Privacy policy

Last updated 5 October 2026

This policy explains what personal data I collect when you visit this website, get in touch or work with me, why I collect it, who I share it with and the rights you have. It is written to meet the EU General Data Protection Regulation (GDPR), the Portuguese data protection law (Lei n.º 58/2019) and the Portuguese electronic communications privacy law (Lei n.º 41/2004).

1. Who I am

The data controller is Tetiana Vorotniak, a self-employed content creator trading as “Tanya — Content with a Why”, based in Lisbon, Portugal. You can contact me at hello@tanya-content.com.

I have not appointed a Data Protection Officer, as this is not required for a business of my size and type. For anything about your data, email me at the address above.

2. What I collect and why

When you send an enquiry

The contact forms on this site ask for:

• Brand enquiries: your name and email (required), and optionally your brand, the service you're interested in and a message.
• Wedding enquiries: your names and email (required), and optionally your wedding date and location and a message.

I use this to reply to you and to prepare a proposal. The same applies if you contact me directly by email, phone, WhatsApp or Instagram. Legal basis: taking steps at your request before entering into a contract (GDPR Article 6(1)(b)). Name and email are needed so I can reply; without them I can't respond to your enquiry.

When you become a client

I keep your contact details, the details of our agreement, our correspondence and the billing details needed to invoice you. Legal basis: performing our contract (Article 6(1)(b)) and complying with Portuguese tax and accounting law (Article 6(1)(c)).

Content I capture at weddings and shoots

My work involves filming and photographing people: the couple or brand I'm working for, and also guests, staff and others present. These images and videos are personal data.

• I capture and edit content to deliver the service my client has asked for. Legal basis: performing the contract with my client (Article 6(1)(b)) and, for guests and others present, the legitimate interest of my client and me in documenting the event they have been invited to (Article 6(1)(f)).
• Content is shared publicly, for example on Instagram, only as agreed with my client. I use content in my own portfolio, website or social media only with my client's permission.
• If you're a guest and would prefer not to be filmed, or want to be removed from published content, tell me or the couple on the day or afterwards by email, and I will respect your wishes wherever possible. This reflects your rights under data protection law and your right to your own image under the Portuguese Civil Code (Article 79).

Testimonials

If a client gives me a testimonial, I publish it with their name only with their permission (Article 6(1)(a)). They can ask me to remove it at any time.

Spam protection

The contact forms use Google reCAPTCHA to check that submissions come from a person, not a bot. reCAPTCHA collects technical information such as your IP address and how you interact with the page, and sends it to Google. Legal basis: my legitimate interest in protecting the forms from spam and abuse (Article 6(1)(f)). Google's use of this data is covered by the Google Privacy Policy.

Website analytics and advertising measurement

With your consent, this site uses:

• Google Analytics to understand how visitors use the site (pages visited, how you arrived, device and approximate location).
• Google Ads conversion tracking to measure whether people who click my Google ads go on to send an enquiry or contact me by WhatsApp, phone or email.
• Google Ads enhanced conversions: when you submit an enquiry form after accepting cookies, the email address you enter may be scrambled on your device (hashed with SHA-256) and sent to Google, which uses it only to match the enquiry to an ad click. Google cannot read the original address from the scrambled version.

Legal basis: your consent (Article 6(1)(a) and Article 5 of Lei n.º 41/2004), which you give or refuse with the cookie banner and can change at any time (see section 3). If you decline, these tools do not set cookies or use identifiers. Google's tags may still send basic signals without cookies, such as the fact that a page was viewed, which Google uses to estimate overall statistics.

Server logs

Like most websites, the server records technical details of each request: IP address, date and time, page requested and browser type. Legal basis: my legitimate interest in keeping the site secure and working (Article 6(1)(f)).

Fonts

The site's fonts are loaded from Google Fonts, which means your browser connects to Google's servers and shares your IP address with Google. Legal basis: my legitimate interest in displaying the site consistently (Article 6(1)(f)).

3. Cookies and similar technologies

Strictly necessary items are used without consent because the site needs them to work. Analytics and advertising cookies are used only if you click “Accept” on the cookie banner.

You can also block or delete cookies in your browser settings. Google may set its own cookies on its domains if you're signed in to a Google account; those are covered by Google's own policy.

4. Who I share data with

I don't sell your data. I share it only with the service providers that help me run the site and my business, who process it on my behalf and under contract:

• Amazon Web Services (Amazon Web Services EMEA SARL): website hosting, on servers in Frankfurt, Germany.
• Resend (Resend, Inc., USA): delivers the contact form submissions to my inbox.
• Zoho (Zoho Corporation B.V., Netherlands): email hosting, in its EU data centres.
• Google (Google Ireland Limited and Google LLC): Analytics, Ads conversion measurement, reCAPTCHA and Fonts, as described above.
• My accountant: for invoicing, bookkeeping and tax compliance.

If you contact me through WhatsApp or Instagram, Meta Platforms processes those messages as an independent controller under its own privacy policy. I may also disclose data where required by law, for example to the Portuguese tax authority (Autoridade Tributária).

5. International transfers

Some providers (Resend and Google LLC) are based in the United States. Where data is transferred outside the European Economic Area, it is protected by the EU-US Data Privacy Framework where the provider is certified under it, or otherwise by the European Commission's Standard Contractual Clauses.

6. How long I keep data

• Enquiries that don't lead to a booking: up to 2 years after our last contact, in case you get back in touch, then deleted.
• Client records and invoices: for as long as Portuguese tax and accounting law requires, currently 10 years.
• Content from weddings and shoots: raw footage is kept for up to 12 months after delivery so I can deal with re-edits or lost files, then deleted. Content published with my client's agreement stays published until either of us asks for it to be removed.
• Google Analytics data: 14 months.
• Server logs: up to 14 days.
• Cookies: as listed in section 3.

7. Your rights

Under the GDPR you have the right to:

• access the personal data I hold about you and get a copy;
• correct data that is inaccurate or incomplete;
• erase your data, where there's no legal reason for me to keep it;
• restrict how I use your data in certain circumstances;
• data portability: receive data you gave me in a common format, or have it sent to someone else;
• object to my use of your data where I rely on legitimate interests, including content in which you appear;
• withdraw your consent at any time, where I rely on consent.

To use any of these rights, email hello@tanya-content.com. It's free, and I'll reply within one month (this can be extended by two more months for complex requests, in which case I'll tell you). I may ask you to confirm your identity first. I don't make decisions about you based solely on automated processing.

Complaints

If you're unhappy with how I handle your data, please tell me first so I can try to put it right. You also have the right to complain to the Portuguese data protection authority:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
www.cnpd.pt

If you live in another EU country, you can also complain to the data protection authority there.

8. Security

The site is served over an encrypted connection (HTTPS), and access to enquiries, client data and footage is limited to me and the providers listed above. No method of storage or transmission is completely secure, but I take reasonable steps to protect your data.

9. Children

This website and my services are intended for adults. I don't knowingly collect personal data from children through this website.

10. Links to other sites

This site links to other sites, such as Instagram, WhatsApp and lisbon-photo.com. Their privacy practices are their own; this policy doesn't cover them.

11. Changes to this policy

I'll update this policy if what I do with personal data changes. The date at the top shows when it was last updated.