Privacy policy

Last updated: 16 October 2026

Who I am

Controller: Richard Peterson Hernández

Email: richardpetersonworks@gmail.com

Site: richardpetersonphotography.com

What I collect, and why

1. My mailing list (newsletter and print waitlist)

Data: your email address. Mailchimp also records when and through which form you signed up, which of my emails you open and which links you click.

Required: yes. I need your email to add you to the list.

Purpose: to send you my newsletter by email. It is one list, which also carries the print waitlist: news about my work and print releases, plus a welcome email when you join. Nothing else.

Legal basis: your consent (art. 6.1.a GDPR, and art. 22.2 LSSI-CE for counting opens and clicks). You give it by signing up through the form, after reading the notice above the button.

How long: until you unsubscribe or withdraw consent. After that I keep the address marked as unsubscribed, so I do not write to you again. I keep the sign-up date as proof of consent for as long as the address stays in Mailchimp.

2. Emails you send me

Data: your email address, your name if you give it, and what you write.

Purpose: to answer you.

Legal basis: my legitimate interest in answering you (art. 6.1.f GDPR). If you ask about a commission or a purchase, the steps you request before a contract (art. 6.1.b).

How long: for as long as I need them to answer you and deal with what you asked. If we do business, I keep invoices for as long as tax law requires.

3. Visitor statistics

Data: Google Analytics measures pages visited, approximate location and device. It sets cookies and measures only if you accept analytics cookies in the banner. Google's script file loads when a page opens, so Google's servers see your IP address and browser then, as any server does when it sends you a file.

Purpose: to see which pages people read.

Legal basis: your consent (art. 22.2 LSSI-CE and art. 6.1.a GDPR).

How long: Google Analytics keeps event data for 14 months. The cookies last up to two years. Details in the cookie policy.

4. Your cookie choice

Data: when the banner loads and when you choose, CookieYes stores a consent ID, the date and time, your choice, your country and a pseudonymised IP address.

Purpose: to be able to show what you chose.

Legal basis: my legal duty to demonstrate consent (arts. 6.1.c and 7.1 GDPR).

How long: up to one year.

5. Technical data and visit counts

Data: Framer hosts this site. To send you a page, it processes technical data such as your IP address and browser. Framer Analytics also counts visits without cookies: pages, country, device, browser and source. According to Framer, it uses no cookies and no persistent identifiers, and it hashes your IP address and browser data with a salt that is deleted every day.

Purpose: to run the site and see which pages people read.

Legal basis: my legitimate interest (art. 6.1.f GDPR).

How long: Framer states no retention period for the counts. The salt that hashes your IP address and browser data is deleted every day.

6. Buying on Gumroad

Data: when you buy a preset or the system, Gumroad takes your payment and sends me your name, email and country with the sale.

Purpose: to deliver what you bought, answer your questions, and ask once how it went.

Legal basis: my legitimate interest in serving the people who buy my products (art. 6.1.f GDPR). You can tell me not to write again.

How long: for as long as tax law requires me to keep sales records.

People in the photographs

The photographs on this site show people in public space. They are part of an artistic and documentary body of work. If you believe you appear in any image and would like it removed, please contact me and it will be promptly reviewed.

Who receives your data

Mailchimp (The Rocket Science Group LLC, United States): holds the list and sends my emails. Transfers rely on the EU-US Data Privacy Framework, with standard contractual clauses as a fallback.

Framer B.V. (Netherlands): hosts the site and processes the form data you send through it.

Google (United States): runs my mailbox (Gmail) and, if you accept, Google Analytics. Transfers rely on the EU-US Data Privacy Framework, which covers Google LLC.

CookieYes Limited (United Kingdom): runs the cookie banner and keeps the record of your choice. Transfers to the United Kingdom rely on the EU adequacy decision for that country.

Mailchimp, Framer and CookieYes process data on my behalf. Google processes it under its own terms. I do not sell your data. I do not share it with anyone else, except where the law requires it.

The site links to Instagram and Gumroad. They have their own policies. If you buy on Gumroad, the purchase happens there, under Gumroad's terms and privacy policy.

Tracking in my emails

Mailchimp records whether you open my emails and which links you click. I use it to see what people read. If you do not want that, you can unsubscribe at any time. I make no automated decisions about you.

Your rights

You can ask me for access to your data, correction, erasure, restriction, portability, and you can object to its use. Write to richardpetersonworks@gmail.com. You can also ask me for a copy of the safeguards that cover transfers outside the EU.

You can withdraw consent at any time. Every email has an unsubscribe link. Withdrawing does not affect what I did before.

Your right to object. Where I use your data because of my legitimate interest (answering your emails, running the site, your purchases through Gumroad), you can object at any time by writing to richardpetersonworks@gmail.com. I will stop unless I have a compelling reason not to. If you tell me not to write to you again after a purchase, I always stop.

If you think I handled your data wrongly, you can complain to the Spanish Data Protection Agency (AEPD): www.aepd.es.

Changes

If I change this policy, the date at the top changes.