01 / Who is responsible?
Hedonist Photo - Visuals & SEO · CVR 43612395
Søtorvet 5, 2., 1371 København K, Denmark
contact@hedonist.photo · +45 55 20 35 13
We are the controller for the operation of 100Portraits and its shop. This notice describes personal data use; visiting the site is not consent to optional tracking. Last revised: 14 October 2026.
02 / Orders and dedications
We process your name, contact details, delivery and billing addresses, order contents, payment status and any requested dedication to fulfil the purchase, under GDPR Article 6(1)(b). Required checkout fields are needed to process and deliver the order. Please include only the recipient name and wording necessary for a dedication, not sensitive personal details. Stripe receives payment and connection information to process payments and prevent fraud; we do not receive or store your full card number.
Accounting records are retained for the current financial year plus 5 years under Danish bookkeeping requirements, Article 6(1)(c). Order and complaint records may also be retained as necessary to establish, exercise or defend legal claims, Article 6(1)(f).
PayPal receives order and connection data when its payment service is used, to process the payment and prevent fraud. Its privacy policy explains further processing and international transfers. PayPal privacy
03 / When you write to us
We use your contact details and message to respond. Enquiries about a purchase or proposed agreement are processed under Article 6(1)(b); other ordinary enquiries under Article 6(1)(f), our legitimate interest in handling correspondence. A form submission does not subscribe you to marketing. For suggestions about future participants, share only necessary public information and make sure you have permission to pass on private contact details.
Ordinary correspondence is deleted when the enquiry is resolved and it is no longer needed for follow-up or a potential claim.
04 / Security and hosting
Hostinger hosts the website. WordPress, WooCommerce and Wordfence support site operation, ordering and security. Technical records may include IP address, request time, requested pages, browser information and security events. An IP address is personal data, not automatically anonymous data. Processing necessary for availability, fraud prevention and protection against abuse relies on Article 6(1)(f). Records are kept only for as long as needed for these purposes, or for investigating a specific incident.
05 / Cookies and your choices
Necessary storage supports the shopping basket, security, login and remembering privacy choices. Optional analytics and embedded media require a separate choice before loading. You can decline optional services and still read the portraits and buy the book. Use “Cookie settings” in the footer to change or withdraw your choices. Withdrawal affects future processing and does not make earlier lawful processing unlawful.
The exhibition and shop share one Real Cookie Banner consent manager for service choices and consent records. Its settings describe the enabled services, purposes and storage lifetimes. Saved portraits, reflections, colour associations and language preference are stored locally when you use those functions; they are not sent to us. They remain until you delete the relevant selection or clear this site’s browser data.
06 / Music, film and analytics
When you allow a Spotify, YouTube or Vimeo player, the provider receives connection data, such as your IP address, browser details and the page request, and may use its own storage or connect the visit with an account you use there. This optional processing is based on consent, Article 6(1)(a). Neither the exhibition nor the shop uses analytics or advertising trackers.
07 / Recipients and international processing
Information needed to fulfil an order is shared with payment providers, the delivery provider and accounting support where necessary. Hosting and security providers process technical data. Providers may act as processors under our instructions or as independent controllers for their own legal obligations, security and payment services. Relevant provider information: Hostinger, Stripe, Wordfence and devowl.io.
Some providers operate internationally, including outside the EEA. Transfers require a valid GDPR Chapter V basis, such as an applicable adequacy decision or standard contractual clauses with any necessary supplementary safeguards. Contact us for details or a copy of the safeguards relevant to your data.
08 / Portraits and participant information
Portraits, quotations and biographies originate in the 2023 art project. They are not a claim that roles or contact details are still current. New editorial reflections are separate from participants’ own statements. Participants can contact us about corrections, permissions or objections to publication. We assess requests in light of the applicable data protection, copyright and freedom of expression rules and the project’s documented permissions.
09 / Your rights
Subject to the applicable conditions, you can request access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests and withdraw consent at any time. Write to contact@hedonist.photo. We normally respond within one month and may ask for proportionate information to verify your identity. Statutory retention duties can limit erasure.
You can complain to Datatilsynet, Denmark’s data protection authority. Our colour activity is a personal reflection tool, not a personality assessment or an automated decision about you.
