Privacy Policy
Effective Date: August 4, 2026
1. Who is responsible for your data
The controller for the personal data described in this policy is Dmytro Derkach, photographer, operating under the trade name Derkach Photography, Rue des fuchsias 40, 1080 Molenbeek-Saint-Jean, Belgium. Contact for all privacy matters: info@derkach-photo.com Professional assignments are contracted and invoiced through Smart Coop – Productions Associées asbl, Rue Coenraets 72, 1060 Saint-Gilles, Belgium, company number 0896 755 397 (VAT BE 0896 755 397), the Belgian structure through which I carry out my activity. SMart is not a processor acting on my instructions: for the purposes of contracting, invoicing, social security and payroll obligations, SMart acts as a separate and independent controller under its own legal obligations. Its own privacy policy applies to that processing.
2. What data I collect
Clients and prospective clients: name, company name, VAT number, postal address, email address, telephone number, the content of our correspondence, project briefs, and information relating to the assignment (dates, locations, deliverables, agreed fees).
Photographic subjects: your image, and where a model release is signed, your name, signature, date of birth where relevant, and contact details.
Website visitors: data submitted through contact forms, and technical data collected through cookies and similar technologies as described in section 9.
I do not deliberately collect special categories of data under Article 9 GDPR. Where a photograph incidentally reveals information such as ethnic origin or religious belief, that data is processed solely on the basis of your consent to the photography itself.
3. Why I process it, and on what legal basis
Responding to enquiries and preparing quotations — Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract.
Performing the photography assignment — Article 6(1)(b) GDPR, performance of a contract.
Transmitting client details to SMart for contracting and invoicing — Article 6(1)(c) GDPR, compliance with a legal obligation, together with Article 6(1)(b).
Retaining accounting and tax records — Article 6(1)(c) GDPR, compliance with a legal obligation.
Publishing photographs in my portfolio, on my website and on social media — Article 6(1)(a) GDPR, your consent, given through a model release.
Establishing, exercising or defending legal claims — Article 6(1)(f) GDPR, legitimate interest.
Analytics and marketing cookies — Article 6(1)(a) GDPR, your consent.
4. Rights to your image
Under Belgian law, the right to one's image is distinct from data protection law. Photographing you, and publishing photographs of you, each require your separate agreement.
Where photographs are intended for publication, a written model release is used. Consent to publication may be withdrawn at any time by writing to info@derkach-photo.com. Withdrawal takes effect for the future: I will remove the images from my website and social media channels within a reasonable period, but I cannot recall copies already distributed by third parties, printed, or archived by search engines.
Minors. For the photography and publication of a person under 18, the consent of both parents or legal guardians is required, in writing. This requirement is independent of the age at which a minor may consent to information society services, which in Belgium is set at 13 years (Article 8(1) GDPR, as implemented by the Act of 30 July 2018).
5. Who receives your data
SMart — separate controller, as described in section 1.
Tilda Publishing — website hosting and form processing, as described in section 6.
Google Ireland Limited — website analytics, where you have consented.
My email provider, Google Ireland Limited — acting as a processor under the Google Workspace Data Processing Addendum concluded pursuant to Article 28 GDPR. Message content may be stored and processed outside the European Economic Area; those transfers rely on the EU–US Data Privacy Framework and, in the alternative, on the European Commission's Standard Contractual Clauses.
Meta Platforms Ireland Limited — the Meta Pixel, where you have consented to advertising cookies. For the collection of that data on this website and its transmission to Meta, Meta and I act as joint controllers within the meaning of Article 26 GDPR, under Meta's Controller Addendum; for the processing Meta subsequently carries out for its own purposes, Meta acts alone as controller. Where you contact me through the WhatsApp button on this website, the content of that conversation is processed by Meta under its own terms and this policy does not govern it.
An external professional retoucher — for high-end retouching of beauty, jewellery and reflective-product images only, acting as a sub-processor under Article 28 GDPR, bound by a confidentiality and data processing agreement. Only the images you have selected are transferred, by secure link, and are deleted on delivery. You may request that retouching be carried out entirely in-house; the timeline and the rate are adjusted accordingly.
My accountant, and where necessary my lawyer — bound by professional secrecy.
Public authorities — where disclosure is required by law.
I do not sell personal data. I do not disclose it to third parties for their own advertising purposes; the measurement and advertising cookies described in section 9 are placed only with your consent and serve the advertising of my own services.
