Privacy policy
Last updated: 15 September 2026
Photos with Nirvana is a brand operated by Heartspace PR Sverige AB, company registration number 556882-2042, Garagevägen 32, 121 32 Enskededalen, Sweden. The company is the data controller for the processing described here. Questions about personal data can be sent to [email protected].
What data we process
When you send the form on the contact page we process your name, email address, type of assignment, preferred date and what you write in the message. If you email or call directly we process the details you choose to give.
If it becomes an assignment we also process the details needed for a quote, an agreement and an invoice: name, company, address and company registration number.
During a shoot we process pictures of the people being photographed. The pictures are the client's delivery. Pictures from assignments appear on this website only by agreement with the client.
Why and on what basis
The details from the form are used to answer your enquiry and book the assignment. The legal basis is that the processing is necessary to enter into an agreement with you, or our legitimate interest in replying to those who get in touch.
Details for quotes, agreements and invoices are processed to perform the agreement and to comply with the Swedish Accounting Act.
Pictures from assignments are processed to deliver the assignment under the agreement. Publication on the website is based on the agreement with the client.
How long
An enquiry that does not lead to an assignment is deleted within twelve months. Agreements and invoice records are kept for seven years under the Swedish Accounting Act. Pictures from assignments are kept as long as needed for delivery and any redelivery, and thereafter in an archive unless otherwise agreed.
Who receives the data
We do not sell personal data. The data is handled by suppliers working on our behalf: Cloudflare (hosting), Resend (sending the form's email), Google Workspace (email) and Sanity (the website's content). The suppliers process data within the EU/EEA where possible. Where processing takes place in the United States it is based on the European Commission's adequacy decision or the EU standard contractual clauses.
Data may also be disclosed to authorities when required by law.
Cookies
The website sets no cookies and uses no visitor analytics. That is why there is no cookie banner.
Your rights
You have the right to know what data we hold about you, to have it corrected or deleted, to restrict the processing, to receive it in a common format and to object to processing based on legitimate interest. Write to [email protected] and we reply within a month. You can also complain to the Swedish Authority for Privacy Protection, imy.se.
Changes
If the policy changes, the new version is published here with a new date.