Legal
Privacy Policy
Last updated: April 2026
Data Controller
Anastasios Pantziarides, operating as TASPHO, Nicosia, Cyprus. standout@taspho.com
What We Collect and Why
Own website analytics (taspho.com)
When you accept analytics cookies, we record: anonymised IP address (last octet masked), browser and device type, approximate location (city/country derived from the anonymised IP), session identifier, and pages visited. No cross-site tracking. Legal basis: consent (Art. 6(1)(a) GDPR). Raw event data is retained for 13 months, then aggregated and permanently deleted.
Client delivery pages (proofing galleries, vault links, checkout)
When a photographer sends you a delivery link, we record access events (page visited, timestamp, anonymised IP, device type) to confirm delivery and assist with access issues. No persistent tracking cookie is set on these pages. Legal basis: legitimate interest / performance of contract (Art. 6(1)(b)/(f) GDPR). Retained for 6–13 months then deleted.
Contact form
Name, email address, and message content submitted via the contact form are used solely to respond to your enquiry. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retained for up to 2 years.
Cookies
| Cookie | Purpose | Duration | Basis |
|---|---|---|---|
| consent_analytics | Stores your analytics preference | 1 year | Functional — no consent required |
| track_sid | Anonymous session ID for own-site analytics | 1 year | Analytics — only set after you accept |
| next-auth.session-token | Authentication session (portal / admin only) | Session | Strictly necessary |
| reviewer_[slug] | Grants access to a proofing gallery you were invited to | 90 days | Strictly necessary |
You can withdraw analytics consent at any time by clicking “Decline” on the cookie banner (clear your consent_analytics cookie to see the banner again).
Third Parties
We use ip-api.com for approximate geolocation. Only the anonymised IP address is transmitted — no personal data. No analytics data is sold, shared, or sent to advertising networks.
File storage uses Cloudflare R2 (EU region). Payment processing uses Stripe; their privacy policy applies to checkout flows.
Your Rights
Under GDPR you have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to processing based on legitimate interest. To exercise any of these rights, email standout@taspho.com.
Supervisory Authority
You have the right to lodge a complaint with the Commissioner for Personal Data Protection, Cyprus (dataprotection.gov.cy).
Platform Use
If you are a client of a studio using this platform, data processing on client delivery pages (proofing galleries, vault links) is carried out on behalf of that studio under a data processing agreement. The studio is the data controller for that processing.