Privacy in the client portal
Controller
Emina Huremovic, LiZa Memories Photography, Mela-Spira-Straße 32b, 8054 Graz, Austria. Privacy contact: info@liza-memories-photography.com.
Access and data
The portal processes your name, email, protected credentials, gallery assignments, photos, favourites and order/release data. Passwords are stored as salted hashes and are not sent by email. Setup and reset links expire and are single use.
Purposes and legal grounds
Access, galleries, image selection, ordering and delivery support the contract or pre-contractual steps (GDPR Art. 6(1)(b)). Statutory records rely on legal duties (c). Limited security data and access protection rely on the legitimate interest in keeping the portal secure (f). This does not authorise advertising or publishing your photos.
Service providers
The live system is prepared for Cloudflare Workers, D1 and private R2 storage. The R2 bucket is restricted to the EU, which does not mean every service processes data only in the EU. An email service delivers access messages and order confirmations. Enabled payment providers receive necessary payment/order data; card details are entered on their checkout. The specific live providers and agreements must be added to the main privacy policy before launch.
Necessary session
A necessary HttpOnly session cookie keeps you signed in, using a random identifier. It expires within 7 days and is ended on logout. No advertising trackers or analytics beacons are integrated in this portal.
Retention and rights
Galleries and accounts are deleted after the agreed access period and necessary contract processing, subject to legal duties. Order records follow statutory retention requirements. You may request access, rectification, erasure, restriction, portability and, where applicable, object. Complaints can be submitted to the Austrian Data Protection Authority. See the main privacy policy for further details.