Privacy Policy

01Who we are and what this policy covers

Lulan Studio ("Lulan Studio", "we", "us", "our") is a wedding photography and cinematography studio founded in 2016, with its studio at 620 S Main St, Los Angeles, California 90014. We are the business responsible for the personal information described here — in European terms, the data controller.

This Privacy Policy applies to personal information we collect through:

• our website at lulanstudio.com and every page and form on it, including inquiry forms, contact forms and scheduling links;
• our client gallery service at gallery.lulanstudio.com;
• email, text message, phone calls and messaging apps you use to reach us;
• consultations, in person or by video call, and the questionnaires and planning documents we exchange with booked clients;
• the events we photograph and film, and the images and recordings produced there;
• our social media pages, to the extent we control the information rather than the platform.

This policy does not govern the independent practices of venues, planners, other vendors, or social media platforms, even when you reach them through a link on our site. Section 17 explains that boundary.

If you have signed a photography or cinematography services agreement with us, that signed agreement governs the commercial terms of your booking. This policy governs how we handle information. Where the two documents address the same subject and cannot be read together, the signed agreement controls for that booking.

02Our commitments to you

The rest of this policy is detailed because privacy law requires detail. These commitments are the substance of it, stated plainly, and we consider ourselves bound by them.

If we ever intend to depart from any of these commitments, we will say so in this policy before doing it, date the change, and where the law requires consent, we will ask for it rather than assume it.

03Information we collect

We collect the categories below. This table also serves as the notice at collection required by the California Consumer Privacy Act.

04Where the information comes from

• Directly from you — forms, email, text, phone, consultations, questionnaires, contracts and payment details you enter.
• Automatically from your device when you use the website, through cookies and similar technologies described in Section 9.
• From the event itself — the photographs and footage our artists create.
• From people acting for you — a planner, a parent, a venue coordinator or a partner may give us your details or your event details on your behalf. If someone gives us your information and you would rather we did not hold it, tell us and we will remove it.
• From our service providers — our payment processor confirms a payment; our gallery platform confirms a download; our email platform records a bounce.

We do not buy personal information from data brokers and we do not enrich our records with purchased third-party data.

05How we use your information

We use personal information only for the purposes below. Where the GDPR applies, the legal basis is given in brackets.

• To respond to inquiries and prepare quotes — answering your message, checking date availability, sending pricing. [Steps at your request prior to a contract]
• To perform our contract with you — scheduling, briefing the artists assigned to your event, coordinating with your venue and vendors, producing and delivering photographs and film, hosting your gallery, fulfilling print and album orders. [Contract]
• To take payment and to keep the invoicing, tax and accounting records the law requires us to keep. [Contract; legal obligation]
• To communicate with you about your booking — confirmations, timelines, delivery notices, gallery expiry-free reminders, and answers to your questions. These are service messages and you cannot unsubscribe from them while your booking is live. [Contract]
• To send marketing — occasional emails about our work, offers and openings, only where you have opted in or where you are an existing client and have not objected. Every marketing message carries an unsubscribe link that works. [Consent; legitimate interests]
• To show our work — publishing images on our website, in blog posts, on social media, in printed samples and in competition or publication submissions. We do this for client images only on the basis described in Section 7. [Consent]
• To operate, secure and improve the website — keeping it up, defending against abuse and fraud, fixing what is broken, and understanding which pages actually help people. [Legitimate interests]
• To measure advertising where you have accepted the relevant cookies. [Consent]
• To evaluate job applications. [Steps prior to a contract; legitimate interests]
• To comply with the law and to establish, exercise or defend legal claims — responding to a valid subpoena, meeting a tax or record-keeping requirement, or preserving evidence in a dispute. [Legal obligation; legitimate interests]

06How we share information — and when we do not

This is the section that matters most to us, so we have written it as a closed list. If a disclosure is not described below, we do not make it.

The only parties we share with

Where a third party genuinely acts on its own account rather than on our instructions — a publication you asked us to submit to, for example — we will tell you who it is and obtain your permission before anything goes to them.

