Privacy Policy – Andy Malhan Photography


1. Introduction


Andy Malhan Photography, based in the Netherlands, is responsible for the processing of personal data as described in this privacy policy. Personal data is handled with care and in accordance with the General Data Protection Regulation (GDPR / AVG).


2. Personal Data We Process


Andy Malhan Photography may process the following personal data:

  • Name
  • Email address
  • Phone number
  • Billing and invoice details
  • Payment information
  • Photographs and images in which individuals may be identifiable
  • Communication content (emails, messages, inquiries)
  • IP address and basic website usage data (if applicable)


3. Purposes of Data Processing


Personal data is processed for the following purposes:

  • Contacting clients and responding to inquiries
  • Executing photography agreements and delivering services
  • Editing, storing, and delivering photographs
  • Invoicing and financial administration
  • Portfolio presentation and marketing (only with explicit consent)
  • Compliance with legal and tax obligations
  • Improving website functionality and services (if applicable)


4. Legal Basis for Processing


  • Personal data is processed based on one or more of the following legal grounds:
  • Performance of a contract
  • Legal obligation
  • Legitimate interest
  • Explicit consent (particularly for publication of photographs)


5. Photography, Model Release, and Privacy Alignment


5.1 Model Release and Consent

For photographs in which individuals are identifiable, Andy Malhan Photography obtains explicit consent before using images for portfolio, website, social media, exhibitions, publications, or other promotional purposes. Consent is usually obtained through a written model release agreement or explicit written confirmation.


  • The model release specifies:
  • The purpose and scope of image use
  • The platforms or media on which images may be published
  • Whether the use is commercial or non-commercial
  • The duration of consent


Consent is voluntary and may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of use prior to withdrawal.


5.2 GDPR Alignment for Image Processing

Photographs that identify individuals qualify as personal data under the GDPR. In certain cases, they may also constitute special categories of personal data. Andy Malhan Photography processes such images in accordance with GDPR principles, including:

  • Lawfulness, fairness, and transparency
  • Purpose limitation
  • Data minimization
  • Storage limitation
  • Integrity and confidentiality
  • Images are processed only for purposes explicitly agreed upon with the data subject.


5.3 Rights of Clients and Subjects

Individuals appearing in photographs have the right to:

  • Access their personal data and images
  • Request correction or deletion
  • Restrict or object to specific uses
  • Withdraw consent for publication or promotional use
  • Requests will be handled within the statutory GDPR time limits.


5.4 Storage and Security of Images

Photographs are stored securely using appropriate technical and organizational measures. Access is limited to authorized persons only. Images are not shared with third parties unless required for service delivery (e.g. printing services) or explicitly agreed upon.


5.5 Minors

For photographs involving minors under the age of 16, consent is obtained from a parent or legal guardian prior to processing or publication.


5.6 Conflict Between Contract and Privacy Rights

In the event of a conflict between contractual image usage terms and privacy rights under the GDPR, applicable data protection law prevails.


6. Data Retention


Personal data is not retained longer than necessary. Financial and administrative data is retained in accordance with Dutch tax legislation (generally 7 years). Photographs are retained according to contractual agreements or until consent is withdrawn, unless a longer retention period is legally required.


7. Sharing of Personal Data


Personal data is not sold or shared with third parties unless necessary to perform services or comply with legal obligations (for example: accountant, tax authorities, hosting providers).


8. Data Security


Appropriate technical and organizational measures are taken to protect personal data against loss, misuse, unauthorized access, or disclosure.


9. Your Rights


You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request deletion of data
  • Restrict or object to processing
  • Withdraw consent
  • Data portability
  • File a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

Requests may be submitted via email.


10. Cookies and Website Data


If applicable, the website uses functional and analytical cookies. Tracking cookies are used only with consent.


11. Contact Details


Andy Malhan Photography

Email: andy@andymalhan.com

Chamber of Commerce (KvK): 89743237


12. Changes to This Policy


This privacy policy may be updated from time to time. The most recent version will always be available on the website.