Privacy policy

Controller and contact

TxokoFoto is the trading name. The legal controller must be identified in the operator section. Contact hola@txokofoto.com for privacy and reservas@txokofoto.com for quotations.

Information and purposes

Enquiries may include your name, email, optional phone, date, venue and event details. They are used to reply, check availability and prepare a proposal. A booking also requires information to perform the service, issue invoices and meet legal obligations. Do not include unnecessary guest or sensitive data.

Legal bases

Requested pre-contractual steps and performance of a contract may rely on GDPR Article 6(1)(b); invoicing and legal duties on Article 6(1)(c). Optional analytics relies on consent under Article 6(1)(a). Promotional use of photographs requires its own lawful basis and image permission where applicable; booking does not automatically authorise publication.

Photographs and galleries

Before the event, the parties must agree recipients, access and availability periods. An unlisted URL alone is not access control. The organiser and TxokoFoto must define responsibilities, attendee information and, if relevant, a processing agreement. Images of children require particular care.

Browsing and assistant

Hosting may process IP addresses, browser details and technical logs to deliver and secure the site. With consent, Google Analytics through Google Tag Manager measures browsing and quote clicks, potentially using browser identifiers. We do not describe all measurement as anonymous.

The assistant answers locally in your browser using predefined responses. Chat text is not sent to an AI provider and is lost on reload. Google Forms works separately.

Providers and international transfers

The website uses Vercel hosting and configured Google services for forms, email, measurement or file delivery. Social platforms have their own policies. Actual contracts, processing locations and recipients must be checked per service. Transfers outside the EEA need valid safeguards under GDPR Chapter V.

Retention

Information should be kept only as needed for the enquiry and service, and for applicable legal or liability periods afterwards. Unconverted enquiries, event files and backups need defined retention and deletion rules. Gallery periods must be agreed before the service. The website's analytics preference expires after 180 days; analytics-provider retention depends on its configuration.

Your rights

Where applicable, you may request access, rectification, erasure, restriction, objection and portability, and withdraw consent without affecting previous lawful processing. Contact hola@txokofoto.com; additional identity information is requested only where necessary and proportionate. Replies are normally due within one month, subject to justified GDPR extensions. You can complain to the Spanish Data Protection Agency at www.aepd.es.

Before sending a form

The external form must explain the controller, purpose, legal basis and privacy link before collecting data. This webpage does not replace information inside the form.