Skip to main content
Your data choices

You can change your choice at any time. Essential cookies remain active for security and to remember this preference.

Essential cookies

Cloudflare security and storage of your choice for six months.

Always active

Book your session with me

Preparing your booking…

Book a session
EN
EN
Menu
Check availability Book online Call+32 485 87 88 42 WhatsApp
Your data, your control

Privacy policy

Last updated: August 20, 2026

1. Introduction

This privacy policy explains how Hani Kanaftchian (self-employed, CBE BE0541771724, Rue Vanderkindere 524, 1180 Uccle, Belgium) collects, uses and protects the personal data of visitors and clients of https://www.kanaftchian.com.

This policy is consistent with Regulation (EU) 2016/679 (GDPR) and Belgian law of July 30, 2018 relating to the protection of natural persons with regard to the processing of personal data.

2. Data controller

The data controller is:

3. Data collected

Hani Kanaftchian collects the following categories of data:

3.1 Data provided by the Client or generated as part of the service

  • Identity and contact details : name, first name, email address, telephone number.
  • Draft reservation in browser : during the browse, the name, email, telephone and message possibly entered can be temporarily kept in the session storage of the tab in order to avoid re-entry in the event of a return. This draft never includes acceptance of the T&Cs or consent for early execution and is only transmitted to the Provider after the explicit confirmation action.
  • Billing and delivery : postal address, company name and VAT number for professional customers.
  • Reservation and service : service chosen, date or slot, options, location, information useful to the organization, messages and exchanges with the Client.
  • Discovery source (optional) : your answer about how you found the website and any details you choose to add. It is stored with your enquiry or booking and used for the studio’s internal statistics. Leaving this question blank does not affect your enquiry.
  • Gift vouchers : identity and email of the buyer and, when provided, name of the beneficiary, personalized message, code, value, validity period and state of use.
  • Payment : for the purchase of a gift voucher, as well as for tracking old reservation transactions still kept: amount, currency, payment or refund status and technical identifiers communicated by Stripe. New standard session bookings are not prepaid online. The Provider does not receive or store the full card number or bank authentication data.
  • Contractual evidence : acceptance of the terms of sale, the date and time associated with the booking or payment, and confirmations and consents requested during the process.
  • Withdrawal and other contractual requests : name, contact details, contract reference, content of the request, date and time of receipt and action taken.
  • Content of the service : photographs taken, selections and files delivered.

3.2 Data collected automatically

  • IP address, browser type, operating system
  • Pages viewed, length of visit, traffic source
  • Cookies and technical identifiers (see Cookie policy)

4. Purposes of processing

Your data is used exclusively for:

  • Execution of the contract : management of the reservation, organization of the session, delivery of the private gallery, invoicing.
  • Transactional communication : sending confirmations, reminders, practical instructions relating to the service and delivery of gift vouchers. For only old reservation processes with online payment still present in the history, an interrupted attempt may have given rise to a single resumption email, without additional prospecting.
  • Legal obligations : conservation of invoices and accounting documents (10 years, Belgian obligation).
  • Management of contractual rights : receiving, recording and processing cancellation, rescheduling and withdrawal requests.
  • Site improvement : audience measurement via Google Analytics 4 and measurement of Core Web Vitals via Cloudflare Web Analytics, only after your consent.
  • Portfolio use : publication of images on the site and social networks only with the Client's explicit agreement.

5. Legal bases for processing

In accordance with Article 6 of the GDPR, processing is based on:

  • The contract and the pre-contractual measures requested (art. 6.1.b): to prepare and confirm a reservation, carry out the photographic service, process the purchase and use of a gift voucher and ensure the corresponding transactional follow-up.
  • The legal obligation (art. 6.1.c): for the conservation of invoices and the VAT declaration.
  • Consent (art. 6.1.a): for audience and performance measurement via Google Analytics 4 and Cloudflare Web Analytics, the publication of photographs in the portfolio and the possible sending of marketing communications.
  • Legitimate interest (art. 6.1.f): to ensure the security of the site and prevent abuse.

