Legal
Privacy Policy
Last updated: June 2026
1. Who we are
Leiden SCA (Leiden Student Creative Agency) is the data controller for all personal data processed through our website and platform.
You can contact us regarding data protection matters at: [email protected]
2. What data we collect and why
Contact form submissions
Name and email address, submitted voluntarily. Used solely to respond to your enquiry. Legal basis: legitimate interests (responding to an inbound request).
Image removal requests
Email address and image description. Used to process your GDPR/AVG erasure request. Legal basis: legal obligation (Article 17 GDPR).
Platform usage (portal, Phase 2+)
Account credentials, uploaded files, and project metadata, when the creative/client portal is operational. Governed by separate terms presented at registration.
Website analytics
We use Plausible Analytics, a privacy-first, cookieless analytics tool hosted in the EU. No personal data or device fingerprints are collected. No consent is required.
3. Where your data is stored
Different parts of the service use different infrastructure:
- —Creative files (the photos, videos, and design assets we deliver to clients) are stored in Cloudflare R2 under EU jurisdiction. These files never leave European infrastructure.
- —Transactional email (notifications and form confirmations) is handled by Resend (EU data residency).
- —The website itself is currently hosted on servers in the United States.
4. How long we keep your data
- —Contact form submissions: deleted within 90 days once the enquiry is resolved.
- —Image removal requests: retained for 3 years as part of our GDPR compliance record, then deleted.
- —Platform accounts: retained for the duration of the account and deleted within 30 days of a deletion request.
5. Your rights
Under the GDPR/AVG, you have the right to:
- —Access — request a copy of the personal data we hold about you
- —Rectification — correct inaccurate data
- —Erasure — request deletion of your data (right to be forgotten)
- —Restriction — limit how we use your data in certain circumstances
- —Objection — object to processing based on legitimate interests
- —Portability — receive your data in a machine-readable format
To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
6. Cookies
We do not use tracking or advertising cookies. See our Cookie Policy for full details.
7. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be noted at the top of this page with an updated date. Continued use of our platform after a change constitutes acceptance of the revised policy.