Privacy Policy

Last updated: Sept 2026

At Pau Granillo Photography, I care about your privacy. This policy explains what personal data I collect, why I collect it, how long I keep it and what rights you have. I process personal data in accordance with the General Data Protection Regulation (GDPR / AVG).

Who I am
Pau Granillo Photography is the controller responsible for processing your personal data.
Name: Paula Granillo
Business: Pau Granillo Photography
Location: Haarlem, the Netherlands
Chamber of Commerce (KvK): 91678366
Email: paula.granillo@gmail.com
Phone / WhatsApp: +31 6 16928831

What personal data I collect and why

When you contact me (contact form, email, WhatsApp or social media)
I collect your name, email address, phone number (if you share it), the type of session you’re interested in and the content of your message. I use this data to answer your questions and to prepare a proposal.
Legal basis: taking steps at your request before entering into an agreement.

When you book a session or a photography course
I collect your name, contact details, billing details and any information needed to plan the session or course (such as location, date and number of participants). I use this data to carry out our agreement, to send invoices and to keep my administration.
Legal basis: performance of a contract and legal obligations (tax law).

Photographs taken during a session
The photos I take of you, your family or your business are personal data. I use them to deliver your gallery and to carry out our agreement.
I will only use photos in my portfolio, on my website, on social media or in other promotional materials with your explicit prior consent. You can withdraw that consent at any time, and I will then stop using those photos in new publications.
Photos of children under 16 are only used with the consent of their parents or legal guardians.
Legal basis: performance of a contract; consent for promotional use.

When you visit my website
My website collects technical data such as your IP address, browser type and the pages you visit. Some of this data is collected through cookies and similar technologies (see section 5).
Legal basis: legitimate interest (security and basic functioning of the website) and consent (analytics and marketing cookies).

Blog comments
If you leave a comment, I collect the data shown in the comment form, your IP address and browser information to help detect spam.
Legal basis: legitimate interest.

Who I share your data with

I never sell your personal data. I only share it with trusted service providers that help me run my business, such as:

  • my website hosting provider Bitsteady Creative;
  • my email provider (Google);
  • the platform I use to deliver online galleries Pixieset;
  • my accountant and accounting software, for my administration;
  • WhatsApp (Meta), if you contact me through WhatsApp;
  • the analytics and marketing tools described in section

Some of these providers may process data outside the European Economic Area (for example in the United States). In that case, the transfer is protected by appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
I may also share data when required by law.

How long I keep your data

  • Enquiries that don’t lead to a booking: up to 1 year after our last contact.
  • Client details, invoices and administration: 7 years, as required by Dutch tax law.
  • Online galleries: available for 12 months after delivery.
  • Session photos (backup archive): 2 years, so I can help you if you lose your files.
  • Photos used in my portfolio or on social media: until you withdraw your consent.
  • Website and cookie data: see section 5.

Cookies and similar technologies

My website uses:

  • Functional cookies: necessary for the website to work properly. These do not require consent.
  • Analytics cookies: Google Analytics and Jetpack Stats (WordPress.com) help me understand how visitors use my website so I can improve it.
  • Marketing cookies: the Meta Pixel (Facebook/Instagram) and the Pinterest Tag help me measure and improve my advertising.
    Analytics and marketing cookies are only placed after you give your consent through the cookie banner. You can change or withdraw your consent at any time via the cookie settings on this website.

Embedded content and external services
Some pages include content or services from other websites, such as Vimeo videos, Google Fonts and Google reCAPTCHA to protect my contact form against spam. These services may collect data about you, such as your IP address, in the same way as if you visited their websites directly.

How I protect your data

I take appropriate technical and organisational measures to protect your personal data against loss and unauthorised access, such as a secure (HTTPS) website, password-protected accounts and secure storage of photo files.

Your rights
You have the right to:

  • access the personal data I hold about you;
  • have incorrect data corrected;
  • have your data deleted;
  • restrict or object to the processing of your data;
  • receive your data in a portable format;
  • withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
    To exercise your rights, send an email to paula.granillo@gmail.com. I will respond within one month.
    If you are not satisfied with how I handle your personal data, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Changes to this policy

I may update this privacy policy from time to time. The latest version will always be available on this page.