Privacy Statement - Aaron Roberts Photographer

1. Who is responsible

This website (aaronlroberts.com) is run by Aaron Roberts, a photographer based in Cluj-Napoca, Romania. I am the “controller” of the personal data described here. For anything to do with your data, email [email protected]. I’m a one-person business, so you’ll always be dealing with me directly.

2. Messages, TFCD requests and casting applications

When you use the contact form, send a TFCD (time for content) request or apply for a casting, I receive the details you type in: your name, email address, your message and anything optional you add, such as an Instagram or portfolio link, phone number, age, where you’re based or dates. The form also stores your IP address and browser type with the message, to stop spam and abuse.

Why: to reply to you, plan a session or consider you for a casting.
Legal basis: taking steps at your request before we agree on a session (GDPR Article 6(1)(b)); for casting applications, your consent, which you give with the tick box and can withdraw at any time (Article 6(1)(a)); for the IP address, my legitimate interest in keeping the forms free of spam (Article 6(1)(f)).
Castings are only open to adults (18+). Please don’t send health information or other special category data – it isn’t needed.

A copy of each message is emailed to me. If you email me directly, the same applies to your email.

3. People in my photographs

Portraits on this website are published with the agreement of the people in them – usually a written model release or a TFCD agreement made before or at the shoot, which sets out how the photos may be used. The legal basis is that agreement (Article 6(1)(b)) or your consent (Article 6(1)(a)).

On the pages themselves, models are named by first name and initial (for example “Abigail J”). The text descriptions of the images (used by screen readers and search engines) may include the model’s name.
Galleries with artistic nudity (Nude and Boudoir) are blurred until a visitor confirms they are 18 or over.
Original files keep their photo metadata (camera, lens, date and copyright details).

Changing or removing photos of you: if you appear in a photo on this website, use the photo removal request form or email [email protected] with a link to the page. I’ll reply within one month, as the GDPR requires – in practice usually within a few days, and first if you mention your safety. Data protection requests are always free: where photos are published on your consent you can withdraw it at any time, and you can object to their use; I’ll stop unless a signed release or another strong legal reason allows me to continue, which I’d explain. Removing your name, hiding photos or taking a session off the homepage is always free too. Full removal of a session covered by a signed release purely because you’ve changed your mind is a contractual matter covered by the Terms & Disclaimer. I keep signed model releases for as long as the photos are used and for the period in which legal claims could be made afterwards.

4. When you browse this website

Without your consent the website only uses what it needs to work: a cookie remembering your cookie choices, one remembering your 18+ confirmation if you give it, and a temporary cookie when you open a form. Details are in the cookie policy.
With your consent (Article 6(1)(a) GDPR and Article 4(5) of Romanian Law 506/2004), Google Analytics 4 records how the site is used: pages viewed, approximate location (country/city), device and browser type and how you arrived. Google Analytics doesn’t store full IP addresses. It is only switched on if you choose “Accept” or allow statistics in the cookie settings, and you can withdraw that at any time with “Cookie settings” at the bottom of every page.
Like every web server, the hosting server keeps short-term technical logs (IP address, page requested, time, browser) for security and to fix problems (legitimate interest, Article 6(1)(f)).

I don’t sell or share your data for marketing. These service providers process some of it on my behalf, under data processing terms:

Web hosting – the server this website and its database run on (in the EU).
Cloudflare – delivers the website securely and quickly and filters malicious traffic; it sees IP addresses and runs the Turnstile spam check on the forms.
Email – messages reach me through my email provider (Zoho, EU data centre).
Google Ireland Ltd – Google Analytics, only with your consent. Google may transfer data to the USA under the EU–US Data Privacy Framework.

I may also disclose data if the law requires it.

6. How long data is kept

Contact messages and TFCD requests: up to 2 years after our last conversation, unless we work together (then as long as needed for that work and for accounting rules).
Casting applications: until the casting is finished and for up to 12 months afterwards, so I can contact you about similar projects – or until you ask me to delete them.
Google Analytics data: 14 months.
Model releases: while the photos are published and for the legal limitation period after that.

7. Your rights and how to complain

Under the GDPR you can ask for a copy of your data (access), have it corrected, deleted or restricted, receive it in a portable format, object to processing based on legitimate interests, and withdraw consent at any time (this doesn’t affect anything done before you withdrew it). Email [email protected] – it’s free and I’ll answer within one month.

If you’re unhappy with how I’ve handled your data, you can complain to the Romanian data protection authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro, or to the authority in the EU country where you live. I’d appreciate the chance to sort it out first.

This website isn’t aimed at children and doesn’t knowingly collect data from anyone under 16.

Last updated 5 October 2026. If this statement changes, the new version will be published here.