Privacy policy

Last updated: 12/06/2026

1. Data controller

Tadej photo
Email:info@tadej.photo
Phone:+386 40 814 388

2. Types of data collected

2.1 Personal data

• Contact form data: Name, email address, phone number, message content
• Technical data: IP address, browser type, device information, pages visited
• Cookie data: As detailed in our Cookie policy

2.2 Automated collection via google tag manager

We use Google Tag Manager to deploy:

• Google Analytics (with IP anonymization)
• Website optimization scripts

3. Legal basis for processing (GDPR Article 6)

• Consent: For cookies and non-essential tracking
• Legitimate interest: For website security and basic analytics
• Contractual necessity: To process your enquiries

4. How We Use Your Data

5. Data storage and hosting

• Primary hosting: AWS Dublin, Ireland (EU)
• Backups: AWS EU region (retained for 30 days)
• Data center compliance: AWS complies with EU data protection standards

6. Data sharing

6.1 Third-party processors

• Amazon Web Services (AWS): Website hosting in Dublin, Ireland
• Google: Analytics via Google Tag Manager

6.2 International transfers

• All data processed within EU AWS data centers
• Google Analytics data may be processed in the US under EU-US Data Privacy Framework adequacy decision
• Standard Contractual Clauses apply where needed

7. Data retention

8. Your rights (GDPR)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erasure ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent at any time

To exercise these rights: Contact us at info@tadej.photo

9. Supervisory authority

As a Slovenian business, our lead supervisory authority is:
Informacijski pooblaščenec (Information Commissioner of Slovenia)
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Website: www.ip-rs.si
Email: gp.ip@ip-rs.si

10. Security measures

• Hosting: AWS Dublin with encryption at rest and in transit
• Drupal security: Regular updates, security modules enabled
• Access control: Limited to website owner only
• Incident response: 72-hour breach notification as required by GDPR

11. Changes to this policy

We may update this policy periodically. Significant changes will be communicated via website notice.

12. Collage Art Project — Photo Capture

12.1 What is collected

When you interact with the Tadej character widget on this website, you may choose to have a photo taken via your device camera. If you proceed, the following data is collected:

•  A JPEG image captured from your device camera at the moment of the flash
• Your email address (provided by you before capture)
• Timestamp of submission
• Browser locale and timezone
• Anonymised IP address (last octet removed)
• A record of your explicit consent

12.2 Legal basis

Processing is based on your explicit consent (GDPR Article 6(1)(a)) given via the two-step confirmation in the character widget. Consent is freely given, specific, informed and unambiguous. You may withdraw it at any time.

12.3 Purpose

Photos are collected solely for consideration in an ongoing collage art project by Tadej. Selected images may be digitally post-processed and combined with other submitted photographs to form composite artworks. These artworks may be published on tadej.photo or displayed in physical exhibitions. No photo will be published, post-processed, or combined with other images without a second explicit confirmation from you by email.

12.4 Responsibility for image content

By submitting a photo you confirm that:

• You are the sole subject of the image, or
• You have obtained explicit consent from every identifiable person appearing in the image before submitting it

Tadej and Deux Cent Deux (the development company responsible for this website) accept no liability for images submitted in violation of third-party rights, including the rights of individuals photographed without their consent. Any such submission is the sole responsibility of the person who submitted it.

12.5 Data storage

Photos and associated consent records are stored on AWS EC2 within the EU (Dublin, Ireland), consistent with the hosting described in section 5.

• Unselected photos: deleted after 12 months from submission date
• Selected photos: retained for the duration of the project or until deletion is requested, whichever comes first
• Consent log: retained for 12 months in line with GDPR accountability requirements

12.6 Your rights

You may request deletion of your photo and all associated data at any time. Each submission generates a unique deletion link sent to your email address immediately after capture. This link remains valid for 30 days.

After 30 days, deletion requests can be made by contacting: info@tadej.photo

Please quote your reference token (included in your confirmation email).

We will action deletion requests within 72 hours.

12.7 No automated decision-making

Selection of photos for the collage project is carried out manually by Tadej. No automated profiling or decision-making is applied to submitted images.