1. Data Controller

EastLabsPhoto.com ("we", "us", or "our") is the data controller responsible for your personal data collected through this website.

Contact: [email protected]

2. Personal Data We Collect

When you place an order, we collect:

• Name (first and last name) - to identify your order
• Email address - to send order confirmations and delivery links

We also automatically collect:

• IP address - for security and fraud prevention
• Browser/device information - for technical support

3. How We Use Your Data

We use your personal data to:

• Process and fulfill your photo/video orders
• Send order confirmations and delivery notifications
• Provide customer support
• Prevent fraud and abuse
• Comply with legal obligations

4. Legal Basis

We process your personal data based on:

• Contract performance (GDPR Art. 6(1)(b)) - processing orders you place with us
• Legitimate interests (GDPR Art. 6(1)(f)) - fraud prevention and security
• Legal obligation (GDPR Art. 6(1)(c)) - tax and accounting records

5. Data Retention

We retain your personal data for:

• Order data: 7 years (for tax and accounting purposes)
• Email delivery logs: 1 year
• Security logs (IP addresses): 90 days

6. Third-Party Services

We share data with the following categories of service providers:

• Payment processors - to process your payments securely (they have their own privacy policies)
• Email delivery services - to send order confirmations and delivery links
• Cloud hosting providers - to host our website and database
• Error monitoring services - to identify and fix technical issues (with PII masking enabled)

All service providers are GDPR-compliant and process data on our behalf.

7. Processing of Athlete Image Data

In addition to the personal data listed above, we process photos and videos of athletes captured during IFBB competitions. This processing is based on (a) our legitimate interest in promoting our professional photo and video work (GDPR Art. 6(1)(f)), (b) our duties as the federation's official media partner, and (c) the consent given by athletes to the federation at competition registration.

Full terms of use, including your right to object and the 30-day removal window, are set out in sections 7 and 8 of our Terms of Service.

8. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access - request a copy of your personal data
• Rectification - correct inaccurate data
• Erasure - request deletion of your data ("right to be forgotten")
• Data portability - receive your data in a portable format
• Object - object to certain processing
• Complaint - lodge a complaint with a supervisory authority

9. Cookies

We use cookies for:

• Essential cookies - required for the website to function
• Analytics cookies - to understand how visitors use our site (only with your consent)

You can manage cookie preferences through the cookie banner or your browser settings.

10. Security

We protect your data with:

• HTTPS encryption for all data transmission
• Industry-standard password hashing
• Rate limiting to prevent abuse
• Regular security audits

11. Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via email or website notice. The "last updated" date at the top indicates the latest revision.

12. Contact Us

For any privacy-related questions or concerns, please contact us at: [email protected]