Privacy Policy

This Privacy Policy explains how Photographer Kyoto ("we", "us", or "our") collects, uses, stores, and protects personal information when you visit our website, submit a booking enquiry, or book a photography session with us. We aim to comply with applicable laws including Japan's Act on the Protection of Personal Information (APPI), the EU General Data Protection Regulation (GDPR) where it applies, and relevant United States privacy laws.

1. Data controller

Business name: Photographer Kyoto
Location: Kyoto, Japan
Email: [email protected]

For privacy-related requests, contact us at the email above. We will respond within a reasonable period and, where required by law, within 30 days.

2. Personal information we collect

We may collect the following categories of personal information:

• Contact details: name, email address, and any phone number you provide.
• Booking information: preferred package, travel dates, group size, location preferences, and messages you send through our enquiry form.
• Session-related information: details needed to plan and deliver your shoot (e.g. hotel meeting point, kimono arrangements, accessibility needs).
• Payment information: if you pay for a session, payment is processed by our chosen payment provider. We do not store full card numbers on our servers.
• Photographs: images of you and your party taken during sessions. These may identify you.
• Technical data: basic server logs (such as IP address, browser type, and request time) generated when you visit our site.

We do not intentionally collect sensitive personal information (such as health data) unless you voluntarily share it to help us plan your session.

3. How we collect information

• Directly from you — via our booking form, email, or messages during session planning.
• Automatically — limited technical data when you load our website.
• From third parties — only where relevant to your booking (for example, a kimono rental studio you ask us to coordinate with).

4. Purposes and legal bases

We use personal information only for clear purposes. Where GDPR applies, our legal bases are noted below.

Purpose	Legal basis (GDPR)
Responding to enquiries and preparing quotes	Contract (pre-contractual steps) / Legitimate interests
Planning, conducting, and delivering photography sessions	Contract
Processing payments and maintaining business records	Contract / Legal obligation
Delivering edited photos via Google Drive or USB	Contract
Customer support and dispute resolution	Contract / Legitimate interests
Website security and abuse prevention	Legitimate interests
Portfolio or marketing use of session photos	Consent (only with your explicit agreement)

5. Cookies and similar technologies

Our website is largely static. We do not use advertising or analytics cookies.

• Theme preference: we may store your light/dark theme choice in your browser's local storage.
• Third-party resources: we load fonts (Google Fonts) and scripts (CDN hosts) that may set or read technical data. These are used to display and operate the site.

Under Japan's APPI and telecommunications rules, we disclose this use transparently. If we introduce non-essential tracking in future, we will update this policy and obtain consent where required.

6. Sharing with third parties

We do not sell your personal information. We share data only when necessary:

• Cloudflare — processes booking form submissions (infrastructure provider).
• Google — Google Drive for photo delivery; Google Fonts for typography.
• Payment processors — when you pay for a session (provider named at checkout).
• Shipping carriers — if you order USB delivery, name and postal address are shared for shipping.
• Service partners — such as kimono studios or transport providers, only when you ask us to coordinate on your behalf.
• Legal requirements — if required by law, court order, or to protect rights and safety.

Each provider processes data under their own terms and, where applicable, data processing agreements.

7. International data transfers

We are based in Japan. Some service providers (for example Cloudflare and Google) may process data in the United States or other countries. Where GDPR applies and data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the provider's standard contractual clauses or equivalent mechanisms, unless an adequacy decision applies.

Under APPI, we take reasonable steps to ensure that overseas recipients maintain comparable protections when your information is transferred internationally.

8. Retention

• Enquiries not converted to bookings: typically up to 24 months, then deleted or anonymised.
• Client and booking records: retained for the duration of our relationship and up to 7 years afterward where needed for tax, accounting, or legal claims.
• Delivered photographs: retained on our systems only as long as needed to provide delivery, backup, and support unless you request earlier deletion (subject to legal retention duties).
• Server logs: typically up to 90 days.

9. Security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, or misuse. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

If a data breach likely affects your rights, we will notify you and relevant authorities as required by APPI, GDPR, or other applicable law.

10. Your rights

Depending on where you live, you may have some or all of the following rights:

• Access — request a copy of personal information we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion where we have no lawful reason to keep the data.
• Restriction — request that we limit how we use your data in certain cases.
• Portability — receive data you provided in a structured, machine-readable format (GDPR).
• Objection — object to processing based on legitimate interests (GDPR).
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Opt out of sale/sharing — we do not sell personal information. California residents may contact us to confirm their status.

To exercise these rights, email [email protected]. We may need to verify your identity before responding.

Japan (APPI)

You may request disclosure, correction, cessation of use, or deletion of retained personal data as provided under APPI. We may charge a reasonable fee for disclosure requests where permitted by law.

European Economic Area & UK (GDPR)

You have the right to lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available from the European Data Protection Board.

United States

Residents of California and certain other states may have additional rights if applicable law covers our business. At our current scale we do not sell or share personal information for cross-context behavioural advertising. If that changes, we will update this policy and provide required notices.

11. Children

Our services are not directed at children under 16. We do not knowingly collect personal information from children without parental consent. Family sessions may include children as subjects; in that case, a parent or guardian must make the booking and provide consent.

12. Photography and likeness

Photographs taken during your session may identify you. We use session images to deliver your order. Any use on our website, social media, or marketing materials requires your separate explicit consent.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes will be posted on this page. Continued use of our website after changes constitutes acknowledgement of the updated policy where permitted by law.

14. Contact

Questions or requests regarding this policy:
[email protected]
Kyoto, Japan

This policy is provided for transparency and compliance purposes. It is not legal advice. If you need advice for your specific situation, consult a qualified attorney in your jurisdiction.