Privacy Statement

1. Who is responsible for your data

This website is operated by BP Medie ApS. BP Medie ApS is the data controller for all personal data collected through bpmedie.dk.

2. What data I collect and why

Booking requests

When you submit a booking through the booking form, I collect your name, email address, phone number, and preferred date. This data is used to confirm and manage your booking.

Legal basis: Article 6(1)(b) GDPR. Processing necessary to perform a contract or take pre-contractual steps at your request.

The booking form also notes where you came from: the page on this site you visited just before booking, the name of the website if you came from elsewhere (for example google.com), or “direct”. If you pressed a package’s “Book a date” button to get there, it also notes which package (and town) that button was for. Both are stored with your booking so I can see which pages help couples find me, and whether couples book the package they first chose. Neither is combined with website analytics or your IP address, and nothing is stored in your browser.

Legal basis: Article 6(1)(f) GDPR. Legitimate interest in knowing which pages and packages lead to bookings, so I can improve them.

Phone country on the booking form

When you reach the step of the booking form where you enter your details, your browser asks IPinfo which country your IP address belongs to, so the phone field can start with your country’s code. For that, IPinfo receives your IP address, the type of browser you use, and the address of this website. The answer is used only to preselect the code, and you can change it before you send the form. I do not receive or store it, and nothing is stored in your browser.

Legal basis: Article 6(1)(f) GDPR. Legitimate interest in making the booking form quicker to fill in correctly.

Contact form enquiries and chat widget

When you use the contact form or the chat widget on this site, I collect your name, email address, and the content of your message. The chat widget is powered by Cloudflare infrastructure and uses the Claude AI API (Anthropic) to generate responses to your questions. Conversation content is stored in a Cloudflare D1 database. No data is shared with any other party or used for any purpose beyond responding to your enquiry.

Legal basis: Article 6(1)(f) GDPR. Legitimate interest in responding to prospective clients.

Email inquiries

When you email me at contact@bpmedie.dk, your message is received and stored in a private inquiry inbox. The inbox is built on Cloudflare D1 (a database hosted by Cloudflare Inc.) and accessible only to me. To help draft a reply, the content of your email (your name, email address, and message) is passed to the Claude AI API provided by Anthropic. Replies to inquiries sent to contact@bpmedie.dk are written by an AI assistant and sent automatically, so you hear back quickly. Every one of them says so and is signed by the assistant, not by me. I read every inquiry myself and take the conversation over personally as soon as it needs a real decision. Emails you send to me directly are answered by me. No email data is shared with any other party or used for any purpose beyond responding to your inquiry.

Legal basis: Article 6(1)(b) GDPR. Processing necessary to take pre-contractual steps at your request.

Photos I show with your consent

If you said yes on the page I send you after our Planning Call (or, before October 2026, ticked the box on the booking form), I keep a set of photos from your day for that purpose and show some of them where you chose: this website and my portfolio, and my Instagram and Facebook pages. If you agreed to short clips, I film a few during your portraits and show a few seconds of them, or of your ceremony film, in the same places. A published photo or clip can be seen and copied by anyone. I do not publish your names with them. I do not publish a photo in which a guest can be recognised unless that guest has agreed to it. On the same page you can name anyone or anything you would rather I left out, and if you ask me to tag you, I keep your Instagram name for that. I store your answers with the date and the wording you saw, so I can show what you agreed to. I keep that record for as long as your consent stands, and for three years after you withdraw it, as proof that photos were only shown with your consent. If you ask me to delete your data, I delete everything else and keep only this record, without your note or your Instagram name.

An AI service, Claude from Anthropic, drafts the text that goes with the photos. For that, the photos of a post are sent to Anthropic in reduced size with the town, the season, and a few words from me about the post. I do not send your names, your wedding date, or your contact details. Anthropic works on my behalf under a data processing agreement, may not use the photos to train its models, and states that it deletes what it receives within 30 days unless the law or a breach of its usage rules requires it to keep something longer. The service does not identify anyone and makes no decision about you. I choose the photos and read every text, and nothing is published until I post or schedule it myself.

Photos lined up for posting are stored with Cloudflare at an unlisted address that Meta collects them from, and they are removed from there once they are no longer needed for a post. If you did not say yes, none of this happens with your photos, and saying no changes nothing about your booking.

If you were a guest at a wedding and you are visible in a photo I have published, write to privacy@bpmedie.dk and I will take it down.

