Privacy policy
Last updated: 01/02/2026
1. Data controller
Tadej photo
Email:info@tadej.photo
Phone:+386 40 814 388
2. Types of data collected
2.1 Personal data
- Contact form data: Name, email address, phone number, message content
- Technical data: IP address, browser type, device information, pages visited
- Cookie data: As detailed in our Cookie policy
2.2 Automated collection via google tag manager
We use Google Tag Manager to deploy:
- Google Analytics (with IP anonymization)
- Website optimization scripts
3. Legal basis for processing (GDPR Article 6)
- Consent: For cookies and non-essential tracking
- Legitimate interest: For website security and basic analytics
- Contractual necessity: To process your enquiries
4. How We Use Your Data
| Purpose | Data used | Legal basis |
|---|---|---|
| Respond to enquiries | Name, email, message | Contractual necessity |
| Website analytics | Anonymized IP, browsing data | Legitimate interest |
| Improve user experience | Cookie data | Consent |
| Security monitoring | IP address, technical data | Legal obligation |
5. Data storage and hosting
- Primary hosting: AWS Dublin, Ireland (EU)
- Backups: AWS EU region (retained for 30 days)
- Data center compliance: AWS complies with EU data protection standards
6. Data sharing
6.1 Third-party processors
- Amazon Web Services (AWS): Website hosting in Dublin, Ireland
- Google: Analytics via Google Tag Manager
6.2 International transfers
- All data processed within EU AWS data centers
- Google Analytics data may be processed in the US under EU-US Data Privacy Framework adequacy decision
- Standard Contractual Clauses apply where needed
7. Data retention
| Data type | Retention period | Reason |
|---|---|---|
| Contact form submissions | 24 months | Business inquiries |
| Server logs | 30 days | Security monitoring |
| Analytics data | 14 months | Website improvement |
| Backup data | 30 days | Disaster recovery |
8. Your rights (GDPR)
You have the right to:
- Access your personal data
- Rectify inaccurate data
- Erasure ("right to be forgotten")
- Restrict processing
- Data portability
- Object to processing
- Withdraw consent at any time
To exercise these rights: Contact us at info@tadej.photo
9. Supervisory authority
As a Slovenian business, our lead supervisory authority is:
Informacijski pooblaščenec (Information Commissioner of Slovenia)
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Website: www.ip-rs.si
Email: gp.ip@ip-rs.si
10. Security measures
- Hosting: AWS Dublin with encryption at rest and in transit
- Drupal security: Regular updates, security modules enabled
- Access control: Limited to website owner only
- Incident response: 72-hour breach notification as required by GDPR
11. Changes to this policy
We may update this policy periodically. Significant changes will be communicated via website notice.