6. Website hosting and international transfers
This website is built and hosted on the Tilda platform. Website data, including form submissions, is stored on servers operated by Hetzner Online GmbH, located within the European Union, under a data processing agreement concluded with the platform. Where a third-party service that itself collects personal data is connected to this website — such as an external form handler, an analytics provider or a delivery service — that data is additionally stored on the servers of the provider of that service. The services currently in use are listed in section 5.
Technical support and maintenance carried out by the platform's personnel may involve access to that data from outside the European Economic Area. Where the country from which such access takes place does not benefit from an adequacy decision under Article 45 GDPR, the transfer relies on Article 46(2)(c) GDPR: the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented by the technical and organisational measures set out in the platform's data processing agreement and by a transfer impact assessment.
Other transfers outside the EEA rely on adequacy decisions adopted by the European Commission: Canada (commercial organisations subject to PIPEDA) and the EU–US Data Privacy Framework, for recipients certified under that framework, whose certification may be verified on the public list maintained at dataprivacyframework.gov.
You may request a copy of the relevant safeguards by writing to info@derkach-photo.com.
7. How long I keep it
Enquiries that do not lead to a contract are kept for 12 months from the last exchange.
Client correspondence and project files are kept for 10 years from the end of the contract, corresponding to the limitation period for contractual claims under Article 2262bis of the Civil Code.
Model releases and consent records are kept for 10 years from signature.
Accounting and VAT documentation is kept for 7 years, in accordance with the retention period applicable following the Act of 18 December 2025, which reinstated the seven-year period retroactively from assessment year 2023.
Photographic originals and archives are retained as part of my professional archive for as long as consent is not withdrawn.
Cookie consent preferences are kept for 6 months, in accordance with the recommendation of the Belgian Data Protection Authority of 20 October 2023.
8. Your rights
You have the right to request access to your personal data, its rectification or erasure, restriction of processing, and data portability. You may object to processing based on legitimate interest, and you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Requests go to info@derkach-photo.com. I will respond within one month, extendable by two further months for complex requests, and will inform you if such an extension is necessary. I may ask for proof of identity where I have reasonable doubt as to who is making the request.
If you consider that your data has been processed unlawfully, you may lodge a complaint with the Belgian Data Protection Authority — Autorité de protection des données / Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Brussels — telephone +32 2 274 48 00, contact@apd-gba.be. You may also bring proceedings before the courts.
9. Cookies
Cookies are governed by Article 129 of the Act of 13 June 2005 on electronic communications, as amended (notably by the Act of 16 December 2021 transposing the European Electronic Communications Code), which implements Article 5(3) of the ePrivacy Directive, read together with the GDPR.
Strictly necessary cookies are placed without consent: they are required for the website to function and to record your cookie choices.
Analytics and marketing cookies are placed only after you have given consent through the cookie banner. You may withdraw or modify your choices at any time via the cookie settings link on each page.
Google Analytics. Where you consent, Google Analytics is used to measure website audience. The _ga cookie has a lifespan of two years. Independently of the cookie lifespan, data retention within Google Analytics is configured at 14 months, after which user-level data is deleted. IP addresses are truncated before storage.
Meta Pixel. Where you consent to advertising cookies, the Meta Pixel (ID 2319540681912356) is loaded. Until that consent is given the script is inert: it is served as inactive text and executes nothing. Once loaded, it records your visit and the pages you view and transmits that information to Meta Platforms Ireland Limited, so that website audience can be measured and so that advertising for my services can be shown to people who have visited this website. The _fbp cookie has a lifespan of three months. Advanced matching — the transmission of hashed contact details — is not enabled. You may withdraw your consent at any time through the cookie settings link on each page; withdrawal stops further collection but does not affect data already transmitted. Meta's own processing of that data is described in Meta's privacy policy.
Your cookie consent choices are stored for 6 months, after which you will be asked again.
10. Security
Access to client files, correspondence and photographic originals is protected by strong authentication and encrypted storage. Original files are held on encrypted media with encrypted backups. Access is limited to me alone, save for the processors listed in section 5.
11. Language versions
This privacy policy is available in French and in English. Both versions have equal legal value. In the event of a discrepancy between the versions, the interpretation most favourable to the data subject prevails. For clients residing in Belgium, the French version serves as the reference text.