07Photographs, film and client galleries

Photographs of you are personal information and we treat them as such. They are also the work our studio is built on, so the rules below are deliberately explicit.

Your galleries

Finished work is delivered through a private client gallery at gallery.lulanstudio.com. Galleries are not indexed by search engines. Access is by the link and, where you ask for one, a password. Client galleries do not expire — we host them for the life of the studio. You control who receives the link; anyone you send it to can view and download, so share it as widely or as narrowly as you wish.

If you would like a gallery taken offline, or made password-protected, or restored after you have taken it down, ask us and we will do it, usually within five business days.

Portfolio, marketing and publication

Guests and other people in your photographs

Your guests have not signed anything with us. We rely on you to tell us if a guest, a child, or a member of your family should not be photographed or should not appear publicly, and we will honour that. Any person who appears in an image we have published may also contact us directly at info@lulanstudio.com to request removal, and we will remove that image from our own channels without argument and without requiring them to explain why.

Faces and facial recognition

Our gallery platform may offer face grouping to help you find photographs of a particular person within your own gallery. Where that feature is available it operates within your gallery only. We do not build a face database across clients, we do not run facial recognition to identify strangers, and we do not sell, license or disclose facial data to anyone. If you would prefer the feature disabled on your gallery, tell us and we will disable it.

Artificial intelligence

We may use ordinary editing software that includes machine-learning tools — noise reduction, masking, retouching — on your images in the course of producing your work. That is processing for your benefit. We do not submit your images or personal information to any third-party system that takes rights to train on them, we do not contribute them to training datasets, and we do not permit our vendors to do so. Where a tool’s terms would claim such rights, we do not use that tool on client material.

08Confidentiality of your event, guests and vendors

Beyond what data-protection law strictly requires, we treat the private facts of your event as confidential business information of yours.

• Guest lists, seating charts, family structures and relationship sensitivities are used to run the day and are deleted from working documents after delivery.
• Home addresses and getting-ready locations are never published, geotagged or included in captions or metadata on published images.
• What you paid is confidential. We do not disclose your collection, your discount, or your total to other clients, vendors or publications, and we do not use your name in a pricing example.
• Unpublished timelines, planning documents and vendor arrangements are not circulated outside the team working your event.
• Surprise elements — a proposal, a reveal, a gift — are held in confidence from the people they are meant to surprise, including from a partner who is also our client.
• We do not discuss one client’s event with another client, and we do not use identifying details in teaching, talks or portfolio commentary without permission.

These obligations survive the completion of your booking and continue indefinitely.

09Cookies, analytics and advertising technologies

Cookies are small files a site stores on your device. Pixels and tags are small pieces of code that report activity back to a service. We use both, in three groups:

You can delete or block cookies in your browser settings; every major browser lets you do this per site. Blocking advertising and analytics cookies does not reduce the service you receive from us in any way.

Embedded content — a Vimeo film player, a map, a scheduling widget — may set its own cookies when you interact with it. Those are governed by that provider’s privacy policy, not ours.

10How long we keep information

Where a legal claim, audit or investigation is live, we retain the relevant records until it is resolved, then apply the periods above.

11How we protect information

We use administrative, technical and physical safeguards proportionate to the sensitivity of what we hold: encrypted transmission over HTTPS across our website and galleries; access limited to the artists and staff who need it, on a per-event basis; unique credentials and multi-factor authentication on the accounts that hold client data; encrypted storage on our working systems; and redundant, geographically separated backups of client work.

Every artist, second shooter, editor and contractor engaged by Lulan Studio signs a confidentiality undertaking before receiving access to client material.

12Your California privacy rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the following rights. We honour them, and we do not charge for exercising them.

