Data Collection & GDPR

The data controller responsible for personal data collected through this website is:

Velora Norel Photography Vienna, Austria contact@veloranorel.com

For all data protection enquiries, please contact us at the email address above.

When you submit a model profile via our submission form, we collect the following categories of personal data:

— Identity data: first name, last name, age — Contact data: email address, telephone number, city/location — Physical measurements: height, bust, waist, hips, shoe size, eye colour, hair colour — Professional data: experience level, shoot type preferences, portfolio links — Biographical data: personal statement ("About You") — Photographic data: images you voluntarily upload as part of your submission

We process your personal data on the following legal bases under Article 6 of the GDPR:

— Consent (Art. 6(1)(a)): You provide explicit consent at the point of submission by ticking the GDPR consent checkbox. This consent covers the storage and review of your submission for casting and representation purposes. — Legitimate interests (Art. 6(1)(f)): Where necessary to manage our casting operations and respond to your enquiry.

For special category data (photographs that may reveal physical characteristics), we rely on your explicit consent under Article 9(2)(a) GDPR.

Your personal data is collected and processed solely for the following purposes:

— Reviewing your model submission for potential casting or representation by Velora Norel — Contacting you regarding your submission — Maintaining records of applicants for ongoing casting consideration — Complying with our legal obligations

We will not use your data for any other purpose without obtaining fresh consent from you.

We retain your submission data for a maximum of 24 months from the date of submission, unless you request earlier deletion or we enter into a working relationship with you, in which case separate contractual terms will apply.

After the retention period, your data and any uploaded photographs are permanently deleted from our systems.

We do not sell, rent, or trade your personal data to any third party.

Your data may be shared with:

— Our hosting and infrastructure providers, who process data on our behalf under data processing agreements and are bound by GDPR-equivalent obligations — Our internal team members involved in casting decisions

All third-party processors are contractually obligated to process your data only on our instructions and in accordance with applicable data protection law.

Your data is stored and processed within the European Economic Area (EEA). Where any transfer outside the EEA is necessary, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

As a data subject under the GDPR, you have the following rights:

— Right of access (Art. 15): Request a copy of the personal data we hold about you — Right to rectification (Art. 16): Request correction of inaccurate or incomplete data — Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten") — Right to restriction of processing (Art. 18): Request that we limit how we use your data — Right to data portability (Art. 20): Receive your data in a structured, machine-readable format — Right to object (Art. 21): Object to processing based on legitimate interests — Right to withdraw consent (Art. 7(3)): Withdraw your consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at contact@veloranorel.com. We will respond within 30 days.

You may withdraw your consent and request deletion of your submission at any time by emailing contact@veloranorel.com with the subject line "Data Deletion Request" and your full name and email address used in the submission.

Upon receipt of a verified request, we will permanently delete your data within 14 days and confirm deletion by email.

If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehorde):

Datenschutzbehorde Bahnhofplatz 5, A-1060 Vienna, Austria dsb@dsb.gv.at www.dsb.gv.at

You may also contact the supervisory authority in your country of residence within the EU.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. Access to submission data is restricted to authorised personnel only and is protected by authentication controls.

We may update this Data Collection Policy from time to time. The current version will always be available at this URL. Material changes will be communicated to you where we hold your contact details.

Last updated: October 2026.