Privacy notice

Who is responsible?

The controller for this photography website is Blacksunset OÜ, registry code 16513658. For website and personal-data enquiries, email anti@nulleuri.ee or call +372 58 200 900. Anti Soosaar responds on behalf of the company.

This notice covers visits to the portfolio, event galleries and journal at photography.antisoosaar.ee, and contact enquiries. Preset purchases are covered by the separate shop privacy notice.

When you get in touch

The contact form collects your name, email address, message and, optionally, a subject or project. We use these details to reply, discuss the collaboration you requested and, where relevant, prepare a contract. The form sends the enquiry by email; its own sending code does not create a separate WordPress message archive.

Preparing a contract at your request relies on Article 6(1)(b) of the General Data Protection Regulation. Other enquiries and communication with business representatives rely on Article 6(1)(f): our legitimate interest in answering incoming questions and organising collaboration. Article 6(1)(c) applies where processing is required by law.

Providing data is voluntary, but we need a working contact address and a message to reply. The subject is optional. Please do not send sensitive personal data that is unnecessary for your enquiry. Sending an enquiry does not subscribe you to a newsletter.

Site operation and security

A web request involves technical data such as an IP address, time, requested address and browser information. These may be needed to deliver the site, investigate an error or security incident, and prevent abuse. The basis is our legitimate interest in keeping the site and communication channels operational and secure.

The contact form limits repeated submissions using a temporary record keyed by a hash derived from the IP address, with a 60-second lifetime. This is separate from any hosting access and security logs.

Cookies and visitor statistics

We use Google Analytics only with your consent (GDPR Article 6(1)(a)). Before consent, the photography measurement integration neither loads Google Analytics nor sends measurement requests. Refusing does not prevent you from viewing the portfolio or getting in touch.

With permission, measurement includes visited page addresses, visit times, site interactions, browser and device information, approximate location, and random visitor and session identifiers. Google states that IP addresses are used to derive approximate location and are not stored in Analytics data. The photography measurement integration does not send contact-form names, email addresses or message contents to Google. Google Signals and advertising-personalisation signals are disabled.

cookieyes-consent remembers your cookie choice for up to 365 days. wp_consent_statistics and wp_consent_statistics-anonymous pass on your choice for up to 30 days. These cookies are necessary to manage your preference. CookieYes runs as a local WordPress interface on this site.

_ga and _ga_ZDQ43HP865 are optional Google Analytics cookies used to distinguish visits and sessions. They are configured for this photography host with a lifetime of up to one year. Cookie expiry may renew following a new choice or a permitted visit; cookie lifetime is not the same as retention on Google servers.

While analytics is enabled, you can withdraw consent using “Cookie settings” in the footer: disable analytics and save your choice. Withdrawal stops further measurement in that document without affecting the lawfulness of earlier processing. If you grant permission again, it takes effect when you open or reload a page. Deleting preference cookies causes the site to ask for your choice again.

Providers and international transfers

Anti Soosaar and authorised providers may process data as needed for hosting, email delivery and receipt, and technical maintenance. This site uses Hostinger web hosting. An email is also processed by the sender’s and recipient’s email providers. Where required by law, data may be received by a competent authority or an adviser dealing with a legal claim.

With your permission, visit data is sent to Google to provide Google Analytics. Google uses international infrastructure and subprocessors, so processing may take place outside the European Economic Area, including in the United States. Google describes its transfer safeguards as the applicable EU-US Data Privacy Framework and, where needed, European Commission Standard Contractual Clauses. Details and safeguards are available in Google’s international-transfer information and data-processing terms.

Following a link to Instagram or another external site brings you under that service’s privacy terms. An external link is not the same as tracking code embedded in this page.

How long is data kept?

Enquiries and correspondence are kept as needed to resolve the enquiry and organise the agreed collaboration. Further retention depends on whether communication is ongoing, the data evidences an agreement or fulfilled obligation, and whether a legal obligation or a justified need to establish or defend a legal claim remains. When those grounds no longer apply, the data should be deleted or anonymised.

For technical logs, retention is determined by investigating errors or security incidents and preventing repeated abuse. For backups, the criteria are whether the copy is still needed to restore the system or data and when it is replaced. Mailboxes, provider logs and backups are retained according to their respective purposes. You can ask the contact above about retention of your particular enquiry.

The current Google Analytics property settings retain event-level data for 2 months and user-level data for 14 months; new user activity may restart the user-data period. These settings do not cover most standard reports based on aggregated data. Browser-cookie lifetimes are listed above.

Your rights

You can request access, correction, erasure or restriction of your personal data. Where the law provides, you can request data portability. You may object to processing based on legitimate interests on grounds relating to your situation. You can withdraw consent at any time.

Email anti@nulleuri.ee. Where necessary, we may request proportionate identity verification to fulfil your request. We normally respond within one month; for complex requests, we will explain any legally permitted extension and its reason. The scope of each right depends on the processing and applicable law.

Within the scope of this notice, we do not make automated decisions about you that have legal or similarly significant effects. If your request concerns your appearance in a published photograph, please include a photograph or gallery link where possible so we can assess the circumstances.

You can complain to the Estonian Data Protection Inspectorate or the data-protection authority where you live, work or consider an infringement to have occurred. If processing changes materially, we will update this notice and provide the necessary information before a new purpose is introduced.