• Right to know. You may ask us for the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclosed it, covering the preceding twelve months or longer where you ask.
• Right to delete. You may ask us to delete personal information we collected from you, subject to the exceptions the statute allows — principally records we must keep for tax, accounting and legal-defence purposes, and the completion of a booking you have already made.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. If that ever changes, this policy will say so and we will provide a Do Not Sell or Share link before any such activity begins.
• Right to limit the use of sensitive personal information. We use sensitive personal information only for the purposes permitted without a limitation right — performing the service you asked for — and never to infer characteristics about you.
• Right to data portability — a copy of your information in a readily usable format.
• Right against retaliation. We will not deny you service, charge you a different price, or give you a lesser experience because you exercised a privacy right. Our services carry no financial incentive tied to your data.

How to make a request

Email info@lulanstudio.com with the subject line Privacy Request, or call +1 (626) 662-1844. We will acknowledge within ten business days and respond substantively within forty-five days, extendable once by a further forty-five days where the request is complex, in which case we will tell you why.

We must verify who you are before releasing or deleting information — usually by matching the details you give against what we already hold, and for a specific-pieces request, by a further confirmation step. An authorised agent may act for you with written permission signed by you; we may still ask you to confirm directly.

California’s "Shine the Light" law also lets residents ask about disclosures to third parties for their own direct marketing. We make no such disclosures.

13Your rights under the GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland — a destination wedding client, for example — you have the rights to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests, including profiling. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of what we did before you withdrew it.

We do not make decisions producing legal or similarly significant effects about you by automated means alone.

Exercise any of these by emailing info@lulanstudio.com. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. You also have the right to lodge a complaint with your national supervisory authority, though we would rather you came to us first so we can put it right.

14Rights in other U.S. states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware and other states with comprehensive privacy statutes have comparable rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale and profiling. Rather than maintain a different standard for each state, we extend the rights described in Sections 12 and 13 to every person who asks, wherever you live. Use the same contact route. Where your state provides an appeal right and we decline a request, we will tell you how to appeal and give you your attorney general’s contact details.

15Children and minors

Our services are directed to adults. We do not knowingly collect personal information online from children under 13, and we do not sell or share the personal information of anyone under 16.

Children are of course present at weddings and appear in the photographs we are engaged to take. We do not publish an identifiable image of a minor for marketing purposes without the written permission of a parent or guardian, and a parent or guardian may ask us to remove such an image at any time by emailing info@lulanstudio.com. We will comply promptly and without requiring a reason.

If you believe a child has provided us personal information through the website, contact us and we will delete it.

16Global Privacy Control and Do Not Track

Browsers and extensions differ in how they signal privacy preferences, and there is still no common standard for Do Not Track, so we do not claim to respond to every variant. We do treat a Global Privacy Control signal as a valid opt-out of sale and sharing where our platform transmits it to us — which, given that we do not sell or share, means it costs you nothing to send and changes nothing about the service you receive.

17Third-party sites and services

Our website links to venues, planners, publications, our vendor recommendations and our social media pages, and it embeds third-party content such as film players and scheduling tools. Once you leave lulanstudio.com or interact with embedded content, that provider’s privacy policy governs, not ours. We do not control what they collect and we are not responsible for their practices. A recommendation of a vendor is a recommendation of their work, not an endorsement of their data handling — read their policy before giving them your details.

18Data transfers and where we operate

Lulan Studio operates from Los Angeles, California, and photographs weddings across Los Angeles, Orange County, San Diego, Santa Barbara and Las Vegas, as well as destination events. Personal information you give us is stored and processed in the United States. If you are outside the United States, using our services means your information will be transferred here, where privacy laws may differ from those of your own country. Where we transfer personal information out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses or the UK Addendum with the vendors concerned.

19Changes to this policy

We revise this policy when our practices change or the law does. The date at the top of this page always reflects the current version. For a material change — a new category of recipient, a new purpose, or anything touching the commitments in Section 2 — we will post notice on this page at least thirty days before the change takes effect, and where we hold your email address and the law requires it, we will email you. Continuing to use the website after a change takes effect means you accept the updated policy; if you do not accept it, stop using the website and tell us, and we will address your information under Sections 12 to 14.

20How to reach us and exercise your rights

A person reads every message sent to the address below — it is not a ticketing queue. If something in this policy worries you, or you want a commitment in writing that is specific to your booking, ask. We would rather write it down than leave it implied.