Privacy Policy

Last updated: 25 August 2026

This Privacy Policy explains how Light & Dark Studio collects and uses personal data when you visit light-n-dark.com, contact us, request a photography estimate, or interact with our website.

1. Data Controller

The controller of personal data collected through this website is:

Light & Dark Studio
GEMI (General Commercial Registry): 168893503000
Email: info@light-n-dark.com
Thessaloniki: +30 6951 661 016

2. Personal Data We Collect

Contact and enquiry forms

When you contact us through the website, we may process the information you choose to provide, such as your name, email address, telephone number and message.

Online price-estimate requests

When you use the online photography price-estimate tool, we may process contact information and project details needed to understand and respond to your request. Depending on the choices you make, this may include your name, telephone number, email address, product or project category, quantity, photography style, number of angles, retouching requirements, shooting location, property details and comments.

At least a telephone number or an email address is required so that we can respond to an estimate request. These requests are transmitted to us by email. Our custom price-estimate endpoint does not intentionally create a separate customer-submission record in the WordPress database, although normal mail-server, security and hosting logs may exist.

Technical and security data

Our hosting and security infrastructure may automatically process technical information such as IP address, date and time of access, requested URL, browser or user-agent information, response codes and error or security events. We use this information to operate, secure and troubleshoot the website and to prevent abuse.

Analytics data

If you consent to Analytics cookies, we use Google Analytics 4 and Microsoft Clarity. These services may process information about website use, such as page views, sessions, approximate location, device and browser information, referral information and interactions with website content. Microsoft Clarity may also provide session recordings and heatmaps designed to help us understand how visitors use the website. Sensitive form-input content is not intended to be captured by Clarity.

Advertising and conversion measurement

If you consent to Marketing cookies, we use Google Ads technologies to measure advertising performance, conversions and remarketing audiences. This may include information about ad interactions, conversion events such as form submissions or telephone-link clicks, browser/device information and advertising or conversion identifiers where available.

External media and links

Some pages may contain content or resources from third-party services such as YouTube, as well as links to services such as Google Maps, WhatsApp, Viber and social networks. When a third-party resource is loaded or you choose to interact with an external service, that provider may receive technical connection data such as your IP address, browser information and the page from which the request originated. The provider's own privacy terms then apply to its processing.

3. Purposes and Legal Bases

Responding to enquiries, preparing quotations and taking steps before entering into a contract: processing is necessary to take steps at your request before entering into a contract and, where applicable, to perform a contract (GDPR Article 6(1)(b)).
Business correspondence and customer administration: where necessary, processing is based on performance of a contract, compliance with legal obligations, or our legitimate interests in managing business communications and protecting legal claims (GDPR Article 6(1)(b), (c) and, where applicable, (f)).
Website security, troubleshooting and abuse prevention: our legitimate interests in maintaining a secure, reliable website and preventing misuse (GDPR Article 6(1)(f)).
Google Analytics and Microsoft Clarity: your consent (GDPR Article 6(1)(a)). These technologies are not activated through our Analytics category unless you choose to allow them.
Google Ads conversion measurement and remarketing: your consent (GDPR Article 6(1)(a)). These technologies are not activated through our Marketing category unless you choose to allow them.
Compliance with accounting, tax, court or other legal requirements: compliance with legal obligations (GDPR Article 6(1)(c)).

4. Cookies and Consent

Optional Analytics and Marketing technologies are disabled by default. You can accept all, reject all, or choose the categories you want to enable. Your choice is stored locally in your browser.

You can change or withdraw your consent at any time by selecting Cookie Settings in the website footer. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

For detailed information about the cookies and similar technologies used on this website, see our Cookie Policy (EU).

5. Recipients and Service Providers

We disclose personal data only where necessary for the purposes described in this Policy. Depending on the processing activity, recipients may include:

website hosting, infrastructure, security and technical-support providers;
email and communications providers used to receive and respond to enquiries;
Google, when you enable Analytics or Marketing, for Google Analytics, Google Ads and related measurement services;
Microsoft, when you enable Analytics, for Microsoft Clarity;
professional advisers, accountants or legal advisers where necessary;
public authorities, courts or law-enforcement bodies where disclosure is required by law.

We do not sell your personal data.

6. International Data Transfers

Some service providers, including Google and Microsoft, operate internationally and may process data outside the European Economic Area (EEA). Where an international transfer of personal data requires a transfer mechanism under the GDPR, the relevant provider states that it uses legally recognised safeguards, which may include adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, and/or European Commission Standard Contractual Clauses.

More information is available from the providers:

7. How Long We Keep Personal Data

We keep personal data only for as long as necessary for the purpose for which it was collected and for any period required to meet legal, accounting, security or dispute-resolution obligations.

Enquiries and quotation requests: retained for the time needed to respond and, where appropriate, for a reasonable period afterwards to manage business correspondence, follow up the requested service, or establish, exercise or defend legal claims.
Client and accounting records: where an enquiry becomes a client relationship, relevant contractual, invoicing and accounting records are retained for the period required by applicable Greek and EU law.
Technical/security logs: retained only for as long as reasonably necessary for security, troubleshooting, abuse prevention and any applicable legal requirements.
Google Analytics: browser-cookie durations are listed in our Cookie Policy. User- and event-level retention is managed through the Google Analytics property settings and Google's applicable retention rules.
Microsoft Clarity: Microsoft states that standard session playback data is retained for 30 days, while click/aggregated data and certain labelled or favourited sessions may be retained for up to 9 months.
Google Ads: advertising and conversion data is retained according to the relevant account settings and Google's applicable retention rules. Browser-cookie durations are listed in our Cookie Policy.

8. Your GDPR Rights

Subject to the conditions and limitations of the GDPR, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete data;
request erasure of your personal data;
request restriction of processing;
receive personal data in a portable format where the right to data portability applies;
object to processing based on legitimate interests;
withdraw consent at any time where processing is based on consent;
lodge a complaint with a competent supervisory authority.

To exercise a right, contact us at info@light-n-dark.com. We may need to verify your identity before acting on a request.

9. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes data-protection law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) or another competent supervisory authority.

Complaint to the Hellenic Data Protection Authority

10. Security

We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or misuse. No internet transmission or electronic storage system can, however, be guaranteed to be completely secure.

11. Automated Decision-Making

We do not use personal data submitted through our contact or quotation forms to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.

12. Changes to This Policy

We may update this Privacy Policy when our services, technologies or legal obligations change. The current version and its update date will be published on this page.