PRIVACY POLICY

1. Data Controller

The controller responsible for processing personal data collected through this website is:

Data controller: Carlota Armengol Navarro
Trading name: Carlota Armengol Photography
Address: Sulzerallee 59, 8404 Winterthur, Switzerland
Email address: carlotaarmna@gmail.com
Website: https://carlotaarmengol.com/

Carlota Armengol Navarro determines how and for what purposes personal data collected through this website is processed.

2. Applicable Legislation

Personal data is processed in accordance with the applicable Swiss legislation, in particular:

• The Swiss Federal Act on Data Protection, also known as the FADP or DPA.
• The Ordinance on Data Protection.
• Applicable Swiss legislation relating to telecommunications and digital services.

Where applicable due to the user’s place of residence, the services offered, or the scope of the professional activity, the provisions of Regulation (EU) 2016/679, the General Data Protection Regulation, or GDPR, may also apply.

3. Personal Data We Process

The following categories of personal data may be processed through this website:

Data Provided Directly by the User

When a user submits the contact form, sends an email, or communicates with the controller through another channel, the following information may be collected:

• First name and surname.
• Email address.
• Telephone number.
• Company or organisation.
• Information about the requested service.
• Date, location, and details of the photography session or project.
• Content of the message.
• Any other information voluntarily provided by the user.

Users are advised not to send sensitive or specially protected information through the contact form unless it is necessary for the enquiry.

Data Collected Automatically

When browsing the website, certain technical information may be collected, including:

• IP address.
• Device type.
• Operating system.
• Browser type and version.
• Browser language.
• Date and time of access.
• Pages visited.
• Referring page.
• Technical information relating to the website’s operation and security.
• Identifiers stored through cookies or similar technologies.

This information may be collected by the hosting server, content management system, security tools, analytics tools, or third-party services integrated into the website.

4. Purposes of Processing

Personal data may be used for the following purposes:

Responding to Enquiries and Requests

To manage and respond to enquiries submitted through the contact form, email, telephone, or other communication channels.

Preparing Quotations and Proposals

To assess the information provided by the user and prepare quotations, proposals, or information relating to photography sessions and services.

Managing the Professional Relationship

To organise, provide, and manage contracted services, including session planning, client communications, work delivery, invoicing, and follow-up.

Complying with Legal Obligations

To comply with applicable accounting, tax, administrative, and legal obligations.

Ensuring Website Security

To detect misuse, unauthorised access, cyberattacks, spam, fraud, and other activities that may affect the security of the website or its users.

Analysing and Improving the Website

To obtain statistical information regarding website use, performance, and operation in order to improve its content, navigation, and user experience.

Analytics tools that are not strictly necessary will only be used in accordance with the user’s preferences or consent where required.

Displaying External Content

To display content or functionalities provided by third parties, such as maps, videos, fonts, social media content, galleries, forms, or photography delivery platforms.

These services may collect user data and apply their own privacy policies.

5. Grounds for Processing

Personal data may be processed where one of the following grounds applies:

• Processing is necessary to respond to a request made by the user.
• Processing is necessary to prepare, enter into, or perform a contractual relationship.
• Processing is required to comply with a legal obligation.
• There is a legitimate interest related to the management, security, or improvement of the professional activity or website.
• The user has given consent, where consent is required.

Where processing is based on consent, the user may withdraw it at any time. The withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

6. Mandatory Information

Fields marked as mandatory in website forms must be completed in order to submit a request.

If the user does not provide the required information, it may not be possible to respond to the enquiry, prepare a quotation, or provide the requested service.

The user confirms that the information provided is true, accurate, and up to date.

Where the user provides personal data relating to another person, the user must be authorised to do so and must inform that person about this Privacy Policy.

7. Data Retention

Personal data will only be retained for as long as necessary to fulfil the purpose for which it was collected.

As a general rule:

• Enquiries that do not result in a contractual relationship will be retained for the time necessary to respond and conduct reasonable follow-up.
• Client and project data will be retained for the duration of the professional relationship.
• Quotations and business communications may be retained for as long as there is a legitimate professional interest or until the user requests deletion.
• Contracts, invoices, and accounting records will be retained for the periods required under applicable tax, commercial, and accounting legislation.
• Technical and security logs will be retained for the period necessary to ensure website security.
• Data processed on the basis of consent will be retained until consent is withdrawn, unless another lawful reason applies.

Once the applicable retention periods have expired, personal data will be deleted, anonymised, or restricted where it must be retained to address potential legal liabilities.

8. Recipients and Service Providers

Personal data will not be sold or transferred to third parties for commercial purposes.

However, data may be accessed by service providers necessary for the website’s operation and the provision of professional services, including:

• Website hosting and server providers.
• Domain providers.
• Email service providers.
• Form providers.
• Website maintenance and security services.
• Storage and backup services.
• Photography gallery or delivery platforms.
• Analytics tools.
• Invoicing, accounting, and administrative service providers.
• Cloud storage providers.
• Map, video, font, or embedded-content providers.
• Professional collaborators where necessary to provide the contracted service.

These providers may only process data within the scope of their respective functions, in accordance with the controller’s instructions and the applicable contractual and legal obligations.

Personal data may also be disclosed to public authorities, courts, regulators, or other bodies where required by law.

9. International Data Transfers

Some technology providers may store or process personal data outside Switzerland.

Where data is transferred to another country, the controller will take the necessary measures to ensure an appropriate level of protection, including:

• Using providers located in countries recognised by Switzerland as providing an adequate level of data protection.
• Entering into appropriate contractual arrangements.
• Using recognised standard contractual clauses.
• Applying additional technical and organisational safeguards.
• Using recognised international data-protection mechanisms.
• Obtaining the data subject’s consent where required.

