GDPR Compliance Statement

Last updated: August 2026

Our commitment to data protection

decordobla is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and UK data protection laws.

Legal basis for processing

We process your personal data under the following legal bases:

• Contract: Processing necessary to fulfill our photography services agreement with you
• Consent: Where you have given explicit consent for specific processing activities
• Legitimate interests: For business operations and service improvement, balanced against your rights
• Legal obligation: Where required by law

Data controller

decordobla acts as the data controller for personal information collected through our website and services. We are responsible for ensuring your data is processed lawfully and securely.

Your GDPR rights

Under GDPR, you have the following rights:

Right to access

You can request a copy of the personal data we hold about you.

Right to rectification

You can request correction of inaccurate or incomplete personal data.

Right to erasure

You can request deletion of your personal data in certain circumstances.

Right to restrict processing

You can request that we limit how we use your personal data.

Right to data portability

You can request your data in a structured, commonly used format.

Right to object

You can object to processing based on legitimate interests or for direct marketing.

Rights related to automated decision-making

We do not use automated decision-making or profiling that produces legal effects.

Data retention periods

We retain personal data only for as long as necessary:

• Booking inquiries: 2 years from last contact
• Client contracts and communications: 6 years after service completion
• Financial records: 7 years as required by law
• Marketing consent: Until withdrawn or 3 years of inactivity

International data transfers

We primarily store and process data within the United Kingdom. If data is transferred outside the UK, we ensure appropriate safeguards are in place.

Data security measures

We implement technical and organizational security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Staff training on data protection

Exercising your rights

To exercise any of your GDPR rights, contact us at [email protected]. We will respond to your request within one month.

Complaints

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.