Privacy Policy
Last updated: 09/09/2026
This policy explains what happens to your personal information when you visit roxyjc.nl, send me a message through this site, or appear in photographs I take at an event.
1. Who is responsible for your data
Roxy JC
Magersfonteinstraat,
Amsterdam, the Netherlands
KVK: 90534247
Email: info@roxyjc.nl
I'm the data controller for this website, which means I decide what personal data is collected here and why. There's no data protection officer; for a business this size, there doesn't need to be one, so questions come straight to me at the address above.
2. What this site collects
When you fill in a form
There are two forms on this site: one on the Contact page and one on the Prices page. Both ask for your name, your email address, and a description of your project. That's it. Those three things go to me so I can reply to you. Nothing is pre-ticked, and I don't ask for anything I don't need to answer your message.
What this site does not do
I want to be specific about this, because most sites do the opposite:
No analytics. There is no Google Analytics, no Hostinger analytics, no Plausible, nothing counting your visit.
No advertising or tracking pixels. No Meta pixel, no Google Ads tag, no retargeting.
No social media embeds. The Instagram icons in the footer are ordinary links. Nothing from Instagram loads on this site or watches you here.
No profiling and no automated decision-making.
Technical information from hosting
This site is hosted by Hostinger. Like any web host, their servers keep a short technical log: your IP address, browser type, which page was requested, and when, so the site can be served to you and kept secure against abuse. I don't have access to these logs for marketing purposes, and I don't use them to identify individual visitors.
3. Why I use your data, and the legal grounds
Name, email and project description from a form: to read and reply to your enquiry and discuss a possible booking. Legal basis: steps taken at your request before entering a contract (GDPR Art. 6(1)(b)).
Contact and project details: to carry out the work you've hired me for. Legal basis: performance of a contract (Art. 6(1)(b)).
Invoices and payment records: required by Dutch tax law. Legal basis: legal obligation (Art. 6(1)(c)).
Server logs: to keep the site running and secure. Legal basis: legitimate interest (Art. 6(1)(f)).
Photographs of identifiable people: see section 4. Legal basis: consent, or legitimate interest (Art. 6(1)(a) / 6(1)(f)).
4. Photographs of people
Photography is part of what I do, so this section matters more here than on most websites.
At events. When I photograph a live show, comedy night, or festival, people in the room may be identifiable in those images. Photographs of identifiable people are personal data, and in the Netherlands, you also have rights over your own likeness under portrait rights (portretrecht, Article 21 of the Dutch Copyright Act).
How I handle it:
Performers and clients: use of their images for my portfolio, this website, and social media is agreed in advance, either in the booking agreement or directly with them.
Audience members: where an event is photographed, the organiser should make this clear to attendees. If you'd rather not be photographed at an event I'm shooting, tell a staff member or me on the night, and I'll respect it.
Commissioned portrait and studio work: the images belong to that commission. I don't publish them in my portfolio or on social media without the subject's agreement.
If you want a photograph of you taken down, email info@roxyjc.nl with enough detail to find it (which event, roughly when, and where you saw it published). I'll remove it from this website and my own social channels. I'll tell you honestly if a copy exists somewhere I don't control, a client's site, a venue's page, so you know who else to ask.
5. Who else can see your data
I don't sell, rent, or trade your data. Ever. A small number of service providers process it on my behalf, under contract, and only to do the job I've hired them for:
Hostinger (Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus) — hosts this website and handles form submissions. They act as my processor under a data processing agreement and use their own sub-processors, including Amazon Web Services, Google Cloud, and Cloudflare.
Google Workspace: where your message lands once it reaches me.
I'll also disclose data where the law genuinely requires it — a court order, a tax authority request.
Transfers outside the EEA. My providers are EU-based, but some of their sub-processors operate internationally. Where data leaves the European Economic Area, those transfers are covered by the European Commission's Standard Contractual Clauses.
6. How long I keep it
Enquiries that don't lead to work: deleted after 12 months is a sensible default.
Customer project files and correspondence: kept for the duration of the project and for 2 years afterwards, in case you need the work again.
Invoices and financial records: 7 years, as required by Dutch tax law.
Photographs: kept in my archive indefinitely unless you ask me to remove yours. Published images can be removed upon request, as described in section 4.
Server logs: kept only as long as my host retains them.
7. Your rights
Under the GDPR you can ask me to:
See what personal data I hold about you, and get a copy of it
Correct anything that's wrong or incomplete
Delete it, where I don't have a legal reason to keep it
Restrict how I use it while a question about it is being sorted out
Object to processing I've based on legitimate interest — including publication of a photograph of you
Withdraw consent at any time, where consent is what I relied on
Receive it in a portable format you can take elsewhere
Email info@roxyjc.nl and I'll respond within one month. It's free, and I won't ask you to justify the request. I may ask you to confirm who you are first, so I don't hand your data to someone else.
8. If you're not happy with how I've handled it
Tell me first, most things are a misunderstanding I can fix quickly.
You also have the right to complain to the Dutch data protection authority:
Autoriteit Persoonsgegevens
PO Box 93374, 2509 AJ The Hague
Telephone: +31 (0)88 1805 250
autoriteitpersoonsgegevens.nl
9. Links to other sites
This site links out to Instagram and may link to venues, clients, or event pages. Once you follow one of those links, you're on someone else's site, under their privacy policy, not this one. I have no control over what they collect.
10. Children
This site isn't aimed at children, and I don't knowingly collect data from anyone under 16 through it. If you believe a child has sent me personal information through a form, email me, and I'll delete it.
11. Changes to this policy
If I change how data is handled here, I'll update this page and change the date at the top. If a change is significant — new analytics, a new processor, a different purpose- I'll say so on the page rather than quietly editing it.
12. Contact
Questions about this policy, or about your data: info@roxyjc.nl