Privacy Policy
Last updated 17 October 2026. This policy explains how Sarp Gurel Media handles personal data under the GDPR (AVG).
Who is responsible
| Trading name | Sarp Gurel Media |
|---|---|
| Legal name | «LEGAL NAME» |
| Address | «STREET ADDRESS», «POSTCODE» «CITY», Netherlands |
| KvK number | «KVK» |
| BTW-id | «BTW-ID» |
| sarp@sarpgurelmedia.com | |
| Phone | +31 6 2733 8889 |
For any question about this policy, or to exercise a right described below, email sarp@sarpgurelmedia.com.
What is collected, why, and on what basis
| Data | Why | Lawful basis (Art. 6 GDPR) | Kept for |
|---|---|---|---|
| Contact-form fields: name, email address, project type, your message, and the timestamp of your consent | To read and answer your enquiry, and to quote for and plan work | 6(1)(b) steps prior to a contract, and 6(1)(f) legitimate interest in answering people who write in | 24 months after our last contact |
| Your IP address, recorded with the enquiry | Abuse prevention and rate limiting on the form | 6(1)(f) legitimate interest in keeping the form usable | 24 months, with the enquiry |
| Vercel Web Analytics: page path, referrer, country, device type, and a hash-derived identifier | To see which pages are read, in aggregate | 6(1)(f) legitimate interest in understanding site use. No cookies, no cross-site tracking, no profiles | The identifier is discarded after 24 hours; only aggregates remain |
| Server logs kept by the hosting platform, including IP address | Security, debugging, and abuse handling | 6(1)(f) legitimate interest in operating the site securely | Per the platform's own retention, typically about 30 days |
| Email correspondence | To carry out and document the work discussed | 6(1)(b) performance of a contract | 24 months, or 7 years where it supports an invoice |
| Invoices and payment records | Dutch tax law requires them | 6(1)(c) legal obligation | 7 years (fiscal retention obligation) |
| Photographs of identifiable people | Delivery of commissioned work, and publication in this portfolio | Delivery: 6(1)(b). Portfolio publication: consent under 6(1)(a) via a model release or a clause in the engagement contract, or 6(1)(f) where no-one's interests override it. See Photographs of people. | Until you ask for removal, or the release is withdrawn |
No automated decision-making or profiling in the sense of Art. 22 GDPR takes place. Your data is never sold.
Who else processes your data
| Processor | Role | Location |
|---|---|---|
| Vercel Inc. | Website hosting, serverless functions, and cookieless Web Analytics | United States / EU edge |
| Resend | Delivers the contact form to the studio inbox | United States |
| «EMAIL PROVIDER» | Mailbox where enquiries are received and stored | «REGION» |
| unpkg.com and esm.sh | Public CDNs serving the JavaScript libraries the site's interactive pages need. Loading a page sends your IP address and user-agent to them. | Global CDN |
| Instagram (Meta) | Only if you click through to a profile link. Nothing is embedded or loaded from Meta on this site. | United States |
Web fonts are served from this site's own domain, so no font provider receives your IP address. See the cookie statement for the full list of third-party domains a page contacts.
Transfers outside the EEA
Vercel and Resend are US companies. Transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. You can ask for a copy of the safeguards that apply.
Your rights
Under the GDPR you may ask to: access the data held about you; rectify it if it is wrong; erase it; restrict or object to its processing — including any processing based on legitimate interest; and receive it in a portable format. Where processing rests on consent, you may withdraw that consent at any time, which does not affect processing already carried out.
Email sarp@sarpgurelmedia.com. You will get an answer within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are not satisfied, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ Den Haag), or to the authority where you live.
Photographs of people
A photograph of an identifiable person is personal data, and Dutch portretrecht (Auteurswet, Art. 19–21) gives the person photographed a say in commercial publication where they have a reasonable interest (redelijk belang). Both apply to the photographs published in the gallery on this site.
Photographs are published here on the basis of a signed model release, an equivalent clause in the engagement contract for the shoot, or — for crowd and event scenes — a legitimate interest in showing the work, balanced against the privacy of the people shown.
Ask for a photograph to be taken down
If you appear in a photograph on this site and want it removed, email sarp@sarpgurelmedia.com with the subject Photo removal request. Describe or link the photo. No reason is needed. It will be taken down within 14 days, usually much sooner, and you will get written confirmation. If you are not sure which photo, say roughly where and when it was taken and the search will be done for you.
Security
The site is served over HTTPS with HSTS. The contact form validates and rate-limits submissions. Access to the mailbox and to the photo archive is restricted to «LEGAL NAME».
Children
This site is not aimed at children, and enquiries are not knowingly accepted from anyone under 16. If a child has been photographed at a commissioned shoot, publication requires the consent of a parent or guardian.
Changes
If this policy changes, the date at the top changes with it. Material changes affecting how your data is used will be communicated directly where there is a way to reach you.