12. Changes
1. Who is responsible for your data
The controller for the personal data described in this policy is Dmytro Derkach, photographer, operating under the trade name Derkach Photography, Rue des fuchsias 40, 1080 Molenbeek-Saint-Jean, Belgium. Contact for all privacy matters: info@derkach-photo.com Professional assignments are contracted and invoiced through Smart Coop – Productions Associées asbl, Rue Coenraets 72, 1060 Saint-Gilles, Belgium, company number 0896 755 397 (VAT BE 0896 755 397), the Belgian structure through which I carry out my activity. SMart is not a processor acting on my instructions: for the purposes of contracting, invoicing, social security and payroll obligations, SMart acts as a separate and independent controller under its own legal obligations. Its own privacy policy applies to that processing.
2. What data I collect
Clients and prospective clients: name, company name, VAT number, postal address, email address, telephone number, the content of our correspondence, project briefs, and information relating to the assignment (dates, locations, deliverables, agreed fees).
Photographic subjects: your image, and where a model release is signed, your name, signature, date of birth where relevant, and contact details.
Website visitors: data submitted through contact forms, and technical data collected through cookies and similar technologies as described in section 9.
I do not deliberately collect special categories of data under Article 9 GDPR. Where a photograph incidentally reveals information such as ethnic origin or religious belief, that data is processed solely on the basis of your consent to the photography itself.
3. Why I process it, and on what legal basis
Responding to enquiries and preparing quotations — Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract.
Performing the photography assignment — Article 6(1)(b) GDPR, performance of a contract.
Transmitting client details to SMart for contracting and invoicing — Article 6(1)(c) GDPR, compliance with a legal obligation, together with Article 6(1)(b).
Retaining accounting and tax records — Article 6(1)(c) GDPR, compliance with a legal obligation.
Publishing photographs in my portfolio, on my website and on social media — Article 6(1)(a) GDPR, your consent, given through a model release.
Establishing, exercising or defending legal claims — Article 6(1)(f) GDPR, legitimate interest.
Analytics and marketing cookies — Article 6(1)(a) GDPR, your consent.
4. Rights to your image
Under Belgian law, the right to one's image is distinct from data protection law. Photographing you, and publishing photographs of you, each require your separate agreement.
Where photographs are intended for publication, a written model release is used. Consent to publication may be withdrawn at any time by writing to info@derkach-photo.com. Withdrawal takes effect for the future: I will remove the images from my website and social media channels within a reasonable period, but I cannot recall copies already distributed by third parties, printed, or archived by search engines.
Minors. For the photography and publication of a person under 18, the consent of both parents or legal guardians is required, in writing. This requirement is independent of the age at which a minor may consent to information society services, which in Belgium is set at 13 years (Article 8(1) GDPR, as implemented by the Act of 30 July 2018).
5. Who receives your data
SMart — separate controller, as described in section 1.
Tilda Publishing — website hosting and form processing, as described in section 6.
Google Ireland Limited — website analytics, where you have consented.
My email provider, Google Ireland Limited — acting as a processor under the Google Workspace Data Processing Addendum concluded pursuant to Article 28 GDPR. Message content may be stored and processed outside the European Economic Area; those transfers rely on the EU–US Data Privacy Framework and, in the alternative, on the European Commission's Standard Contractual Clauses.
Meta Platforms Ireland Limited — the Meta Pixel, where you have consented to advertising cookies. For the collection of that data on this website and its transmission to Meta, Meta and I act as joint controllers within the meaning of Article 26 GDPR, under Meta's Controller Addendum; for the processing Meta subsequently carries out for its own purposes, Meta acts alone as controller. Where you contact me through the WhatsApp button on this website, the content of that conversation is processed by Meta under its own terms and this policy does not govern it.
An external professional retoucher — for high-end retouching of beauty, jewellery and reflective-product images only, acting as a sub-processor under Article 28 GDPR, bound by a confidentiality and data processing agreement. Only the images you have selected are transferred, by secure link, and are deleted on delivery. You may request that retouching be carried out entirely in-house; the timeline and the rate are adjusted accordingly.
My accountant, and where necessary my lawyer — bound by professional secrecy.
Public authorities — where disclosure is required by law.
I do not sell personal data. I do not disclose it to third parties for their own advertising purposes; the measurement and advertising cookies described in section 9 are placed only with your consent and serve the advertising of my own services.
6. Website hosting and international transfers
This website is built and hosted on the Tilda platform. Website data, including form submissions, is stored on servers operated by Hetzner Online GmbH, located within the European Union, under a data processing agreement concluded with the platform. Where a third-party service that itself collects personal data is connected to this website — such as an external form handler, an analytics provider or a delivery service — that data is additionally stored on the servers of the provider of that service. The services currently in use are listed in section 5.
