Privacy Policy

Effective Date: July 6, 2026
1. Who is responsible for your data
The controller for the personal data described in this policy is Dmytro Derkach, photographer, operating under the trade name Derkach Photography, Rrue des fuchsias 40, 1080 Molenbeek-Saint-Jean, Belgium.
Contact for all privacy matters: info@derkach-photo.com
Professional assignments are contracted and invoiced through SMart (SMartCoop CVSO/SCES, [enterprise no.], Rue Émile Féron 70, 1060 Brussels), the Belgian cooperative through which I carry out my activity. SMart is not a processor acting on my instructions: for the purposes of contracting, invoicing, social security and payroll obligations, SMart acts as a separate and independent controller under its own legal obligations. Its own privacy policy applies to that processing.
2. What data I collect
Clients and prospective clients: name, company name, VAT number, postal address, email address, telephone number, the content of our correspondence, project briefs, and information relating to the assignment (dates, locations, deliverables, agreed fees).
Photographic subjects: your image, and where a model release is signed, your name, signature, date of birth where relevant, and contact details.
Website visitors: data submitted through contact forms, and technical data collected through cookies and similar technologies as described in section 9.
I do not deliberately collect special categories of data under Article 9 GDPR. Where a photograph incidentally reveals information such as ethnic origin or religious belief, that data is processed solely on the basis of your consent to the photography itself.
3. Why I process it, and on what legal basis
Responding to enquiries and preparing quotations — Article 6(1)(b) GDPR, steps taken at your request prior to entering into a contract.
Performing the photography assignment — Article 6(1)(b) GDPR, performance of a contract.
Transmitting client details to SMart for contracting and invoicing — Article 6(1)(c) GDPR, compliance with a legal obligation, together with Article 6(1)(b).
Retaining accounting and tax records — Article 6(1)(c) GDPR, compliance with a legal obligation.
Publishing photographs in my portfolio, on my website and on social media — Article 6(1)(a) GDPR, your consent, given through a model release.
Establishing, exercising or defending legal claims — Article 6(1)(f) GDPR, legitimate interest.
Analytics and marketing cookies — Article 6(1)(a) GDPR, your consent.
4. Rights to your image
Under Belgian law, the right to one's image is distinct from data protection law. Photographing you, and publishing photographs of you, each require your separate agreement.
Where photographs are intended for publication, a written model release is used. Consent to publication may be withdrawn at any time by writing to info@derkach-photo.com. Withdrawal takes effect for the future: I will remove the images from my website and social media channels within a reasonable period, but I cannot recall copies already distributed by third parties, printed, or archived by search engines.
Minors. For the photography and publication of a person under 18, the consent of both parents or legal guardians is required, in writing. This requirement is independent of the age at which a minor may consent to information society services, which in Belgium is set at 13 years (Article 8(1) GDPR, as implemented by the Act of 30 July 2018).
5. Who receives your data
SMart — separate controller, as described in section 1.
Tilda Publishing — website hosting and form processing, as described in section 6.
Google Ireland Limited — website analytics, where you have consented.
My email provider, [provider] — acting as a processor under a written agreement pursuant to Article 28 GDPR, with servers located in the European Economic Area.
My accountant, and where necessary my lawyer — bound by professional secrecy.
Public authorities — where disclosure is required by law.
I do not sell personal data, and I do not share it for third-party advertising purposes.
6. Website hosting and international transfers
This website is built and hosted on the Tilda platform. Website data, including form submissions, is stored on servers located within the European Economic Area.
Technical support and maintenance carried out by the platform's personnel may involve access to that data from outside the European Economic Area. Where the country from which such access takes place does not benefit from an adequacy decision under Article 45 GDPR, the transfer relies on Article 46(2)(c) GDPR: the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented by the technical and organisational measures set out in the platform's data processing agreement and by a transfer impact assessment.
Other transfers outside the EEA rely on adequacy decisions adopted by the European Commission: Canada (commercial organisations subject to PIPEDA) and the EU–US Data Privacy Framework, for recipients certified under that framework.
You may request a copy of the relevant safeguards by writing to info@derkach-photo.com.
7. How long I keep it
Enquiries that do not lead to a contract are kept for 12 months from the last exchange.
Client correspondence and project files are kept for 10 years from the end of the contract, corresponding to the limitation period for contractual claims under Article 2262bis of the Civil Code.
Model releases and consent records are kept for 10 years from signature.
Accounting and VAT documentation is kept for 7 years, in accordance with the retention period applicable following the Act of 18 December 2025, which reinstated the seven-year period retroactively from assessment year 2023.
Photographic originals and archives are retained as part of my professional archive for as long as consent is not withdrawn.
Cookie consent preferences are kept for 6 months, in accordance with the recommendation of the Belgian Data Protection Authority of 20 October 2023.
8. Your rights
You have the right to request access to your personal data, its rectification or erasure, restriction of processing, and data portability. You may object to processing based on legitimate interest, and you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Requests go to info@derkach-photo.com. I will respond within one month, extendable by two further months for complex requests, and will inform you if such an extension is necessary. I may ask for proof of identity where I have reasonable doubt as to who is making the request.
If you consider that your data has been processed unlawfully, you may lodge a complaint with the Belgian Data Protection Authority — Autorité de protection des données / Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Brussels — telephone +32 2 274 48 00, contact@apd-gba.be. You may also bring proceedings before the courts.
9. Cookies
Cookies are governed by Article 129 of the Act of 13 June 2005 on electronic communications, as amended (notably by the Act of 16 December 2021 transposing the European Electronic Communications Code), which implements Article 5(3) of the ePrivacy Directive, read together with the GDPR.
Strictly necessary cookies are placed without consent: they are required for the website to function and to record your cookie choices.
Analytics and marketing cookies are placed only after you have given consent through the cookie banner. You may withdraw or modify your choices at any time via the cookie settings link on each page.
Google Analytics. Where you consent, Google Analytics is used to measure website audience. The _ga cookie has a lifespan of two years. Independently of the cookie lifespan, data retention within Google Analytics is configured at 14 months, after which user-level data is deleted. IP addresses are truncated before storage.
Meta Pixel. The Meta Pixel is not currently deployed on this website. Should it be introduced, this policy will be updated and consent will be requested through the cookie banner before any activation.
Your cookie consent choices are stored for 6 months, after which you will be asked again.
10. Security
Access to client files, correspondence and photographic originals is protected by strong authentication and encrypted storage. Original files are held on encrypted media with encrypted backups. Access is limited to me alone, save for the processors listed in section 5.
11. Language versions
This privacy policy is available in French and in English. Both versions have equal legal value. In the event of a discrepancy between the versions, the interpretation most favourable to the data subject prevails. For clients residing in Belgium, the French version serves as the reference text.
12. Changes

• This policy may be amended to reflect changes in my activity or in applicable law. The version in force is the one published on this page, with its date of last update. Material changes affecting processing based on your consent will be notified to you, and fresh consent requested where required.