Privacy Policy

The not-so-exciting, but important part
I know privacy policies aren’t exactly anyone’s favourite reading, so I’ve tried to keep this one as clear and straightforward as possible.
This Privacy Policy explains what personal information Slow Story Photography collects, why I need it, how I use and protect it, and what choices you have regarding your data.
Last updated: 30 September 2026

1. Who is responsible for your personal data?
The data controller is:
Slow Story Photography
Owner: Paulina Sikora-Kacprzak
KvK number: 97234230
Email: [email protected]
If you have any questions about your personal data or this Privacy Policy, you can contact me using the email address above.
2. What personal information may I collect?
Depending on how you interact with Slow Story Photography, I may collect and process information including:
- your name;
- email address;
- telephone number;
- address, where needed for delivery or administration;
- information provided when booking a photography session;
- names of people taking part in the session;
- children’s ages, where relevant;
- information about pets joining the session;
- session date, time and selected package;
- information you voluntarily choose to share with me before a session;
- photographs and videos created during the session;
- booking and payment information, including payment status and transaction details;
- messages and correspondence between us;
- information connected with orders for prints or other photography products;
- your email address, name and marketing preferences when you join my mailing list;
- your answer to questions such as how you heard about Slow Story Photography;
- limited technical information generated when using my website, booking system or online galleries, such as IP address, browser or device information where this is processed by the services I use.
Please only provide information that is relevant to your booking or session.
If you voluntarily share health, accessibility or other sensitive information because it is relevant to making the session comfortable or accessible for you or someone taking part, I will use that information only for that purpose and only where necessary.
3. Why do I process your information?
Enquiries and preparing a booking
If you contact me about a photography session, I use the information you provide to answer your questions, discuss the service and take the necessary steps towards a booking.
Providing photography services
I use your information to:
- organise and carry out your photography session;
- communicate with you before and after the session;
- manage your booking and payments;
- create and deliver your photographs and, where applicable, video;
- provide your online gallery;
- prepare prints or other products;
- arrange collection or delivery;
- provide customer service after the session.
This information is generally processed because it is necessary to enter into or perform our photography agreement.
Payments, invoices and business administration
Certain booking, payment and invoicing information is processed because I have legal and administrative obligations as a business.
Core Dutch business administration must generally be retained for 7 years. Belastingdienst
Mailing list and marketing emails
If you join the Slow Story Photography mailing list, I may use your name and email address to send you emails about photography sessions, availability, offers and news.
Where marketing is based on your consent, you can withdraw that consent at any time by using the unsubscribe link in an email or by contacting me.
Unsubscribing from marketing emails does not affect an existing photography booking or services you have already purchased.
You also have the right to object to the use of your personal data for direct marketing. Dutch Data Protection Authority
Understanding how clients find Slow Story Photography
If you answer a question such as “How did you hear about Slow Story Photography?”, I may use that information to understand which marketing channels are useful for my business.
Portfolio, social media and advertising
Booking a photography session does not automatically give Slow Story Photography permission to publish your photographs.
Permission to use identifiable photographs or videos for promotional purposes is requested separately.
If you give permission, selected photographs or videos may be used for purposes including:
- the Slow Story Photography website and portfolio;
- social media;
- printed promotional materials;
- promotional posts and campaigns;
- paid online advertising.
You can refuse permission without affecting your booking, session or package.
Where this use is based on your consent, you can withdraw that consent by contacting me.
Withdrawal of consent does not make previous lawful use of the photographs unlawful, but I will stop future use based on that consent where reasonably possible.
4. Photographs of children
Many Slow Story Photography sessions include children.
Information such as a child’s name or age is collected only where it is useful for organising or preparing the photography session.
Photographs and videos of children are created as part of the photography service booked by their parent or guardian.
Public use of identifiable photographs or videos of children is handled separately from the booking itself.
Where permission is required, I will ask the appropriate parent or legal guardian and, where appropriate, take the young person’s wishes into account.
5. Who may receive or process your information?
I do not sell your personal information.
I use several third-party services to operate Slow Story Photography and provide photography services. Depending on how you interact with me, your information may be processed by providers including:
Photonesto
Used for session booking, client information, online galleries, photograph selection and delivery.
MailerLite
Used to collect mailing-list registrations and send marketing and campaign emails.
Carrd
Used to host my websites and landing pages.
Google / Gmail
Used for email communication and related business services.
My bank and financial service providers
Used to process and manage payments.
Professional photography laboratories
Used when prints or other physical photography products are ordered.
PostNL
Used when you choose to have physical products delivered by post.
Accounting or tax service providers
Where required for my business administration.
