Privacy Policy
Elior Bliah Photography ("we", "our", "us") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and what rights you have in relation to it. It applies to all visitors and customers of eliorbliah.com, and is governed primarily by the Israeli Protection of Privacy Law, 5741-1981, as amended by Amendment 13 (in force since August 14, 2025). Where you are located in the European Economic Area, the relevant GDPR provisions are noted alongside the Israeli ones.
1. Information We Collect
We collect information you provide directly to us in the following circumstances:
Orders: When you purchase a print or digital download, we collect your name, email address, shipping address, and order details. Payment information is processed exclusively by Tranzila (our PCI-DSS Level 1 payment processor) and is never stored on our servers.
Contact form: When you contact us, we collect your name, email address, subject, and message content.
Usage statistics: We automatically collect basic, anonymous information about how visitors interact with the site — specifically: pages visited, photographs viewed, approximate geographic region (country-level only, derived from your IP address at request time and not stored), and device type (mobile/tablet/desktop). Your IP address is never saved to our database. This data is collected using a self-hosted system and is not shared with any third-party analytics providers.
2. Legal Basis for Processing
Under the Israeli Protection of Privacy Law, our basis for collecting and using your personal information depends on the data concerned:
Performance of a contract: Processing your order and delivering your purchase — necessary to fulfil the sale you requested.
Legitimate interest: Collecting anonymous usage statistics to improve site performance. No personal data is involved in this processing.
Consent: Where you have provided consent via the cookie banner, for the placement of the session cookie used to distinguish unique visits, and for newsletter emails via the explicit checkbox at signup. You may withdraw consent at any time.
If you are in the European Economic Area: The same processing also relies on Article 6(1)(b) GDPR (contract performance) and Article 6(1)(f) GDPR (legitimate interests, for anonymous usage statistics), and Article 6(1)(a) GDPR (consent, for cookies and newsletter emails).
3. Cookies
We use a minimal number of cookies strictly necessary to operate the site:
eb_sid — A session identifier cookie containing a randomly generated ID with no personal information attached. Used solely to count unique visits for anonymous statistics. Expires after 30 days. Not used for advertising or cross-site tracking.
eb_analytics_consent — Stores your consent choice (accepted or declined) so the banner does not reappear on subsequent visits. Stored in your browser's local storage, not transmitted to our servers.
admin_session — An authentication cookie used exclusively for the site administrator. Not set for regular visitors.
We do not use advertising cookies, cross-site tracking cookies, or any third-party cookies. We do not use Google Analytics, Facebook Pixel, or any equivalent service.
4. How We Use Your Information
Order data is used solely to fulfill your purchase, send order confirmation, and (for print orders) coordinate shipping. We do not use your purchase history for marketing without your explicit consent.
Contact form data is used solely to respond to your inquiry. Messages are retained for up to 12 months and then deleted.
Anonymous usage statistics are used solely to understand which content is most valuable and to improve site performance. This data cannot be used to identify you.
5. Data Sharing
We do not sell, rent, or trade your personal information. We share data only with the following service providers, strictly as necessary to operate the site:
Tranzila (tranzila.com) — payment processing and card clearing (PCI-DSS Level 1), and acts as merchant of record for the charge. Tranzila processes all card data under their own Privacy Policy. As we are registered as an osek patur (VAT-exempt dealer), a receipt (קבלה) — not a VAT tax invoice — is issued for every purchase.
Resend (resend.com) — transactional email delivery (order confirmations, contact form replies). Only your email address and name are transmitted, solely for the purpose of sending the email.
Cloudinary (cloudinary.com) — image hosting and delivery. No personal data is transmitted; only image assets are served.
Vercel (vercel.com) — website hosting. Standard server logs may be retained by Vercel per their own Privacy Policy.
We may disclose your information if required to do so by law or in response to valid legal process.
6. Do Not Track
We respect the Do Not Track (DNT) browser signal. If your browser has DNT enabled, no analytics data will be collected during your visit and the session cookie will not be set.
7. Data Breach Notification
If a security incident poses a risk to your rights — such as unauthorized access to, or disclosure, loss, or alteration of, personal data — we will report it to the Israeli Privacy Protection Authority (PPA) immediately upon discovery, as required by the Data Security Regulations, 2017. Israeli law does not set a fixed 72-hour deadline the way the GDPR does; "immediately" is the applicable standard.
We will notify you directly if the PPA directs us to do so following its review of the incident. Any such notice will explain, in plain language, what happened, what data was affected, the likely consequences, and what steps you can take.
8. Your Rights
Under the Israeli Protection of Privacy Law, sections 13–14, you have the right to:
Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate data.
Deletion: Request deletion of your personal data ("right to be forgotten").
Objection: Object to processing based on legitimate interests.
Portability: Request your data in a structured, machine-readable format.
Withdraw consent: Where processing is based on consent, withdraw it at any time by clearing your browser cookies or emailing us.
California residents have additional rights under the CCPA, including the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale of personal information (we do not sell personal information).
To exercise any of these rights, email eliorbliah@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Israeli Privacy Protection Authority (gov.il/en/departments/the_privacy_protection_authority), or, if you are in the EEA, with your local data protection authority.
9. Data Retention
Order data is retained for 7 years to comply with applicable tax and accounting obligations. Contact form messages are retained for 12 months. Anonymous analytics events are retained indefinitely in aggregated form; no personal data is attached to these records.
10. Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. All data is transmitted over HTTPS. Payment data is never stored on our servers.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the site after changes constitutes acceptance of the updated policy.
12. Contact
For any privacy-related questions or requests, contact us at: eliorbliah@gmail.com