Privacy Notice

Effective Date: April 6, 2026

1. The Controller

Gustavo Alcalá ("we", "us", or "our") operates the website www.alcala.photography. For the purposes of the Swiss Federal Act on Data Protection (nFADP) and the General Data Protection Regulation (GDPR), we are the Data Controller responsible for the processing of your personal data.

  • Contact: info@alcala.photography

  • Location: Buchs, St. Gallen, Switzerland

2. Personal Data We Collect

We adhere to the principle of Data Minimization (nFADP Art. 6). We only collect data strictly necessary for our services:

  • Communication Data: Name, email address, and phone number when you contact us via forms to request a quote or service.

  • Photographic Data: Images of identifiable individuals captured during contracted photography sessions.

  • Technical & Usage Data: When you visit our website, our hosting provider (Squarespace) automatically collects technical data, including your IP address, browser type, operating system, and the timestamp of your visit.

  • Analytics Data: If you provide explicit consent via our cookie banner, we use Google Analytics to collect pseudonymised data about your browsing behavior (e.g., pages visited, time spent on the site) to help us improve our services.

3. Purpose and Legal Basis for Processing

We process your data securely and strictly on the following legal bases:

  • Contractual Necessity: To provide quotes, schedule shoots, manage client communications, and deliver the final photographic products.

  • Consent (nFADP Art. 6 / GDPR Art. 6(1)(a)): The use of analytical cookies (Google Analytics) and the display of your photographs on our public portfolio or social media channels rely entirely on your active, explicit consent, which can be withdrawn at any time.

  • Legitimate Interest (nFADP Art. 6 / GDPR Art. 6(1)(f)): The collection of server log files and essential technical cookies by Squarespace is necessary to securely and reliably provide this website and protect against fraud or cyber threats.

4. Data Processors and International Transfers

To operate this website, we employ specialized service providers who act as our Data Processors. This involves the transfer of personal data outside of Switzerland and the European Economic Area (EEA):

  • Squarespace (Website Hosting): Our website is hosted by Squarespace (USA). Your technical data and any form submissions are processed on Squarespace servers.

  • Google LLC (Analytics): With your consent, website traffic data is transmitted to Google (USA). We have enabled "IP Anonymization" so that your IP address is truncated before being stored by Google.

Safeguards for International Transfers: Because the United States is considered a country without adequate statutory data protection under Swiss law, these data transfers are legally secured. Both Squarespace and Google participate in the Swiss-US Data Privacy Framework (DPF). Where necessary, we also rely on Standard Contractual Clauses (SCCs) approved by the Swiss Federal Data Protection and Information Commissioner (FDPIC). Your data is never sold to third parties.

5. Data Retention

We do not hold data indefinitely.

  • Administrative/Financial Data: Retained for 10 years to comply with Swiss commercial and tax law (GeBüV).

  • Photographic Archives: Retained as agreed upon in the client contract. Unselected RAW files and outtakes are purged systematically after the final gallery delivery.

  • Analytics Data: Google Analytics data is retained for a maximum of 2 months.

6. Cookies and Tracking Technologies

This website uses cookies—small text files placed on your device.

  • Essential Cookies: Deployed by Squarespace automatically to ensure the secure functioning of the website (e.g., preventing cross-site request forgery). These cannot be disabled.

  • Analytical Cookies (Google Analytics): These cookies track site usage and are disabled by default. They will only be activated if you explicitly click "Accept" on our cookie banner.

7. Your Data Subject Rights

Under the nFADP and GDPR, you have the right to:

  • Access: Request a copy of the personal data we hold about you (Subject Access Request).

  • Rectification: Request the correction of inaccurate or incomplete data.

  • Erasure: Request the deletion of your data ("Right to be Forgotten"), subject to our overriding legal retention obligations.

  • Withdrawal of Consent: Withdraw your consent for tracking cookies or portfolio use at any time.

To exercise these rights, please contact us at the email provided above. We will respond to all requests within the legally mandated 30-day window.