Privacy Policy

01 Introduction

Foto Phactory ("Foto Phactory," "we," "us," or "our") is a premium wedding photography and cinematography studio founded by Sashi Roy, based in Patna, Bihar, India, and operating through our website fotophactory.in (the "Site"). This Privacy Policy describes how we collect, use, store, share, and protect personal information gathered through our Site, our social media pages, WhatsApp, phone calls, in-person consultations, and while providing photography, cinematography, and related creative services (collectively, the "Services").

By visiting our Site, submitting a form, messaging us on WhatsApp, or booking a Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, please do not use our Site or Services, or contact us at the details below to discuss your concerns.

This Policy is drafted to align with recognised data protection frameworks, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and India's Digital Personal Data Protection Act, 2023 (DPDP Act), along with Google's Search, Advertising, and Analytics policies applicable to our use of Google Analytics 4, Google Ads, and Meta Pixel.

02 Who We Are

For the purposes of applicable data protection laws, Foto Phactory acts as the Data Controller (GDPR terminology) or Data Fiduciary (DPDP Act terminology) in respect of personal data collected through the Site and Services.

03 Information We Collect

We collect information in the following categories, depending on how you interact with us:

a. Information You Provide Directly

• Full name, phone number, email address, and city, submitted via our contact form, booking form, or enquiry widget
• Wedding, event, or shoot details (date, venue, type of Service, guest count, preferences) shared for quotation and planning purposes
• Messages, photographs, or documents shared with us over WhatsApp, phone, email, or in-person meetings
• Billing information such as billing name, address, and GST details (where applicable) for invoicing
• Payment-related information such as transaction ID, payment method, and payment status (we do not store full card numbers, CVV, or UPI PINs — see Section 9)
• Testimonials, reviews, or feedback you choose to share with us

b. Information Collected Automatically

This information is collected via cookies, pixels, and similar technologies as described in Sections 6 and 7.

c. Information From Third Parties

• Publicly available information from your Instagram, Facebook, or WhatsApp profile when you contact us through those platforms
• Information shared by wedding planners, venues, or vendors coordinating on your behalf, with your consent
• Aggregated, non-identifying analytics data from Google Analytics 4, Google Ads, and Meta Pixel

d. Photographs, Videos & Creative Content

As a photography and cinematography studio, we capture images and video footage of you, your family, and your guests during shoots and events. This visual content is treated as personal data where individuals are identifiable, and is handled in accordance with Section 10 (Photography & Media Usage).

04 How We Use Your Data

We use the information we collect to:

• Respond to enquiries and provide quotations for wedding, pre-wedding, maternity, baby, birthday, couple, family, corporate, product, and commercial photography or films
• Confirm, schedule, and coordinate bookings, shoots, and events, including drone photography where permitted
• Process payments, issue invoices, and maintain financial records
• Deliver photographs, films, and edited media to you
• Communicate updates via call, SMS, email, or WhatsApp regarding your booking
• Improve our Site, Services, and customer experience through analytics
• Run marketing and remarketing campaigns via Google Ads and Meta (Instagram/Facebook) with your consent
• Showcase select, consented work in our portfolio, social media, and website
• Comply with legal, tax, and regulatory obligations in India
• Detect, prevent, and address fraud, spam, or misuse of our forms and Services

05 Legal Basis for Processing

Where GDPR applies (for example, to destination wedding clients based in the EU/UK), we rely on the following legal bases:

• Consent — for marketing communications, cookies, and use of images in promotional material
• Contract performance — to process bookings, deliver Services, and handle payments
• Legitimate interest — to improve our Site, prevent fraud, and maintain business records
• Legal obligation — to comply with Indian tax, accounting, and consumer protection laws

Under the DPDP Act, 2023, we process personal data based on your free, informed, specific, and unambiguous consent, or where permitted for "certain legitimate uses" recognised under the Act, such as fulfilling a service you have voluntarily requested.

06 Cookies & Tracking Technologies

Our Site uses cookies and similar technologies to operate correctly, remember your preferences, and understand how visitors use our Site.

On your first visit, a cookie consent banner allows you to accept, reject, or customise non-essential cookies. You can change your preferences at any time via the "Cookie Settings" link in our website footer, or by adjusting your browser settings to block or delete cookies. Blocking essential cookies may affect Site functionality.

07 Analytics, Meta Pixel & Google Ads

Google Analytics 4 (GA4)

We use GA4 to understand how visitors interact with our Site — pages viewed, time spent, device type, and general location. GA4 data is processed by Google in accordance with the Google Privacy Policy. IP addresses are used only in an aggregated, anonymised form for reporting.

Meta Pixel (Instagram & Facebook)

We use Meta Pixel to measure the effectiveness of our Instagram and Facebook advertising and to build remarketing audiences of visitors who may be interested in our photography and cinematography Services. Meta processes this data under its own Privacy Policy.

Google Ads & Remarketing

We may run Google Ads campaigns and use conversion tracking and remarketing to show relevant ads to past visitors across the web. You can opt out of personalised advertising using Google Ads Settings or the Digital Advertising Alliance opt-out tool.

08 WhatsApp Business Communication

We use WhatsApp Business (+91 70504 78772) to communicate with clients regarding enquiries, bookings, shoot coordination, and delivery of previews. When you message us on WhatsApp:

• Your phone number, profile name, and messages are visible to us and stored to maintain a record of your booking and communication history
• WhatsApp (Meta) processes messages in accordance with the WhatsApp Privacy Policy
• We may send booking confirmations, reminders, previews, and invoices via WhatsApp; you may request to stop receiving non-essential messages at any time
• Please do not share sensitive information such as full payment card details over WhatsApp

09 Website Forms, Bookings & Payment Collection

Contact & Enquiry Forms

Fields marked mandatory (typically name, phone number, and Service of interest) are required to respond to your enquiry. Optional fields help us tailor our response but are not required to submit the form.