The use of certain US-based providers may be covered by the Swiss–US Data Privacy Framework where the provider is validly certified.

Users may request further information about international transfers and the safeguards applied by contacting the controller using the details set out in this Privacy Policy.

10. Cookies and Similar Technologies

This website may use cookies and similar technologies to:

• Enable the technical operation of the website.
• Remember user preferences.
• Protect forms against spam and misuse.
• Analyse website traffic and use.
• Display content provided by external services.
• Integrate social media functionalities.

Strictly necessary cookies may be used to ensure the proper functioning and security of the website.

Analytics, advertising, or third-party cookies that are not strictly necessary will be managed in accordance with applicable law and the preferences expressed by the user.

Further information about the cookies used, their duration, purpose, and providers is available in the corresponding Cookie Policy.

Users can also delete or block cookies through their browser settings, although doing so may affect the operation of certain parts of the website.

11. Forms and Communications

When a user submits a form, the information provided will be used to manage and respond to the request.

Submitting a form does not automatically result in the conclusion of a contract or the user being added to a marketing mailing list.

Newsletters or recurring promotional communications will not be sent without a valid legal basis or the appropriate consent.

Users may request at any time to stop receiving marketing communications by following the procedure indicated in each communication or by contacting the controller.

12. Photographs and Image Rights

In the course of the professional activity, photographs and videos featuring identified or identifiable individuals may be processed.

The processing and publication of such images may be based on:

• The performance of a photography services agreement.
• The consent of the individuals photographed.
• The authorisation of parents, guardians, or legal representatives in the case of minors.
• Specific agreements with clients, models, collaborators, or participants.
• A legitimate interest, where applicable and where the rights of the individuals concerned do not override that interest.
• Any exceptions provided for under applicable law.

Where images are to be used in a portfolio, website, social media, advertising, competitions, publications, or promotional materials, the appropriate authorisation will be obtained where required.

The specific terms relating to the selection, storage, delivery, and publication of photographs may be set out in the relevant contract or release form for each project.

Individuals wishing to request information regarding a published photograph or exercise their rights in relation to it may contact the controller.

Any request to remove an image will be assessed in accordance with applicable law, the consent granted, existing contracts, the photographer’s intellectual property rights, and the rights of the individuals shown.

13. Photographs of Minors

Photographs of minors will be processed with particular care.

Where required, authorisation will be obtained from parents, guardians, or legal representatives before the images are published or used for promotional, commercial, or portfolio purposes.

Authorisation to carry out a photography session does not necessarily include authorisation to publish the photographs. These matters may be governed separately.

14. Social Media

The controller may maintain professional profiles on social media platforms and link to them from this website.

When users interact with these profiles, their personal data may be processed both by the controller and by the relevant social media platform, in accordance with that platform’s terms and privacy policy.

The controller does not have full control over the processing carried out by these platforms. Users are therefore advised to review their privacy policies and security settings.

15. Third-Party Content

The website may integrate third-party services, including:

• Google Maps.
• Videos hosted on external platforms.
• Web fonts.
• Social media.
• External photography galleries.
• Anti-spam tools.
• Analytics services.
• File-storage or delivery platforms.

When such content is loaded, the third-party provider may receive information such as the user’s IP address, device, visited page, or browser identifiers.

Where technically possible and legally required, these services will be blocked until the user provides consent.

16. Data Security

The controller will implement reasonable technical and organisational measures to protect personal data against:

• Unauthorised access.
• Loss or destruction.
• Unlawful alteration.
• Accidental or unlawful disclosure.
• Fraudulent use.
• Cyberattacks.
• Unauthorised processing.

These measures may include encrypted communications, backups, access controls, software updates, and security tools.

However, no internet-connected system can guarantee absolute security.

Where a personal data breach occurs that may create a high risk for the individuals concerned, the notification and response measures required by applicable law will be taken.

17. Rights of Data Subjects

Individuals whose personal data is processed may request, in accordance with applicable law:

• Confirmation as to whether their personal data is being processed.
• Access to their personal data.
• Correction of inaccurate or incomplete data.
• Deletion of personal data where appropriate.
• Restriction of or objection to certain processing activities.
• Delivery or portability of personal data where applicable.
• Withdrawal of consent.
• Information about the source, purpose, and recipients of their personal data.
• Information about international data transfers.
• Human review of automated decisions where applicable.

Requests to exercise these rights should be sent to:

Carlota Armengol Navarro
Sulzerallee 59
8404 Winterthur
Switzerland

Email address: [ADD EMAIL ADDRESS]

The request must clearly specify the right being exercised. Where there are reasonable doubts about the identity of the applicant, additional information may be requested in order to verify their identity.

The exercise of these rights will be free of charge except in the exceptional circumstances permitted by applicable law.

18. Complaints

Users who believe that their personal data has been processed contrary to applicable law may first contact the controller in order to seek a resolution.

They may also submit an enquiry or complaint to the competent Swiss authority:

Federal Data Protection and Information Commissioner — FDPIC
Feldeggweg 1
3003 Bern
Switzerland

Where the GDPR applies, users may also contact the data-protection authority responsible for their place of residence.

19. Automated Decision-Making

As a general rule, no decisions producing legal effects or similarly significantly affecting users are made solely on the basis of automated processing.

If a relevant automated decision-making system is used in the future, the individuals concerned will be informed in advance about how it works and the rights available to them.

20. Amendments to this Privacy Policy

The controller may amend this Privacy Policy to reflect:

• Legislative changes.
• New guidance issued by data-protection authorities.
• Changes to the services offered.
• New website functionalities.
• Changes to the technology providers used.

The version in force will be the version published on the website at any given time.

Where changes are significant, users may be informed through a prominent notice on the website.

Last updated: 15 July 2026.