Privacy Policy

1. Data Controller

The Data Controller is Salvo Nicolosi, photographer operating as Salvo Nicolosi Photography, based in the Catania area, Sicily, Italy. This notice concerns salvonicolosiph.com and the corresponding Italian website salvonicolosiph.it.

For privacy enquiries and requests to exercise your rights, contact info@salvonicolosiph.com.

2. Categories of personal data

Depending on your interaction with the website and photography services, the following data may be processed:

• technical data generated when accessing the website, such as IP address, browser information, access times and server logs;
• name, contact details, message content and other information you choose to share by email or WhatsApp Business;
• information needed to prepare quotations, organise assignments, deliver photographs and administer professional relationships;
• photographs and, where relevant, associated information relating to identifiable people, including participants in private events.

The website does not currently provide an online contact form or newsletter subscription form.

3. Contact requests and professional services

When you contact Salvo Nicolosi by email or WhatsApp Business, the data you provide is used to respond to your enquiry, discuss availability, prepare quotations and, if you commission a service, organise and fulfil the photography assignment.

The legal basis is taking steps at your request before entering into a contract and, where applicable, performing the contract (Article 6(1)(b) GDPR). Information required for invoicing and compliance with legal obligations is processed under Article 6(1)(c) GDPR. Limited processing needed to manage or defend legal claims may be based on legitimate interests, subject to the applicable balancing of interests (Article 6(1)(f) GDPR).

You can choose whether to contact the photographer by email or WhatsApp. Providing the information needed to handle your enquiry or assignment is voluntary, but without it the request or service may not be manageable.

4. Website hosting and technical security

The websites are hosted using Aruba services. Technical data and server logs may be processed to deliver the pages, maintain the service and protect the website against abuse and security incidents. The relevant legal basis is the legitimate interest in operating a secure and functional website (Article 6(1)(f) GDPR), and any applicable legal obligation.

The exact categories of logs, their retention periods and the roles of individual Aruba entities must be checked against the hosting contract and actual configuration before publication.

5. Photography services and image publication

During commissioned photography services, images of clients, guests and other participants may be created, selected, edited, delivered and archived to fulfil the assignment and manage the professional relationship. The applicable legal basis depends on the individual processing activity and the relationship with the person concerned.

Photographs displayed in the online portfolio are published on the basis of the relevant authorisations obtained from clients and, where required, from identifiable people depicted. Publication for advertising or other additional uses must fall within the scope of the authorisation obtained. Particular care is taken with images of children and authorisations from persons exercising parental responsibility.

Authorisation to publish an image and the basis for retaining photographs in private working archives are separate matters. Requests concerning publication can be sent to info@salvonicolosiph.com; the response will depend on the circumstances and applicable law.

6. Email and WhatsApp Business

Email correspondence is handled through the email service used for the professional mailbox. When you choose WhatsApp Business, your interaction also involves WhatsApp and its applicable privacy terms and infrastructure. Avoid sending unnecessary sensitive information through either channel.

Communications are not currently deleted on a fixed automatic schedule. They are retained while relevant to the enquiry, professional relationship or applicable administrative or legal requirements and should be periodically reviewed and deleted or minimised when no longer needed.

7. Analytics and website measurement

Google Analytics 4 is not currently installed or active on the website. If it is introduced, this notice and the Cookie Policy will be updated to identify the provider, purposes, data involved, retention arrangements and any international transfers. Non-essential analytics will be enabled only where the applicable consent requirements have been met.

At present, technical hosting information should not be confused with an installed Google Analytics service.

8. Advertising, remarketing and profiling

The Meta Pixel is not currently installed or active on the website. Salvo Nicolosi intends to use advertising measurement and targeted advertising in the future. Before any advertising pixel or comparable non-essential tracking tool is enabled, the relevant notices and consent controls must be updated and configured so that tracking does not begin before the required consent.

Future advertising processing may involve identifiers, page interactions and conversion events, depending on the tools actually deployed. This paragraph does not mean such tracking is already taking place.

9. Newsletter — future service

No website newsletter subscription system is currently active and no newsletter platform has yet been selected. If a newsletter is introduced, its subscription mechanism and this notice will be updated to identify the provider, categories of data, purposes and retention criteria.

Promotional emails will require an appropriate legal basis, including specific, demonstrable consent where required. Contacting the photographer for a quotation does not, by itself, subscribe a person to marketing messages. Subscribers will be able to withdraw consent and unsubscribe.

10. External links and service providers

The website may link to third-party platforms such as Instagram, Facebook, LinkedIn and WhatsApp. Clicking an external link takes you to a service governed by its own privacy information.

Recipients may include Aruba for hosting, providers of professional email and communication services, and professional advisers where necessary for administration or legal compliance. The identity and role of each provider depend on the services actually used. A newsletter provider, Google Analytics and Meta Pixel must not be treated as currently active website recipients solely because they are planned.

11. International transfers

Some communications or third-party services, including WhatsApp Business, may involve processing outside the European Economic Area. Where a transfer subject to Chapter V of the GDPR takes place, it must rely on a valid transfer mechanism, such as an applicable adequacy decision or appropriate safeguards.

The specific transfer arrangements depend on the service, contractual terms and configuration in use and should be checked before publication. Future analytics, advertising and newsletter services will require a further assessment when selected.

12. Data retention

Personal data is kept for no longer than necessary for its purpose, taking account of legal, contractual and evidential requirements:

• Email and WhatsApp: messages are currently not automatically deleted. Relevant correspondence is kept while needed for the enquiry, assignment or related obligations, with periodic review and removal of material no longer necessary.
• Accounting and contractual records: retained for periods required by applicable law and any necessary defence of legal claims.
• Photographic archives: originals and edited files may be retained for delivery, follow-up requests, portfolio management or other legitimate purposes and may be deleted after a period determined by the nature of the assignment and agreed arrangements. No universal automatic deletion date is currently promised.
• Published portfolio images: remain online while the relevant publication is justified and authorised, subject to applicable rights and any valid requests.
• Technical logs: retention follows the hosting configuration and legitimate security needs; the precise period must be verified with Aruba.

These criteria will be refined when a documented retention schedule is adopted. Data is deleted or anonymised when it is no longer needed, unless a lawful reason requires further retention.

13. Your rights

Subject to the conditions of the GDPR, you may request access to your personal data, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent at any time where consent is the legal basis, without affecting processing lawfully carried out beforehand.

Send requests to info@salvonicolosiph.com. Your identity may be verified where reasonably necessary to protect personal data.

14. Right to lodge a complaint

If you believe that your personal data is processed in breach of data protection law, you may lodge a complaint with a competent supervisory authority, including the Italian Data Protection Authority (Garante per la protezione dei dati personali). You may also seek the judicial remedies provided by applicable law.

15. Cookies and tracking technologies

For information on cookies, technical storage and consent preferences, see the Cookie Policy. That document must also be aligned with the tools actually active at publication; any references to Google Analytics 4 or Meta Pixel as currently installed must be corrected if those services remain inactive.

16. Changes to this Privacy Policy

This Privacy Policy may change when website features, suppliers, professional processes or applicable legal requirements change. The current version will be published on this page with its update date. In particular, introducing a newsletter, Google Analytics 4 or Meta Pixel will require a review before activation.