Privacy Policy — Simão Fonseca

1. Who is responsible

This website is operated by Simão Fonseca (hereafter "I", "me", or "the photographer"). For any privacy-related enquiries, please use the contact form.

2. Data I collect

This is a personal portfolio website. I collect the minimum data necessary to operate it:

Contact form submissions — when you submit the contact form, I collect your name, email address, and message. This data is used solely to respond to your enquiry. Form submissions are handled via Formspree (Formspree, Inc., USA), which acts as a data processor on my behalf. See Formspree's privacy policy.
Hosting logs — the hosting provider (Cloudflare) may log basic access information (IP address, page visited, timestamp) as part of normal server operations. These logs are subject to Cloudflare's privacy policy.

3. What I do NOT collect

No tracking or analytics cookies are set.
No advertising or profiling data is collected.
No data is sold or shared with third parties for marketing purposes.
Fonts and assets are served directly from this website — no external font services (e.g. Google Fonts) are loaded.

4. Legal basis for processing

Contact form data is processed on the basis of Art. 6(1)(b) GDPR — processing necessary for taking steps at your request prior to entering into a contractual arrangement (e.g. a licensing or commission enquiry). Hosting logs are processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) in operating a secure service.

5. Retention

Contact form messages are retained only as long as necessary to fulfil your enquiry and are deleted thereafter. Hosting logs are retained according to Cloudflare's standard retention schedule.

6. Your rights (GDPR)

If you are located in the EU/EEA, you have the right to:

Access — request a copy of the personal data I hold about you.
Rectification — ask me to correct inaccurate data.
Erasure — request deletion of your personal data ("right to be forgotten").
Restriction — ask me to limit how I process your data.
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interest.

To exercise any of these rights, please contact me via the contact form. I will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. As this website is operated from Baden-Württemberg, Germany, the competent authority is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW).

7. Photography copyright

8. Changes to this policy

This policy may be updated occasionally. The "last updated" date at the top of this page indicates when it was last revised.