Privacy Policy
Last updated: May 2026
This policy explains what personal data Alexander Krohn Photography collects, why, and how it is handled. The site is operated by Alexander Krohn, based in Vaasa, Finland (alex@alexanderkrohn.com).
What data is collected and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, message (contact form) | Responding to enquiries | Legitimate interest | Until deleted from inbox |
| Name, email, postal address, phone (print orders) | Fulfilling print orders | Contract performance | 1 year |
| Name, email, postal address, VAT number (invoicing) | Issuing invoices and meeting accounting obligations | Contract performance; legal obligation (Accounting Act) | 7 years |
| IP address (contact form, order form, site login) | Rate limiting to prevent abuse | Legitimate interest | 15 minutes – 1 hour |
Session cookie (ak_session) |
Keeping you signed in to the private portfolio | Strictly necessary | 24 hours |
Session cookie (gallery_session) |
Keeping you signed in to your client gallery | Strictly necessary | 7 days |
| Photo selections / favourites | Saving your marked photos in your client gallery | Contract performance | Duration of gallery |
No data is sold or used for advertising. No tracking cookies or third-party analytics pixels are used.
Cookies
This site uses only strictly necessary session cookies. They are required for the private portfolio and client gallery to function. No consent is needed for strictly necessary cookies under the ePrivacy Directive.
No advertising, analytics, or cross-site tracking cookies are set.
Third-party processors
The following companies process personal data on this site's behalf:
- Cloudflare, Inc. — infrastructure, hosting, and CDN. All web traffic passes through Cloudflare's network. Data processing agreement in place. Cloudflare Privacy Policy.
- Resend — transactional email delivery. Email addresses submitted via the contact form, print order form, and invoice emails are processed by Resend. Data processing agreement in place. Resend Privacy Policy.
No other third parties receive your personal data.
Your rights
Under the GDPR and Finnish data protection law (tietosuojalaki 1050/2018), you have the right to:
- Access — request a copy of the personal data held about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your data (subject to legal retention obligations)
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interest
- Restriction — request that processing be restricted while a dispute is resolved
To exercise any of these rights, contact alex@alexanderkrohn.com. Requests will be handled within 30 days.
You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
Data security
All data is transmitted over HTTPS. Session tokens are signed with HMAC-SHA256 and stored as HttpOnly cookies. Access to client galleries and the private portfolio is protected by PIN or password authentication with rate limiting.
Changes to this policy
If this policy changes materially, the "last updated" date at the top will be revised. Continued use of the site after changes constitutes acceptance.
Contact
Alexander Krohn
Vaasa, Finland
Y-tunnus 3628304-9
alex@alexanderkrohn.com