I'm Flavio Moretti, a sports and event photographer. On flaviomoretti.nl you can browse and buy photos from road cycling and cyclocross events, and request an assignment. To do that, I need some of your data. This policy explains which data that is, why I use it, how long I keep it and what your rights are.
In short: I only use your data to handle your order, question or assignment, and to improve the website. I never sell your data, and I don't use advertising or tracking cookies from other companies.
1. Who is responsible?
Flavio Moretti Media (a sole proprietorship of Flavio Moretti, the Netherlands) is the data controller under the General Data Protection Regulation (GDPR). Questions about your data? Email info@flaviomoretti.nl or call +31 6 40510312.
2. Which data do I use, and why?
Below you'll find, per situation, which data I process, for what purpose and on which legal basis under the GDPR.
Buying photos in the web shop
When you order, I ask for your name, email address and country (the country determines the VAT). If you order as a business, I also ask for your company name, billing address and, optionally, your VAT number. As a private customer you don't enter an address. I also store the order details: order number, purchased photos, chosen licence, amount, any discount code and the date. I need this to deliver your photos (via a download link by email), issue an invoice and find your order if you have a question. You can order as a guest or with an account. If you order as a guest, the website creates a temporary guest profile in the background so your cart is kept. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and the legal obligation to keep financial records (Art. 6(1)(c) GDPR).
An account
If you create an account, I store your name, email address, an encrypted password, your language preference and, optionally, your preferred licence and address. Your account shows your previous orders and downloads. You can delete your account yourself from your profile. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
A notification when an album is complete
For an album that is still being uploaded, you can leave your email address. You'll then receive one email as soon as all photos are online. I only use your address for that single notification, never for newsletters or advertising, and only for the album you signed up for. After that one email you won't hear from me about it again. Legal basis: consent (Art. 6(1)(a) GDPR). Changed your mind, or want your address removed sooner? Just email me and I'll delete it.
Contact form and email
If you contact me, I use your name, email address, and, if provided, your phone number, company details and the content of your message to answer your question. The contact form is protected against spam by Google reCAPTCHA (see section 4). Legal basis: legitimate interest in answering your question (Art. 6(1)(f) GDPR), or steps prior to entering into a contract (Art. 6(1)(b) GDPR).
Requesting an assignment (work with me)
If you request an assignment through the form on /samenwerken, I store your name, email address, optionally your phone number and organisation, and what you enter about the assignment (such as date, location, budget and your message). I use this to answer your request and make a proposal. This form is also protected by Google reCAPTCHA (see section 4). Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR).
Assignments and private galleries
For a photography assignment, I process the contact and company details of you or your organisation, the agreements about the assignment and the billing details. I may deliver photos through a private gallery: a secret link that is not indexed by search engines and only works for people who have it. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Photos you appear in
I photograph public sporting events. If you take part or watch, you may be recognisable in a photo. I publish these photos (with a watermark) on the website so participants can find and buy them. I don't link names to photos and I don't use facial recognition. Legal basis: my legitimate interest as a photographer in covering events and offering the photos (Art. 6(1)(f) GDPR). Would you like a photo of you taken offline? Email me the link to the photo and I'll remove it. I always honour reasonable requests, for example when a photo is unflattering or shows a personal situation.
Security and technical data
On every visit, the server processes technical data such as your IP address, browser type and time of the request. This is needed to run the website, prevent abuse (such as login attempts and spam) and fix problems. In addition, my own database counts how far visitors get in the ordering process (for example cart, checkout, paid) and on what kind of device. For this I use a random code per visit, no name, email or IP address. Legal basis: legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
3. Cookies and website statistics
A cookie is a small file stored in your browser. I only use cookies that are needed to run the website, plus one analytics cookie for visitor statistics. I don't use advertising, social media or tracking cookies from other companies. That's why you don't see a cookie banner.
Functional cookies
These cookies are needed to log in, keep your cart, remember your language and submit forms securely (including laravel_session and XSRF-TOKEN). They expire when your session ends. No consent is required for these.
