This notice describes what data thenarrativestudio.com processes and why.
The site is operated and the data controlled by THE NARRATIVE S.R.L. (Strada Nicolae Bălcescu 69B/10, 535600 Odorheiu Secuiesc, Harghita county, Romania; CUI: 37402503). Questions: thenarrativestudio@gmail.com. Appointing a data protection officer is not mandatory for us; the same address is our contact point for any data protection matter.
When you send the form we process the name, e-mail address, phone number and message you provide — so we can reply. The data goes to our mailbox and a protected database, and is kept for at most 1 year.
Legal basis: our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).
When you book, we process your name, e-mail, phone number, the chosen time and any note — to fulfil the booking. For graduation bookings we also process your social media profile (if you give it) and, for a joint booking, your partner’s name. For online payments, payment is processed by Stripe; card details never reach us. Booking data is kept for 2 years.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Issuing and keeping the invoice is a legal obligation (Art. 6(1)(c)); accounting records are kept for the period required by law.
The booking form is protected against bots by Cloudflare Turnstile. To filter out mass fake bookings we do not store your IP address, only an irreversible fingerprint of it: we use it to limit the number of bookings started from one address and, if needed, to block an abusive address. The fingerprint is kept with the booking (30 days for unconfirmed bookings) and, in case of a block, until the block is lifted.
Legal basis: our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
After delivering your photos we may contact you once to ask for a review on Google. Leaving a review is voluntary; if you would rather not receive such a message, just tell us.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
A person’s likeness is personal data. We process the photographs to deliver the service: the selection gallery stays available for 30 days, and raw files are kept for 12 months after the session, then securely deleted.
Publishing photographs in our portfolio, on the website or on social media happens only with your separate, explicit consent (Art. 6(1)(a) GDPR). This is not a condition of the service and can be withdrawn at any time at thenarrativestudio@gmail.com — after withdrawal we remove the images from our online channels. For photographs of minors, a parent’s or guardian’s consent is required.
Our processors: <b>Stripe</b> (payment processing), <b>Cloudflare</b> (hosting, security, bot filtering, visitor statistics), <b>Resend</b> (sending confirmation e-mails), <b>SmugMug</b> (online selection and delivery gallery), <b>Google</b> (client records and calendar), <b>Discord</b> (internal notifications), and our accounting office. Invoice data is submitted to the Romanian tax authority’s (<b>ANAF</b>) e-Factura system as required by law.
Except for the accounting office, these providers also process data in the United States. The transfer safeguard is the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses (Art. 46 GDPR).
We do not sell your data and do not use it for automated decision-making or profiling.
The site uses no tracking cookies. Visits to the graduation page are measured by Cloudflare Web Analytics: without cookies and without identifiers stored in the browser, showing aggregate data only. The host’s (Cloudflare) technical logs and security cookies, and the booking form’s bot filter (Turnstile), are strictly necessary for operation and therefore require no consent. During payment, Stripe may set its own cookies for fraud prevention.
We keep a single flag in the browser’s session storage noting that the opening animation has already played (so it does not repeat on every page); it is deleted when you close the tab.
The Instagram images on the home page and the graduation page load directly from Meta’s servers, so your browser’s IP address reaches Meta.
At any time you can request a copy, correction, deletion or restriction of your data, object to processing, request data portability, and withdraw consent you gave earlier — all at thenarrativestudio@gmail.com.
You may lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest; anspdcp@dataprotection.ro; www.dataprotection.ro.
Last updated: September 2026