Privacy policy

When you write to me through this site, you trust me with some of your details. Here is what they are, what I do with them and how long I keep them, as plainly as I can put it.

Who is responsible

Vagelis Benetatos (FotoPaths). For anything about your details: [email protected] or by phone on +30 693 183 1232.

What I keep

• From the contact form: your name, email, phone if you give it, the kind of event, the date and venue, the number of guests, the coverage you want and whatever you write in your message. The time you sent it, the language, the page you sent it from and, if known, the page or site you came from are kept with it.
• To keep spam out: the form uses Cloudflare Turnstile, which checks that a person is sending it. Your IP address is not stored. Only a one way fingerprint of it (a hash) is kept for 24 hours, so that dozens of messages cannot be sent from the same connection.
• If you email me directly, I keep our correspondence.

Why

To reply to you and, if you want, to send you a proposal for your day. The legal basis is taking steps you asked for before a possible agreement (Article 6(1)(b) GDPR). The spam check relies on my legitimate interest in protecting the form (Article 6(1)(f)).

Your email address automatically receives a short confirmation that your letter reached me, with nothing you wrote in it except your first name. I do not send newsletters, and I never sell or give your details to anyone for advertising.

Who processes them for me

• Cloudflare: hosts the site and the form, keeps the copy of the messages and runs the Turnstile check.
• Google (Workspace): the [email protected] mailbox where messages arrive.
• Resend: sends me the notification for each new form message and sends you the short confirmation, from the address send.fotopaths.com. The notification contains what you wrote in the form.
• Sanity: the site's photographs load from its network (cdn.sanity.io). Like any server, it sees your IP address in order to send them. It receives nothing from the form.
• Google (Analytics): only if you allow it, counts visits to the site (see "Cookies, statistics and video" below). It receives nothing from the form.

Some of these companies are based, or have servers, outside the European Union. Transfers rely on the safeguards the GDPR provides: the EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission's standard contractual clauses.

How long

• Messages sent through the form: 12 months from the day you sent them. Then they are deleted automatically, without you having to ask.
• Our email correspondence, where the notification of your message also arrives: if we do not work together, 12 months after our last contact, and then I delete it. If we work together, as long as the work needs, and as long as tax law requires for invoices.
• The IP fingerprint used against spam: 24 hours, and then it too is deleted automatically.

Cookies, statistics and video

The site sets no advertising cookies and does not follow you from site to site. Videos (YouTube, Vimeo) load only when you press play, and then that service's terms apply.

Visitor statistics: only if you press "OK" in the cookie message does the site load Google Analytics 4, so that I can see how many people visit, which pages they read and where they come from. Then the cookies _ga and _ga_… are set, holding a random code that tells visits apart, for up to 6 months. Google signals and ad personalisation are off. If you press "No, thanks", Google Analytics does not load at all. The legal basis is your consent (Article 6(1)(a) GDPR). Google Analytics keeps this data for 14 months.

Your choice stays in this browser only, for 6 months, and you can change it at any time in the Cookie settings.

Photographs on the site

Photographs from weddings, christenings and proposals are published with the couple's agreement: the proposal we sign includes their use in my portfolio, this site among it. If you are in one and would like it removed, write to me and I will take it down.

Your rights

You can ask to see your details, correct them, delete them, restrict their use, receive them in a file, or object to their use. Write to me at [email protected] or through the contact page, and I will answer within one month at the latest, as the law requires. If you think something is not handled properly, you can complain to the Hellenic Data Protection Authority (www.dpa.gr).

Last updated: 26 September 2026