6. Data recipients

Your data is never transferred, rented or sold to third parties. However, they may be communicated to:

  • Technical processors : Cloudflare (hosting, measurement of Core Web Vitals and, when this protection is activated, Turnstile anti-spam), Google (Analytics, Calendar and Workspace), Stripe (purchase of gift vouchers, reimbursements and monitoring of old transactions concerned) and Brevo (transactional emails), to the extent necessary for their missions.
  • Accountant : for compliance with legal tax obligations.
  • Authorities : upon legal request only.

7. Transfers outside the European Union

Some subcontractors (including Cloudflare, Google, Stripe or their own service providers) may process data outside the European Economic Area. When such a transfer takes place, it is governed by a mechanism provided for in Chapter V of the GDPR applicable to the service provider concerned, such as an adequacy decision or the standard contractual clauses of the European Commission.

8. Data retention periods

  • Confirmed bookings and client correspondence : a maximum of 3 years from the last interaction, unless there is a longer contractual or litigation requirement.
  • Local draft of the reservation form : only in the browser tab, up to 30 minutes of inactivity. It is deleted after confirmation and disappears at the latest when the browsing session is closed.
  • Uncompleted bookings from the former checkout process : when data from the old payment process still remains, deletion no later than 30 days after creation of the basket; the possible recovery link expires after 7 days. The current Standard Sessions journey does not create a Stripe checkout or cart.
  • Gift vouchers and associated contractual proofs : for the duration necessary for their issuance, use, management of requests and defense of the rights of the parties; the corresponding accounting documents follow the legal deadline indicated below.
  • Cancellation, rescheduling and withdrawal requests : for the duration necessary for their processing, for proof of respect for the rights and for the reasonable defense of the parties, without prejudice to legal retention periods.
  • Invoices and accounting documents : 10 years from 1st January following their date, in accordance with Belgian requirements.
  • Delivered edited photographs : up to 1 year after delivery to allow a new delivery to the Client. The online delivery link may expire sooner, depending on the duration announced when shipping.
  • Unselected photographs and RAW files : maximum 30 days after delivery, then deletion.
  • Photographs published with consent : until consent is withdrawn or publication is no longer necessary.
  • Google Analytics 4 browsing data : up to 14 months; Analytics cookies: up to 13 months.
  • Cloudflare Web Analytics performance data : data not sampled for 7 days, then aggregated data accessible for a maximum period of 6 months.
  • Choice of cookie consent : 6 months.

9. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

  • Right of access : obtain confirmation that your data is processed and receive a copy.
  • Right of rectification : correct inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”): request the deletion of your data, subject to legal retention obligations.
  • Right to restriction of processing : temporarily freeze the processing of your data.
  • Right to data portability : receive your data in a structured and readable format.
  • Right to object : object to processing based on legitimate interest or for prospecting purposes.
  • Right to withdraw your consent at any time, without affecting the lawfulness of the previous processing.

To exercise these rights, contact Hani Kanaftchian by email at hani@kanaftchian.com specifying your identity. A response will be provided within the legal period of one month from receipt of the request. This period may be extended by two months when the request is complex or numerous; you will then be informed within the first month.

10. Right to lodge a complaint

If you believe your rights are not being respected, you may lodge a complaint with the Belgian Data Protection Authority:

11. Data security

Hani Kanaftchian implements appropriate technical and organizational measures to guarantee the security of your data: encrypted HTTPS connections, regular backups, storage on Cloudflare secure infrastructure, limited access to strictly necessary data, strong passwords and two-factor authentication on critical tools.

12. Policy Changes

This policy may be updated at any time to reflect legal or technical developments. The current version is always the one published on this page, accompanied by its update date.

Hani Kanaftchian, photographer