Legal basis: Article 6(1)(a) GDPR. Your consent, given on the page I send you after our Planning Call (or earlier on the booking form) and separate from the booking itself. You can change or withdraw it at any time with the same link, by writing to privacy@bpmedie.dk, or by replying to any email from me. Where a guest can be recognised in a published photo, that guest’s own consent.

Website analytics

I use Burst Statistics to understand how visitors use this website. It sets no cookie and does not use fingerprinting. Each visit is counted with a code made from your IP address, your browser and a key that changes every day, so I cannot recognise you on a later day. All analytics data is stored directly on this server and is not shared with any external platform.

Legal basis: Article 6(1)(f) GDPR. Legitimate interest in understanding how the website is used, so I can improve it.

Cookies and browser storage

This website sets no cookies for statistics, advertising or tracking. It keeps a few small notes in your browser so the chat works and the short note about visit statistics appears only once. The cookie policy lists each of them and how long it stays.

3. How long I keep your data

Booking records and related correspondence are kept for 5 years from the date of the wedding, in line with Danish business record-keeping requirements.

Email inquiries that do not result in a booking are deleted automatically 24 months after the inquiry is closed. Chat widget conversations are deleted automatically after 12 months. These deletions are carried out by an automated daily process in the Cloudflare D1 database.

The finished photographs and any ceremony film I deliver to you stay in my archive for as long as I run my business, so that I can send them again if you lose your copy or something goes wrong with the delivery. I promise to hold them for at least 12 months after delivery. Your gallery link is active for 30 days, and I can reopen the gallery for you on request. The unedited camera files are deleted 13 months after the wedding day. You can ask me to delete your gallery from my archive at any time by writing to privacy@bpmedie.dk.

Where you have given consent for me to show photos on my website, portfolio, or social media, I keep the photos set aside for that purpose, and the published ones stay up, for as long as that consent stands. You can withdraw it at any time by writing to privacy@bpmedie.dk. I then take the photos down from my website, delete the posts on Instagram and Facebook, and delete the copies I kept for this purpose, without undue delay. I keep a technical fingerprint of each photo, which cannot be turned back into the picture, so that it is not posted again by mistake. Copies that other people made while a photo was public are outside my reach, and Meta clears deleted posts from its own systems on its own schedule. Your gallery in my archive is separate and is described above.

Analytics data collected by Burst Statistics is stored on this server and retained for a maximum of 2 years.

4. Who I share your data with

I do not sell your personal data. The following third-party services process data as part of running this website and my business:

• Cloudflare Inc. (USA): edge infrastructure, D1 database, and scheduled processing for the email inquiry inbox and chat widget, and storage of the photos lined up for posting and the records of those posts, where you consented to your photos being shown. Cloudflare operates under a Data Processing Addendum covering GDPR compliance. Data may be processed in the United States under Standard Contractual Clauses.
• Anthropic (Anthropic Ireland Limited, with processing in the United States by Anthropic PBC): Claude AI API, used to draft and send replies to email inquiries, to power the chat widget, and, where you consented to your photos being shown, to draft the text for them. Content is passed to the API for these purposes and may not be used to train its models. Data is processed in the United States under Standard Contractual Clauses.
• Google LLC (USA): Google Calendar, where your booking, including where you came from, is kept. Data may be transferred to the United States under Standard Contractual Clauses.
• Meta Platforms Ireland Ltd: Instagram and Facebook, where I publish photos if you consented to that. On its own platforms Meta decides itself how posts and visitor data are handled, under its own privacy policy, and it may transfer data to the United States.
• Simply.com A/S: website hosting. Servers are located within the EU.
• IPinfo Inc. (USA): looks up the country of your IP address for the phone field on the booking form. IPinfo receives your IP address directly from your browser and handles it under its own privacy policy. Its services are hosted in the United States.

You can ask me for a copy of the safeguards that cover these transfers by writing to privacy@bpmedie.dk.

5. Your rights

Under GDPR you have the following rights regarding your personal data:

• Access: request a copy of the data I hold about you.
• Rectification: ask me to correct inaccurate data.
• Erasure: ask me to delete your data, subject to legal retention obligations.
• Restriction: ask me to limit how your data is used.
• Portability: request your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: where processing is based on your consent, withdraw it at any time by writing to privacy@bpmedie.dk or by contacting me directly.

To exercise any of these rights, contact me at privacy@bpmedie.dk. I will respond within 30 days.

6. Complaints

If you believe your data is being processed unlawfully, you have the right to lodge a complaint with the Danish Data Protection Authority:

7. Changes to this statement

I may update this privacy statement when the services used on this site change. The date at the top of the page shows when it was last revised.