I. Privacy and Data Protection Policy
In compliance with current legislation, Graciela Vilagudín Photography (hereinafter referred to as “the Website”) is committed to adopting the necessary technical and organizational measures appropriate to the level of security required by the risk associated with the personal data it processes.
Applicable Laws
This Privacy Policy is adapted to current Spanish and European regulations on the protection of personal data on the internet, specifically:
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
Organic Law 3/2018 of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).
Royal Decree 1720/2007 of 21 December, approving the Regulation implementing Organic Law 15/1999 on the Protection of Personal Data (RDLOPD).
Law 34/2002 of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).
Identity of the Data Controller
Data Controller: Graciela Vila Gudín
NIF/CIF: 33345907R
Address: Calle Andrés Muruais, 9, 2º, Pontevedra (36001), Spain
Phone: +34 653 12 59 61
Email: hola@gracielavilagudin.com
Registration of Personal Data
In compliance with the GDPR and the LOPD-GDD, the personal data collected by Graciela Vilagudín Photography through forms on its website will be incorporated into a file for the purpose of facilitating, expediting, and fulfilling commitments established between Graciela Vilagudín Photography and the user, or to maintain the relationship established through the forms, or to respond to a request or inquiry.
Unless an exception in Article 30.5 of the GDPR applies, a record of processing activities is maintained specifying the purposes and conditions of the data processing.
Principles Governing Personal Data Processing
The processing of users’ personal data will comply with the following principles established in Article 5 of the GDPR and Article 4 of Organic Law 3/2018:
Lawfulness, fairness, and transparency: User consent will always be required after providing transparent information about the purposes of data collection.
Purpose limitation: Personal data will be collected for specific, explicit, and legitimate purposes.
Data minimization: Only the data strictly necessary for the stated purposes will be collected.
Accuracy: Data must be accurate and kept up to date.
Storage limitation: Data will be stored only as long as necessary for the purposes of processing.
Integrity and confidentiality: Data will be processed in a manner that ensures appropriate security and confidentiality.
Accountability: The data controller is responsible for ensuring compliance with these principles.
Categories of Personal Data
The categories of data processed by Graciela Vilagudín Photography are limited to identifying information. No special categories of personal data, as defined in Article 9 of the GDPR, are processed.
Legal Basis for Processing
The legal basis for processing personal data is consent. Graciela Vilagudín Photography undertakes to obtain express and verifiable consent from users before processing their personal data for specific purposes.
Users may withdraw their consent at any time. Withdrawal will be as easy as granting consent, and it will not affect the lawful processing carried out before withdrawal.
Where data is requested via forms, users will be informed which fields are mandatory.
Purposes of Data Processing
Personal data is collected and managed by Graciela Vilagudín Photography to facilitate, manage, and maintain the commitments or relationships established through its website forms, and to respond to user inquiries or requests.
Data may also be used for commercial and analytical purposes, such as personalization, statistics, marketing studies, and to improve website content and usability.
At the time of collection, users will be informed of the specific purposes of processing.
Retention Period
Personal data will be retained only as long as necessary for the purposes of processing, and in any case, for a maximum of 36 months or until the user requests deletion.
Users will be informed of the specific retention period or criteria used to determine it at the time of collection.
Recipients of Personal Data
User data will not be shared with third parties except when required by law or with the user’s explicit authorization.
Service providers that may process data on behalf of the controller include:
Google Analytics (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
Dinahosting (Rúa das Salvadas, 41, 15705 – Santiago de Compostela, Spain)
If personal data is to be transferred to a third country or international organization, users will be informed in advance.
Personal Data of Minors
In accordance with Article 8 of the GDPR and Article 7 of Organic Law 3/2018, only individuals aged 14 or older may lawfully give consent for data processing by Graciela Vilagudín Photography.
For minors under 14, consent from a parent or legal guardian is required.
Confidentiality and Security
Graciela Vilagudín Photography undertakes to implement the technical and organizational measures necessary to ensure the security of personal data and to prevent accidental or unlawful destruction, loss, alteration, unauthorized access, or disclosure.
The Website uses an SSL (Secure Socket Layer) certificate to ensure that personal data is transmitted securely and in encrypted form.
Although no internet system is entirely secure, the controller will notify users promptly of any data breach that may compromise their rights and freedoms.
Personal data will be treated confidentially, and this obligation extends to all persons authorized to access it.
User Rights
Under the GDPR and Organic Law 3/2018, users have the following rights:
Right of access: To know whether personal data is being processed and to obtain details about the processing.
Right of rectification: To correct inaccurate or incomplete personal data.
Right of erasure (“right to be forgotten”): To request deletion of personal data when no longer necessary or when legally appropriate.
Right to restriction of processing: To request limitation of processing under certain circumstances.
Right to data portability: To receive personal data in a structured format and transmit it to another controller.
Right to object: To object to the processing of personal data.
Right not to be subject to automated decision-making: To avoid decisions based solely on automated processing, including profiling.
Requests to exercise these rights must include:
Full name and a copy of ID (or representative’s ID, if applicable).
A clear description of the request.
A contact address for notifications.
Date, signature, and supporting documentation (if applicable).
Requests may be sent to:
Address: Calle Andrés Muruais, 9, 2º, Pontevedra (36001), Spain
Email: hola@gracielavilagudin.com
Links to Third-Party Websites
The Website may include links to third-party websites with their own privacy policies. Graciela Vilagudín Photography is not responsible for the content or privacy practices of those websites.
Complaints
If users believe that their data protection rights have been violated, they have the right to file a complaint with the competent supervisory authority, particularly in their place of residence, work, or where the infringement occurred.
In Spain, the competent authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD): https://www.aepd.es
II. Acceptance and Changes to This Privacy Policy
Users must read and agree to this Privacy Policy before providing personal data. Use of the Website implies acceptance of its terms.
Graciela Vilagudín Photography reserves the right to modify this Privacy Policy for legal, technical, or regulatory reasons. Users are advised to review this page periodically.
This Privacy Policy was last updated in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights.