Privacy Policy

1. Who we are (data controller)

The data controller for emanuelsialina.ro is ALI & MELI STUDIO S.R.L., a Romanian limited liability company providing photography and videography services under the Emanuel Lupașcu Photographer and Alina Lupașcu Film identity.

Controller contact details: email emy_lupascu@icloud.com, phone +40 757 241 816.

Romanian tax ID (CUI): 45273671. Trade Register number: J7/757/24.11.2021. Registered office: Municipiul Botoșani, Aleea Curcubeului nr. 5, Scara E, Ap. 1, Județul Botoșani, România. Main activity: CAEN 7420 — Photographic activities.

2. What data we collect

Through the contact and enquiry forms (weddings, baptisms, private collections) we collect only the data you enter yourself:

• —your name (and, where relevant, your partner's or the parents' names);
• —your email address and phone number;
• —the date and location of your event (wedding, baptism, photo session);
• —the message and details you voluntarily send through the form;
• —the package and additional services chosen in the private configurator.

3. Why we process this data (purposes)

• —to answer your enquiry and check date availability;
• —to prepare and send you a photo-video services offer;
• —to give you access to the private pricing collection through a unique link;
• —to conclude and perform the services contract;
• —to comply with legal obligations (for example accounting and invoicing), where applicable.

4. Legal bases for processing

Answering enquiries and preparing offers: steps taken at your request before entering a contract (Art. 6(1)(b) GDPR).

Performing the photo-video services contract: Art. 6(1)(b) GDPR.

Accounting and tax obligations, where applicable: Art. 6(1)(c) GDPR.

Keeping a history of enquiries and defending against potential claims: legitimate interest (Art. 6(1)(f) GDPR).

Optional language preference: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time. We do not use enquiry data for marketing without a separate lawful basis and, where required, separate, optional consent that is unchecked by default.

5. Who we share data with (recipients and processors)

Data is processed by the following service providers, strictly for operating the website:

• —Lovable / Lovable Cloud — website hosting, authentication and enquiry storage: form data, administrator account data and technical data (such as IP addresses and access logs);
• —Resend — transactional email delivery only (notifications and access messages): recipient addresses and message content, which may include form or enquiry data; we do not use this service for marketing;
• —Cloudflare — delivery infrastructure and photograph delivery (R2): images, IP addresses and technical request data needed for delivery and security;

6. International transfers

Lovable / Lovable Cloud, Cloudflare and Resend infrastructure may involve processing on servers outside the European Economic Area (EEA), including in the United States, depending on the service and operation. We do not claim that all data remains exclusively in Romania or the EEA. Transfers requiring safeguards are subject to the relevant provider data processing agreements and contractual safeguards, including European Commission Standard Contractual Clauses where applicable. The exact location of each operation has not been individually verified.

7. How long we keep data

Enquiries that do not become clients: names, email addresses, phone numbers, event dates, locations and types, and enquiry details may be retained for up to 12 months from the last relevant interaction. After that period, the data should be deleted or anonymized unless another legal basis requires retention.

Data of clients who enter into a contract: for the duration of the contractual relationship plus 3 years, where needed for the establishment, exercise or defence of legal claims.

Mandatory accounting, financial and fiscal documents are retained according to applicable Romanian accounting and tax legislation. These obligations may require longer retention; not all client data is automatically deleted after 3 years.

Applying these rules requires checking contractual status and legal obligations before deletion or anonymization; publishing this policy does not automatically delete existing records.

8. How we protect data

• —encrypted connections (HTTPS) across the entire site;
• —the admin area is protected by authentication;
• —private pricing collections are accessible only through unique, server-verified links;
• —forms are protected by submission rate limiting.

9. Your rights

Under the GDPR, you have the following rights where applicable and subject to the conditions and limits set by law:

• —the right to access your data;
• —the right to rectification of inaccurate data;
• —the right to erasure (“the right to be forgotten”);
• —the right to restriction of processing;
• —the right to data portability;
• —the right to object to processing based on legitimate interest;
• —the right to withdraw consent, where processing is based on consent.

10. How to exercise your rights

You can write to us at any time at emy_lupascu@icloud.com or call us at +40 757 241 816. We respond without undue delay, normally within one month; for complex requests, this period may be extended under the GDPR and we will inform you.

11. Complaint to the supervisory authority

If you believe the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal — ANSPDCP.

12. Cookies and third-party services

Full details about the cookies and local storage used by this site, and how you can change your consent, are available in the Cookie Policy.