Analytics cookie (Matomo)
To see how the website is used, for example which albums are popular and where people drop off at checkout, I use Matomo. Matomo runs on my own server, so the data doesn't go to Google or any other company. Matomo sets the cookie _pk_id (13 months) to recognise whether a visit comes from the same browser, and _pk_ses (30 minutes) for the current visit. I have configured Matomo with privacy in mind: your IP address is shortened immediately (the last two parts are removed), nothing is shared with third parties, you are not followed across other websites, nothing is measured if your browser sends "Do Not Track", and statistics are never linked to your name or order. Because this cookie is only used for my own statistics and has little impact on your privacy, no consent is required under Dutch law. Legal basis: legitimate interest in improving the website (Art. 6(1)(f) GDPR). Prefer not to be counted? Use the button below.
Paying via Mollie
At checkout you are taken to Mollie's payment page. Mollie may set its own necessary cookies there for secure payment. See mollie.com/privacy.
Your choice for website statistics
…
This choice is stored in a cookie in your browser. If you clear your cookies or use another browser, you will need to set it again.
You can also delete or block cookies in your browser settings. Without functional cookies, logging in and the cart will no longer work.
4. Other companies I work with
I never sell or rent out your data. I do work with a few service providers who may process data about you:
Mollie (the Netherlands) processes your payment. I only receive confirmation of whether the payment succeeded, not your bank or card details.
Hosting provider (within the EU): runs the website, the database and email.
Own storage server (the Netherlands): stores the original photos and the website statistics (Matomo), under my own control.
Google reCAPTCHA protects the contact form, the request form (/samenwerken) and account creation against spam. The script is only loaded on those forms. Google receives, among other things, your IP address and browser data and may process them outside the EU under the EU-US Data Privacy Framework. See policies.google.com/privacy.
European Commission (VIES): if you enter a VAT number with a business order, I check that number in the official EU database VIES.
Tax authorities and other public bodies, only when required by law.
5. How long do I keep your data?
Orders and invoices: 7 years, as required by Dutch tax law.
Account: until you delete it. Any orders you placed (with the details on the invoice) are kept for 7 years. The rest of your account is erased.
Guest profile without a paid order (for example a cart you never checked out): deleted automatically after 30 days.
Album notification: deleted automatically no later than one year after the notification was sent (sooner on request).
Contact and email: up to 2 years after the last contact, unless it relates to an assignment or order. In that case, that retention period applies.
Requests via /samenwerken: automatically deleted 2 years after the last change. If it became an assignment, the invoice details are kept for 7 years.
Ordering process data: automatically deleted after 13 months.
Statistics (Matomo): raw visit data for up to 25 months. After that, only aggregated figures without per-visit data remain.
Photos: as long as the album is online, or until you ask me to remove a photo of you.
6. How do I protect your data?
The website uses an encrypted connection (https). Passwords are stored encrypted, so even I can't read them. Only I have access to the admin area, protected by a personal account. Original photos are stored on a protected server and can only be downloaded after a paid order. Private galleries use long links that can't be guessed. I keep the software up to date and make regular backups. Fonts and other parts of the website are served from my own server, not by third parties.
Think something is wrong with the security of your data? Please email info@flaviomoretti.nl right away.
7. Your rights
You have the right to access your data and to have it corrected or deleted. You can also restrict processing, object to processing based on legitimate interest (such as statistics or a photo you appear in), and receive your data in a common file format (data portability). Where you gave consent, for example for a notification, you can withdraw it at any time.
Send your request to info@flaviomoretti.nl, preferably from the email address you ordered with or used for your account, so I can check it's really your data. You don't need to send a copy of your ID. I'll respond within one month. Data I'm legally required to keep, such as invoices, can only be deleted once the retention period has ended.
8. Complaints
Not happy with how I handle your data? Please let me know and we'll find a solution together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl, or with the supervisory authority in your own EU country.
9. Changes
I update this policy when the website or the rules change. The date at the top shows when it was last updated. If there are major changes that affect you, I'll let you know via the website or by email.
This English version is a translation. If the Dutch and English versions differ, the Dutch version prevails.
