries: your private gallery stays available for the window set out in our Terms (currently 6 months from delivery), after which it is archived and access is closed. Invoice records tied to the booking are kept for the 8 years noted above.
• Analytics: aggregated and short-lived, as described in section 5.
• Meta Pixel data: retained by Meta under its own retention rules.

When a retention period ends, we delete or anonymise the data.

8. Sending data outside the EU

Some of our providers are based in, or transfer data to, the United States. Where that happens, the transfer is protected by recognised safeguards. Our client-gallery database and the image objects behind it sit in the EU, so that data is not routinely sent outside it:

• Resend is certified under the EU-US Data Privacy Framework and also uses Standard Contractual Clauses.
• Vercel relies on Standard Contractual Clauses, and the EU-US Data Privacy Framework where applicable.
• Cloudflare is a US company, certified under the EU-US Data Privacy Framework, and uses Standard Contractual Clauses. The image objects for our client galleries in Cloudflare R2 are stored in the EU.
• Supabase runs our client-gallery database in the EU (Frankfurt), so your gallery account and gallery details reside in the EU and are not transferred out of it at rest. Where Supabase staff access the service from the United States for support, that access is covered by Standard Contractual Clauses.
• Stripe (session deposits) is certified under the EU-US Data Privacy Framework and uses Standard Contractual Clauses for transfers to the United States.
• Meta(only if you consent to the Pixel) is a separate controller, not our processor. Its transfers to the United States are covered by Meta’s own EU-US Data Privacy Framework certification and Standard Contractual Clauses, which we do not warrant.

You can ask us for more detail on any of these safeguards using the contact in section 1.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and get a copy.
• Rectification of data that is wrong or incomplete.
• Erasure of your data (“right to be forgotten”) where there is no overriding reason to keep it.
• Restriction of processing in certain cases.
• Object to processing based on our legitimate interest, including any analytics.
• Withdraw consent at any time where we rely on consent (for example, the Meta Pixel), without affecting processing done before you withdrew it.
• Data portability, where it applies, to receive your data in a portable format.

To exercise any of these, email photo@andreblunt.com. We will respond within one month. There is normally no charge.

Complaints. If you think we have mishandled your data, we would like the chance to put it right, so please contact us first. You also have the right to lodge a complaint with the Hungarian supervisory authority:

National Authority for Data Protection and Freedom of Information (NAIH)

Nemzeti Adatvédelmi és Információszabadság Hatóság

Address: H-1055 Budapest, Falk Miksa utca 9-11, Hungary

Postal address: 1363 Budapest, Pf. 9

Phone: +36 (1) 391-1400

Email: ugyfelszolgalat@naih.hu

Web: https://www.naih.hu

10. Changes to this policy

If we change how we handle data, we will update this page and change the “last updated” date above. For significant changes, we will make the update more visible on the site.

11. Contact

Questions about this policy or your data:

Andre Blunt Kft · photo@andreblunt.com · József körút 69. Fsz. 1. ajtó, 1085 Budapest, Hungary