Privacy Policy

1. Data controller

In The Darkroom, with its studio at Thorvald Meyers gate 44, 0555 Oslo, is the data controller for the personal data processed through the website inthedarkroom.org and in connection with photography assignments.

All contact about privacy goes in writing to [email protected].

2. What data we process

We only collect data you give us yourself, or data that is necessary in order to deliver a photography assignment you have booked:

• Contact form: name, email address, the type of session chosen, preferred date, location and your free-text message.
• Assignment agreement: agreement details, the address where the session takes place and any practical information you share with us (for example the timeline for a wedding day).
• Image material: photographs and possibly audio/video from the session, plus the names of the people portrayed if you give them to us.
• Email correspondence: the messages exchanged between you and us.
• Technical log: anonymised visitor statistics from the website, see the cookie policy.

We never ask for national identity numbers, health data or other special categories of personal data. Should such data nevertheless be necessary for an assignment — for example accessibility arrangements in the studio — we process it only with your explicit consent and delete it as soon as the assignment is completed.

3. Purposes and legal basis

4. Pictures as personal data

A photograph in which a person can be recognised is personal data. Pictures from your assignments are therefore treated in the same way as other data about you:

• We never publish pictures of you in the portfolio, on the website or on social media unless you have given written consent to exactly that use.
• Consent to publication can be withdrawn at any time. We then remove the pictures from our own channels as quickly as possible, normally within five working days.
• The pictures in the portfolio on this website are our own work and illustrations published with the consent of the people portrayed.
• You decide who you share your private gallery with. The link should not be posted publicly, since anyone who has it can see the pictures.

5. How long we keep the data

• Enquiries that do not lead to an assignment: deleted no later than twelve months after the last contact.
• Assignment agreements and correspondence: kept for three years after the assignment has ended, so that we can answer questions about the delivery.
• Statutory documentation: agreement documentation we are required to keep is stored for five years after the end of the year in which the assignment was carried out.
• Image archive: original files are kept for up to ten years, so that you can get hold of the pictures again if you lose them. You can ask us to delete your archive earlier at any time.

6. Sharing with others

We never sell personal data, and we do not share it with anyone other than the data processors necessary for running the studio:

• The email and cloud storage provider, for correspondence and the image archive.
• The provider of the gallery solution used to deliver pictures.
• An external adviser who assists with statutory documentation of assignments.
• A print partner, if you order prints or albums.

All data processors are bound by data processing agreements. Data is stored within the EU/EEA. If a supplier has to transfer data to a country outside the EEA, this is done only on the basis of the European Commission's standard contractual clauses.

7. Security

The website is served over an encrypted connection (HTTPS). The image archive and correspondence sit on accounts with two-factor authentication, and private galleries are protected by unique links that expire. Only the three photographers and the retoucher at the studio have access to the image material. In the event of a personal data breach we notify the Norwegian Data Protection Authority within 72 hours, and you directly if the breach involves a high risk to your rights.

8. Your rights

At any time you have the right to:

• access the data we hold about you and receive a copy of it;
• have data corrected if it is wrong or incomplete;
• have data deleted where we no longer have a legal basis for storing it;
• request that processing be restricted while an objection is being handled;
• receive your data in a machine-readable format (data portability);
• object to processing based on legitimate interest;
• withdraw consent, without affecting the lawfulness of processing before the withdrawal.

Send a written request to [email protected] and we will reply within 30 days at the latest. If you believe we are processing data in breach of the rules, you can complain to the Norwegian Data Protection Authority.

9. Data about children

In family and newborn sessions we process data about children. Such sessions are always agreed with the parents or guardians, and pictures of children are published only after explicit written consent from everyone with parental responsibility. If the child is old enough to have an opinion about their own pictures, we ask the child as well.

10. Changes and contact

We update this policy when our services or the rules change. The date at the top shows when it was last changed. In the event of significant changes we notify clients with active assignments by email.

Questions about privacy: [email protected]. General enquiries: [email protected].