Privacy Policy

Last updated: September 27, 2026

Who I am

This website is operated by:

Controller: Marco Di Marco, photojournalist, photographer, videographer, tour guide
Website: marcodimarco.photo
Contact email: info@marcodimarco.photo

I am based in Iceland and process personal data in line with the General Data Protection Regulation (GDPR) and applicable EEA data protection rules. For anything in this policy, or about how your data is handled, you can contact me at the email address above.

Data collected automatically

When you visit this website, the hosting provider automatically records basic technical information as part of normal server operation. This can include things such as your IP address, browser and device information, the pages you request, the date and time of access, and other technical or security log information.

This data is used for the technical operation, security, and troubleshooting of the site, for example to detect abuse or keep the site running reliably. The legal basis is my legitimate interest in running a secure and functioning website.

Contact and tour forms

This website uses forms to let visitors get in touch, for example for general enquiries, tour requests, or trip planning. Depending on the form, this can involve providing:

  • your name
  • your email address
  • the type of enquiry or request
  • a preferred tour or departure, where relevant
  • a message or any other information you choose to include

Some forms include a required checkbox confirming that the submitted data may be processed for the purpose stated on the form. Form submissions are stored in the website’s form system, and a notification is sent to my inbox at info@marcodimarco.photo so I can respond to you.

The legal basis for this processing depends on what you are asking about:

  • If you are enquiring about a service, tour, workshop, trip planning, or another potential professional engagement, processing is generally necessary to take steps you requested before entering into a contract.
  • For general correspondence that is not connected to a specific service request, I rely on my legitimate interest in receiving and responding to professional enquiries.

If you want a previous message deleted, you can email me at info@marcodimarco.photo and I will remove it where possible, unless I need to keep it for legal or administrative reasons.

Newsletter

If you subscribe to my newsletter, I collect your email address and your explicit consent to receive updates. No name is required; the form requires only your email address and confirmation of consent.

Your email address is stored in the website’s form system and is also sent to EmailOctopus, the email marketing service I use to send the newsletter. EmailOctopus is operated by Three Hearts Digital Ltd and acts as a processor for this contact information. According to EmailOctopus’s current published documentation, contact list data is hosted on servers in Ireland, within the EEA.

Newsletter emails may include occasional updates on my work, field stories, projects, volcanoes and natural phenomena, tours, and photography workshops. They are sent only to people who have actively subscribed. You can unsubscribe at any time using the link included in each newsletter email, or by writing to info@marcodimarco.photo and asking to be removed.

The legal basis for processing newsletter data is your consent.

Comments

If you leave a comment on a blog post, the site collects the information included in the comment form, such as your name, email address, and website (if provided), along with your IP address and browser information.

An anonymised string created from your email address (a hash) may be sent to the Gravatar service to check whether you have a Gravatar profile picture. If you do, it may be shown next to your comment once it is approved. Gravatar’s own privacy policy is available at automattic.com/privacy.

The information you choose to submit is used to publish and manage your comment. Technical information such as your IP address and browser information may also be processed for moderation, security, and spam prevention, based on my legitimate interest in maintaining a secure and functional comment section.

Google Analytics

I use Google Analytics (GA4) to understand how visitors use this website, so I can improve its content and performance.

Analytics is managed through the site’s cookie and consent system, using Google’s Advanced Consent Mode. If you consent to analytics storage, analytics cookies are used in the normal way. If you do not consent, analytics cookies are not used in that normal consented way, but Google tags may still send limited cookieless signals. These signals can include information about your consent status and limited technical or event information, and Google may use them for measurement and modelling purposes.

I do not control, and cannot fully verify, every technical detail of how Google’s systems behave once a request reaches them. For a full list of cookies and services, see the Cookie Policy.

This site uses a cookie and consent management system to handle cookies and similar technologies. Some cookies are necessary for the site to work correctly and are used regardless of your preferences. Optional categories, such as analytics, depend on the choice you make in the cookie banner or preference settings, which you can change at any time. Declining a category stops the related cookies and normal storage from being used, though as explained above, some services may still send limited signals under Google’s consent mode framework even when declined.

For the full, current list of cookies, their purpose, and how to manage your preferences, see the Cookie Policy.

Embedded content

Some pages on this site include embedded third-party content, currently including YouTube videos. Loading or interacting with this content works the same as if you visited that service directly, and the provider may collect technical information about you according to its own privacy policy. This is different from ordinary links to my social media profiles, which take you to those external services when you choose to follow them.

Who your data may be shared with

I do not sell or rent your personal data. Depending on how you interact with the site, your data may be processed by:

  • Hosting and infrastructure providers, who host the website and process related technical data as part of providing hosting.
  • My email hosting provider, which delivers messages sent from the site’s forms to my inbox at info@marcodimarco.photo.
  • EmailOctopus, for newsletter subscribers, as described above.
  • Google, for analytics and consent-mode measurement, with the behaviour depending on your consent choices.
  • Embedded content providers, such as YouTube, where their content is loaded on a page you visit.
  • Other service providers reasonably necessary to operate, secure, or support the website.

International data processing

This website is hosted by a managed hosting provider. Some of the service providers I use, such as Google, may process data outside Iceland or the EEA depending on the service. Where a service provider processes personal data outside the EEA, that processing is subject to the safeguards and transfer mechanisms described by that provider and required under applicable data protection law. EmailOctopus states that newsletter contact data is hosted in Ireland, within the EEA.

How long data is kept

I keep personal data only for as long as reasonably necessary for the purpose it was collected for:

  • Enquiries and messages are kept for as long as needed to answer them and manage any related professional relationship, and are reviewed periodically.
  • Newsletter subscription information is kept while you remain subscribed. After you unsubscribe, limited information may be retained where necessary to record and respect your unsubscribe request or to meet legal obligations.
  • Technical and security logs are kept for as long as needed for operational and security purposes.
  • Administrative or accounting records, if you become a client, may be kept for as long as required by law.

Your rights under GDPR

If you are in the EEA or otherwise subject to GDPR, you have the right to:

  • access your personal data and receive a copy
  • correct inaccurate or incomplete data
  • request erasure of your data in certain circumstances
  • restrict processing in certain cases
  • object to processing based on legitimate interests
  • data portability, where applicable
  • withdraw consent at any time, where processing is based on consent

To exercise any of these rights, email info@marcodimarco.photo. I may need to confirm your identity before acting on a request, and some rights may be limited where I am required to keep data for legal reasons.

You also have the right to lodge a complaint with your local data protection authority. In Iceland, this is the Icelandic Data Protection Authority (Persónuvernd).

Security

I use reasonable technical and organisational measures to protect your data, including HTTPS encryption for this site, a reputable managed hosting provider, and restricted access to backend systems and email. No online service can guarantee absolute security, but I aim to minimise unnecessary data collection and keep the systems I use up to date.

Children

This website and its services are aimed at adults and professional users, and are not directed at children under 16. If you believe a child has provided personal data through this site, please contact me at info@marcodimarco.photo so I can review and, where appropriate, delete it.

For details on cookies and similar technologies, see the Cookie Policy. For the terms governing use of this website, see the Terms & Conditions.

Changes to this Privacy Policy

This Privacy Policy may be updated from time to time, for example when I add new services or when legal requirements change. The date at the top of this page shows the latest update.

How to contact me about privacy

Marco Di Marco
Email: info@marcodimarco.photo

I will do my best to respond within a reasonable time and address your request or concern.