Privacy
& cookies

Who controls your data

The data controller is MODEL 5 d.o.o., 1000 Ljubljana, Slovenia.
Email: info@model-group.si
Phone: +386 41 727 777

Cookies: only when you pay

This website uses no cookies, with one exception: when you click Pay on the Model book & photo shoot page, the payment form of our payment provider Stripe loads, and Stripe sets strictly necessary cookies to prevent card fraud. Nothing from Stripe loads before you click. There is no Google Analytics, no advertising scripts or third-party tracking, and no social media plugins — we count visits ourselves, without cookies.

Apart from that payment form, the site loads nothing from third-party servers — fonts are self-hosted, and video and photographs are served from our own server. This means nobody but our hosting provider receives your IP address when you visit. The Instagram and Facebook links are ordinary links; nothing loads until you click them.

That is why there is no cookie consent banner — strictly necessary payment cookies do not require consent, and there is nothing else to accept or decline.

Visit counting

To know which pages people read and where they come from, we count visits ourselves, on our own server — without cookies and without storing anything in your browser. When you view a page, we record:

• which page you open,
• the site you came from (the domain only, e.g. instagram.com) and any campaign tag in the link (utm),
• whether you use a phone, tablet or computer.

When you send a form or pay for a shoot, one application, message or payment is added to the totals, together with where the visit came from (e.g. Instagram) — without your details.

So that the same visitor is not counted several times a day, we derive a one-way code from your IP address and browser identifier, using a random key that is replaced and deleted every day. Your IP address and browser identifier are not stored, and after midnight the code can no longer be linked to you or to your visits on other days. Only totals are kept (e.g. "40 visitors on a phone"), which are not personal data, and we do not send them to any advertising or analytics service.

The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in knowing whether the site works. If your browser sends a Global Privacy Control or "Do Not Track" signal, your visit is not counted.

What data is collected

Apart from the short-lived visit-counting code (above), we only receive personal data you send us through one of the forms.

"Become a model" application

• first name, surname, email, phone, year of birth, city
• measurements: height, bust, waist, hips, shoe size
• the three photographs you upload

Contact form

• name, email, subject and message

Model book booking

• name, email, phone, the date you book, and optionally your Instagram handle and a note
• where your visit came from (e.g. Instagram or Google), so we know which posts work
• payment details are entered directly into Stripe's form — we never see or store your card number; we receive only the amount, the date of payment and the billing name

When a form is submitted we also record the date, time and IP address, solely to limit spam.

Why we process it, and on what basis

Applications are processed on the basis of your consent (Article 6(1)(a) GDPR), given by ticking the box on the form. The purpose is to assess your application and potentially work together. Messages from the contact form are processed so that we can reply.

Model book bookings are processed to perform the contract you enter into when you book (Article 6(1)(b) GDPR), and payment and invoice records to meet our legal accounting obligations (Article 6(1)(c) GDPR).

We do not use your data for profiling, automated decision-making or marketing messages.

Minors

If you are under 18, your application must be approved by a parent or guardian. Applications from minors without such approval are not considered and are deleted.

How long we keep it

• Applications and photographs: 12 months maximum, then automatically deleted.
• Contact form messages are kept for as long as needed to reply.
• If we begin working together, data is kept on a contractual basis.
• Model book bookings: for as long as needed to carry out the shoot; invoices and payment records for the period required by Slovenian tax law (10 years).
• Visit counting: the daily code is deleted at midnight; only totals without personal data are kept.

Who it is shared with

We do not sell, rent or share your data with advertisers. For Model book bookings only, your booking details go to the photographer who carries out the shoot, and payments are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland) as an independent payment provider under its own privacy policy. Otherwise, your data stays with us. It is stored on our hosting provider's server in Slovenia, acting as a data processor. Photographs from applications are stored outside the publicly accessible part of the server.

Your rights

At any time you may request:

• access to your data and a copy of it
• correction of inaccurate data
• erasure (the "right to be forgotten")
• restriction of, or objection to, processing
• transfer of your data to another controller
• withdrawal of consent — this does not affect the lawfulness of processing before withdrawal

An email to info@model-group.si is enough. We reply within one month at the latest.

If you believe we are handling your data incorrectly, you may complain to the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.

Security

The site runs over an encrypted connection (HTTPS). Photographs from applications are not publicly accessible — they are reachable only through signed, time-limited links sent to the agency by email.