Legal
Privacy Policy
Last updated: September 2026
1. Who we are
Leiden SCA (Leiden Student Creative Agency) is the data controller for all personal data processed through our website and platform.
You can contact us regarding data protection matters at: [email protected]
2. What data we collect and why
Contact form submissions
Name and email address, submitted voluntarily. Used solely to respond to your enquiry. Legal basis: legitimate interests (responding to an inbound request).
Image removal requests
Email address and image description. Used to process your GDPR/AVG erasure request. Legal basis: legal obligation (Article 17 GDPR).
Platform usage (portal, Phase 2+)
Account credentials, uploaded files, and project metadata, when the creative/client portal is operational. Governed by separate terms presented at registration.
Shared gallery links
Clients can share their photos through a public link. If you open one, we count views and downloads for the person who shared it as anonymous totals only: per day, per file, and per country (from your IP address, which is not kept). To count unique visitors without cookies, your IP address and browser type are combined with a random value that exists only in our server's memory and is discarded every 24 hours. This fingerprint is never written to disk and can't be linked back to you afterwards. Nothing is stored on your device. If your browser sends Global Privacy Control or Do Not Track, we skip this step entirely. Legal basis: legitimate interests (letting the person who shared the photos see whether they reached their audience).
When a client creates a public link, we record that they accepted our responsibility notice, with the time, IP address and browser. We keep this as evidence in case of a dispute about the shared content. Legal basis: legitimate interests (establishing and defending legal claims).
Website analytics
We use Plausible Analytics, a privacy-first, cookieless analytics tool hosted in the EU. No personal data or device fingerprints are collected. No consent is required.
3. Where your data is stored
Different parts of the service use different infrastructure:
- —Creative files (the photos, videos, and design assets we deliver to clients) are stored in Cloudflare R2 under EU jurisdiction. These files never leave European infrastructure.
- —Transactional email (notifications and form confirmations) is handled by Resend (EU data residency).
- —The website itself is currently hosted on servers in the United States.
4. How long we keep your data
- —Contact form submissions: deleted within 90 days once the enquiry is resolved.
- —Image removal requests: retained for 3 years as part of our GDPR compliance record, then deleted.
- —Shared gallery statistics: anonymous totals, kept for as long as the project exists. The in-memory visitor fingerprint is discarded every 24 hours.
- —Platform accounts: retained for the duration of the account and deleted within 30 days of a deletion request.
5. Your rights
Under the GDPR/AVG, you have the right to:
- —Access — request a copy of the personal data we hold about you
- —Rectification — correct inaccurate data
- —Erasure — request deletion of your data (right to be forgotten)
- —Restriction — limit how we use your data in certain circumstances
- —Objection — object to processing based on legitimate interests
- —Portability — receive your data in a machine-readable format
To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
6. Cookies
We do not use tracking or advertising cookies. See our Cookie Policy for full details.
7. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be noted at the top of this page with an updated date. Continued use of our platform after a change constitutes acceptance of the revised policy.