Technical support and maintenance carried out by the platform's personnel may involve access to that data from outside the European Economic Area. Where the country from which such access takes place does not benefit from an adequacy decision under Article 45 GDPR, the transfer relies on Article 46(2)(c) GDPR: the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented by the technical and organisational measures set out in the platform's data processing agreement and by a transfer impact assessment.
Other transfers outside the EEA rely on adequacy decisions adopted by the European Commission: Canada (commercial organisations subject to PIPEDA) and the EU–US Data Privacy Framework, for recipients certified under that framework, whose certification may be verified on the public list maintained at dataprivacyframework.gov.
You may request a copy of the relevant safeguards by writing to info@derkach-photo.com.
7. How long I keep it
Enquiries that do not lead to a contract are kept for 12 months from the last exchange.
Client correspondence and project files are kept for 10 years from the end of the contract, corresponding to the limitation period for contractual claims under Article 2262bis of the Civil Code.
Model releases and consent records are kept for 10 years from signature.
Accounting and VAT documentation is kept for 7 years, in accordance with the retention period applicable following the Act of 18 December 2025, which reinstated the seven-year period retroactively from assessment year 2023.
Photographic originals and archives are retained as part of my professional archive for as long as consent is not withdrawn.
Cookie consent preferences are kept for 6 months, in accordance with the recommendation of the Belgian Data Protection Authority of 20 October 2023.
8. Your rights
You have the right to request access to your personal data, its rectification or erasure, restriction of processing, and data portability. You may object to processing based on legitimate interest, and you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Requests go to info@derkach-photo.com. I will respond within one month, extendable by two further months for complex requests, and will inform you if such an extension is necessary. I may ask for proof of identity where I have reasonable doubt as to who is making the request.
If you consider that your data has been processed unlawfully, you may lodge a complaint with the Belgian Data Protection Authority — Autorité de protection des données / Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Brussels — telephone +32 2 274 48 00, contact@apd-gba.be. You may also bring proceedings before the courts.
9. Cookies
Cookies are governed by Article 129 of the Act of 13 June 2005 on electronic communications, as amended (notably by the Act of 16 December 2021 transposing the European Electronic Communications Code), which implements Article 5(3) of the ePrivacy Directive, read together with the GDPR.
Strictly necessary cookies are placed without consent: they are required for the website to function and to record your cookie choices.
Analytics and marketing cookies are placed only after you have given consent through the cookie banner. You may withdraw or modify your choices at any time via the cookie settings link on each page.
Google Analytics. Where you consent, Google Analytics is used to measure website audience. The _ga cookie has a lifespan of two years. Independently of the cookie lifespan, data retention within Google Analytics is configured at 14 months, after which user-level data is deleted. IP addresses are truncated before storage.
Meta Pixel. Where you consent to advertising cookies, the Meta Pixel (ID 2319540681912356) is loaded. Until that consent is given the script is inert: it is served as inactive text and executes nothing. Once loaded, it records your visit and the pages you view and transmits that information to Meta Platforms Ireland Limited, so that website audience can be measured and so that advertising for my services can be shown to people who have visited this website. The _fbp cookie has a lifespan of three months. Advanced matching — the transmission of hashed contact details — is not enabled. You may withdraw your consent at any time through the cookie settings link on each page; withdrawal stops further collection but does not affect data already transmitted. Meta's own processing of that data is described in Meta's privacy policy.
Your cookie consent choices are stored for 6 months, after which you will be asked again.
10. Security
Access to client files, correspondence and photographic originals is protected by strong authentication and encrypted storage. Original files are held on encrypted media with encrypted backups. Access is limited to me alone, save for the processors listed in section 5.
11. Language versions
This privacy policy is available in French and in English. Both versions have equal legal value. In the event of a discrepancy between the versions, the interpretation most favourable to the data subject prevails. For clients residing in Belgium, the French version serves as the reference text.
12. Changes
- This policy may be amended to reflect changes in my activity or in applicable law. The version in force is the one published on this page, with its date of last update. Material changes affecting processing based on your consent will be notified to you, and fresh consent requested where required.
Manage cookies
Cookie Settings
Cookies necessary for the correct operation of the site are always enabled.
Other cookies are configurable.
Other cookies are configurable.