Other hosting, cloud-storage or IT providers may also process limited information where this is necessary to operate and secure my business.
These services receive only the information reasonably necessary for the function they provide.
Photonesto states that its galleries are password protected and stored on servers within the European Union. Photonesto MailerLite provides a GDPR Data Processing Addendum and states that subscriber data for EEA customers is kept within the EU, while also maintaining safeguards for any international transfers that may otherwise occur. MailerLite
6. International data transfers
Some service providers or their subprocessors may operate outside the European Economic Area.
Where personal data is transferred outside the EEA, I aim to use service providers that apply an appropriate GDPR-recognised transfer mechanism, such as an adequacy decision or Standard Contractual Clauses.
The exact service providers and their processing arrangements may change over time as the tools used by Slow Story Photography change.
7. How long do I keep your personal information?
I do not intend to keep personal information indefinitely just because I can.
Different types of information are kept for different periods depending on why they are needed.
Online galleries
Online galleries remain active for 3 months after delivery.
After this period, access to the gallery may be removed.
Clients are responsible for downloading and safely storing their final photographs after delivery.
RAW files
RAW files are stored for up to 1 year after the photography session.
After this period, they may be permanently deleted.
Final edited photographs
Final edited JPG files are stored for up to 2 years after delivery for backup and client-service purposes.
After this period, they may be permanently deleted.
Photographs used for portfolio or promotion
Selected photographs or videos for which permission has been given for portfolio, social media or promotional use may be retained for longer than two years.
They may be retained for as long as they are reasonably needed for those purposes and while the relevant permission remains valid.
If permission is withdrawn, I will stop future use based on that consent where reasonably possible, unless another lawful reason requires the information to be retained.
Mailing list
Mailing-list information is retained until you unsubscribe, withdraw your consent or the mailing list is discontinued.
Limited information may be retained where necessary to make sure that an unsubscribe request continues to be respected.
Financial and administrative records
Information forming part of my legally required business administration may be retained for 7 years, or longer where Dutch law specifically requires it. Belastingdienst
Other booking information and correspondence
Other booking information and correspondence will be kept only for as long as reasonably necessary to provide the service, answer follow-up questions, manage my business and deal with any relevant legal or administrative matters.
8. Your privacy rights
Under the GDPR, depending on the circumstances, you may have the right to:
- request access to personal information I hold about you;
- ask for inaccurate information to be corrected;
- ask for certain personal information to be deleted;
- ask for processing to be restricted;
- receive certain information in a portable format;
- object to certain uses of your information;
- object to direct marketing;
- withdraw consent where processing is based on consent.
Not every right applies in every situation. For example, I may still need to retain certain financial information because of a legal obligation.
To exercise one of your privacy rights, please contact:
[email protected]
I may need to verify your identity before completing a request.
9. Withdrawing consent
Where I use your personal information based on consent — for example for marketing emails or the promotional use of photographs — you may withdraw that consent.
To unsubscribe from emails, you can use the unsubscribe link included in marketing emails.
For photographs, videos or other privacy questions, contact:
[EMAIL ADDRESS]
Withdrawing consent does not affect the lawfulness of processing that took place before the consent was withdrawn.
10. Security
I take reasonable technical and organisational measures to protect personal information from accidental loss, unauthorised access, disclosure, alteration or misuse.
I also aim to limit access to personal information to the services and people who reasonably need it.
No online system can guarantee absolute security, but I aim to use reputable providers and appropriate security settings for the information I process.
11. Website and technical data
When you visit a Slow Story Photography website or landing page, the website provider may process technical information necessary to deliver and secure the site.
This can include information such as your IP address, browser, device type and basic access logs.
If I introduce optional analytics, advertising pixels or other non-essential tracking technologies in the future, this Privacy Policy will be updated and consent will be requested where required.
This is particularly relevant if advertising tracking tools are later added to support campaigns.
12. Automated decision-making
Slow Story Photography does not use automated decision-making that produces legal or similarly significant effects for clients.
13. Complaints
If you have a question or concern about the way your personal information is handled, I would appreciate the opportunity to look into it first.
You can contact me at:
[email protected]
You also have the right to make a complaint to the Dutch data protection authority:
Autoriteit Persoonsgegevens
The Autoriteit Persoonsgegevens also provides guidance and templates for individuals and small businesses concerning GDPR rights and privacy statements. Dutch Data Protection Authority
14. Changes to this Privacy Policy
I may update this Privacy Policy if my services, working methods, service providers or legal obligations change.
The most recent version will be available on this page.
The date at the top of this Privacy Policy shows when it was last updated.

Questions?

If anything in this Privacy Policy is unclear, or if you would like to ask how your information is being used, feel free to contact me: [email protected]

• Instagram
• Facebook