9 Reitarska Street, Studio 4, Kyiv 01054 Mon–Fri 09:00–20:00 · Sat by appointment +380 44 221 64 09 hello@lumenphotokyiv.com

Legal

GDPR & Data Protection

Updated 9 February 2026

Lumen Photo LLC ("Lumen Photo", "we", "us") is committed to protecting the personal data of all individuals who interact with us. This page describes how we comply with the EU General Data Protection Regulation (GDPR) and the applicable data protection principles of Ukrainian law for clients, website visitors and others whose data we process. We serve clients in Ukraine and the European Union and take data protection obligations in both jurisdictions seriously.

1. Data controller identity

The data controller responsible for your personal data is:

Lumen Photo LLC
9 Reitarska Street, Studio 4, Kyiv 01054, Ukraine
Email: privacy@lumenphotokyiv.com
Phone: +380 44 221 64 09

We do not currently have a formal Data Protection Officer (DPO), as our scale of processing does not require one under applicable law. Privacy enquiries should be directed to the email address above.

2. What personal data we process

We process the following categories of personal data:

  • Identity data: name and, where relevant, the names of subjects featured in a commissioned shoot.
  • Contact data: email address, phone number and postal address where provided.
  • Communication data: the content of messages sent to us via our contact form or by email.
  • Transaction data: booking details, invoices and payment records.
  • Technical data: IP address, browser type, device information and website usage data collected automatically.
  • Visual data: photographs and retouched images created during commissioned sessions (where the subject is an identifiable natural person).

We do not process special category data (such as health data, biometric data or political opinions) in the ordinary course of our business.

3. Lawful bases for processing

We process personal data under one or more of the following lawful bases set out in Article 6 of the GDPR:

  • Consent (Art. 6(1)(a)): Where you have given us clear, specific consent — for example, by submitting our contact form, accepting analytics cookies, or confirming you are happy for images to appear in our portfolio.
  • Performance of a contract (Art. 6(1)(b)): Where processing is necessary to fulfil a photography booking or to take steps prior to entering into a booking at your request.
  • Compliance with a legal obligation (Art. 6(1)(c)): Where we are required to process data by applicable law, such as Ukrainian tax and accounting requirements.
  • Legitimate interests (Art. 6(1)(f)): Where processing is necessary for our legitimate interests — including operating and securing our website, communicating efficiently, and improving our services — and those interests are not overridden by your fundamental rights and freedoms.

4. Your data subject rights

Under the GDPR and applicable Ukrainian data protection law, you have the following rights in relation to your personal data. We will respond to a verified request within one calendar month.

4.1 Right of access (Art. 15 GDPR)

You have the right to request a copy of the personal data we hold about you, together with information about how it is used, where it came from, and who it is shared with.

4.2 Right to rectification (Art. 16 GDPR)

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.

4.3 Right to erasure — "right to be forgotten" (Art. 17 GDPR)

You have the right to ask us to delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and there is no other lawful basis), where you have objected to processing and there are no overriding legitimate grounds, or where the data has been unlawfully processed. We may retain certain data where we have a legal obligation to do so or to establish, exercise or defend legal claims.

4.4 Right to restriction of processing (Art. 18 GDPR)

You have the right to request that we restrict processing of your personal data in certain circumstances: for example, while the accuracy of the data is being contested, or while an objection is being assessed.

4.5 Right to data portability (Art. 20 GDPR)

Where processing is based on consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted directly to another controller where technically feasible.

4.6 Right to object (Art. 21 GDPR)

You have the right to object to processing of your personal data where we rely on legitimate interests as our lawful basis. On receipt of an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests or we need to process the data for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes (if applicable), you have an unconditional right to object at any time, and processing for such purposes will cease immediately.

4.7 Right to withdraw consent (Art. 7(3) GDPR)

Where we process your data on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. To withdraw consent, please contact us at the address below or, for cookies, clear them in your browser settings.

4.8 Rights related to automated decision-making (Art. 22 GDPR)

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects in respect of individuals. If this changes, we will update this page accordingly.

5. How to exercise your rights

To exercise any of the rights described above, please contact us in writing:

We may ask you to verify your identity before we can action a request, to ensure data is not released to an unauthorised person. We will respond within one month. If your request is particularly complex, we may extend this period by a further two months, in which case we will notify you within the first month.

There is no charge for making a request. However, if requests are manifestly unfounded, repetitive or excessive, we may charge a reasonable fee or decline to respond in accordance with Article 12(5) GDPR.

6. International data transfers

Our primary operations and data storage are within Ukraine. Where we use third-party service providers (such as cloud hosting or analytics tools) that are based outside Ukraine or the European Economic Area, we take steps to ensure that any such transfer is made in accordance with applicable data protection law, including where necessary the use of standard contractual clauses or other approved transfer mechanisms.

7. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, as detailed in our Privacy Policy. Once data is no longer required, it is securely deleted or anonymised.

8. Security measures

We apply appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction or alteration. These measures include access controls, encrypted transmission where applicable, and internal policies governing data handling. We review our security measures periodically and update them as appropriate.

9. Supervisory authority

If you are located in the European Union and believe we have not addressed your concern adequately, you have the right to lodge a complaint with the supervisory authority in your EU member state. A list of national supervisory authorities is available on the European Data Protection Board website at edpb.europa.eu.

If you are based in Ukraine, you may direct complaints to the Ukrainian Parliament Commissioner for Human Rights (Ombudsman), who acts as the supervisory authority for personal data protection in Ukraine.

We would, however, appreciate the opportunity to address your concerns directly before you approach a supervisory authority, and encourage you to contact us first.

10. Updates to this page

We may update this GDPR & Data Protection page from time to time in line with changes to applicable law or our processing activities. The effective date at the top of this page reflects the date of the most recent revision.

11. Contact

For any data protection query, right exercise request, or complaint, please contact:

Lumen Photo LLC
9 Reitarska Street, Studio 4, Kyiv 01054, Ukraine
Email: privacy@lumenphotokyiv.com
Phone: +380 44 221 64 09