Booking Forms

Booking forms collect event details necessary to plan and deliver your shoot, including date, venue, package selected, and any special requirements. This information is used solely for planning, staffing, and delivering your booked Service.

Payment Collection

Advance payments, booking deposits, and balance payments may be collected via bank transfer, UPI, or a third-party payment gateway. Where a payment gateway is used, your card, UPI, or banking details are processed directly by the gateway provider under its own PCI-DSS-compliant security standards — Foto Phactory does not store your complete card number, CVV, or banking credentials on our servers. We retain only transaction references (amount, date, status, and transaction ID) for accounting and invoicing.

Spam & Security

We may use basic bot-detection (such as honeypot fields or CAPTCHA) on our forms to prevent spam and abuse.

10 Photography & Media Usage Rights

As is standard practice in the photography and videography industry:

• Foto Phactory retains copyright ownership of all original photographs and films it creates, unless otherwise agreed in a separate written contract
• Clients receive a licence to use delivered photographs and films for personal, non-commercial purposes
• We may use select images and footage from your shoot for our portfolio, website, social media (Instagram, Facebook, YouTube), and marketing materials, unless you opt out in writing before or at the time of booking
• If you prefer that your images not be used publicly, please inform us in writing (email or WhatsApp) prior to your shoot, and we will honour a reasonable "do-not-publish" request
• Raw, unedited footage and files are retained temporarily for editing purposes and are not distributed publicly
• Any identifiable third parties (e.g., guests at a wedding) appearing in delivered media are treated with the same confidentiality standards as our direct clients

11 Sharing of Information

We share personal data only where necessary, including with:

• Service providers — payment gateways, cloud storage/hosting providers, and editing/production freelancers bound by confidentiality obligations
• Analytics & advertising partners — Google (GA4, Google Ads) and Meta (Instagram/Facebook Pixel, WhatsApp Business), as described in Sections 6–8
• Vendors and collaborators — venues, planners, or associate photographers/videographers involved in delivering your event, where relevant
• Legal & regulatory authorities — where required by Indian law, court order, or to protect our legal rights
• Business transfers — in the event of a merger, acquisition, or restructuring of Foto Phactory, with continued protection under this Policy

We do not sell, rent, or trade your personal data to third parties for their independent marketing use.

12 Data Storage & Security

We implement reasonable technical and organisational safeguards appropriate to the nature of the data we hold, including:

• Encrypted website connections (HTTPS/SSL)
• Access controls limiting who at Foto Phactory can view client data and media
• Secure, password-protected cloud storage for photographs, films, and client records
• Regular backups of delivered media during the agreed retention period

While we take security seriously, no method of transmission or storage over the internet is 100% secure. We cannot guarantee absolute security but will notify affected individuals and relevant authorities in the event of a data breach, as required under applicable law.

13 Data Retention

You may request earlier deletion of your data, subject to our legal obligation to retain certain financial and business records.

14 International Data Transfers

Foto Phactory is based in Patna, Bihar, India, and primarily stores data within India. However, some third-party service providers we use (such as Google, Meta, and certain cloud storage or payment platforms) may process or store data on servers located outside India, including in the United States or European Union. Where this occurs, such providers maintain their own compliance frameworks (such as Standard Contractual Clauses under GDPR) to protect your data during international transfer.

15 Your Rights Under GDPR (EU/UK Visitors)

If you are located in the European Economic Area or United Kingdom, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure ("right to be forgotten"), subject to legal retention requirements
• Restrict or object to certain processing, including direct marketing
• Request data portability in a machine-readable format
• Withdraw consent at any time, without affecting prior lawful processing
• Lodge a complaint with your local data protection supervisory authority

16 Your Rights Under CCPA (California Visitors)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information, subject to legal exceptions
• Opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising (we do not sell personal data; certain analytics/advertising cookies may qualify as "sharing" under CCPA, and you may opt out via our cookie settings)
• Non-discrimination for exercising your privacy rights
• Designate an authorised agent to make a request on your behalf

17 Your Rights Under India's DPDP Act, 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we process about you and the processing activities involved
• Correction and updating of inaccurate or incomplete personal data
• Erasure of personal data that is no longer necessary for the purpose it was collected, subject to legal retention requirements
• Grievance redressal through our designated Grievance Officer (Section 21)
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity
• Withdraw consent at any time for consent-based processing, as easily as it was given

To exercise any of the above rights (under GDPR, CCPA, or the DPDP Act), please contact us using the details in Section 22. We will respond within the timelines required under applicable law, generally within 30 days.

18 Children's Privacy

Our Site and Services are intended for adults capable of entering a binding contract. We do not knowingly collect personal data directly from children via our website forms. Where we photograph or film children as part of baby, maternity, birthday, or family Services, this is done with the consent and under the supervision of the child's parent or legal guardian, who is treated as the primary point of contact for all data and consent matters relating to that child.

19 Third-Party Links

Our Site and social profiles may contain links to third-party websites or platforms, including Instagram, Facebook, YouTube, and payment gateways. We are not responsible for the privacy practices of these third parties. We encourage you to review their respective privacy policies before sharing personal information with them.

20 Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or Services. The updated version will be posted on this page with a revised "Last Updated" date. We encourage you to review this Policy periodically. Continued use of our Site or Services after changes take effect constitutes acceptance of the revised Policy.

21 Grievance Officer

In accordance with the Digital Personal Data Protection Act, 2023 and applicable Indian IT rules, the Grievance Officer for Foto Phactory is:

Any complaints, concerns, or requests relating to your personal data may be addressed to the Grievance Officer, who will acknowledge and resolve valid grievances within the timelines prescribed under applicable law.