Privacy notice
Karl Emerick Hanuska Photography · Last updated 12 October 2026
Who is responsible
Karl Emerick Hanuska, based in Amsterdam, is responsible for the personal data processed through karlhanuska.photography and his commercial photography work. For questions about this notice or your privacy rights, use the enquiry form.
Postal address: Ton de Leeuwstraat 8, 1011 DE Amsterdam, Netherlands.
Enquiries and assignments
When you contact me, I receive the information you provide, such as your name, email, organisation, assignment type, timing, location and message. Team size and intended use may also be requested. Required fields let me respond meaningfully; other details are optional. Please avoid including sensitive information about yourself or other people unless it is necessary for the assignment.
I use this information to answer you, prepare a quotation and arrange or carry out an assignment. Where you are the prospective client, this processing is necessary to take steps at your request before a contract or to perform it. For enquiries from staff, representatives and other contacts, my legitimate interest is communicating about and delivering professional photography services. Sending an enquiry does not subscribe you to marketing.
For confirmed assignments I also process the billing and payment information needed to administer the contract and keep the records required by tax law. A commissioning organisation may supply the names, work contact details or photography brief for people taking part.
Photographs and client galleries
Photographs, names, selection notes and delivery records are processed to plan, photograph, edit and deliver the agreed work. A client account may contain your contact details and access permissions. Private galleries are intended for authorised recipients; please keep login details private.
The basis for photographing and publishing identifiable people depends on the assignment and my role. It may be performance of a contract with the person concerned, consent, or a legitimate interest assessed against that person’s rights. A client’s contract does not automatically authorise every use of someone else’s portrait. The intended audience, publication channels and any permission requirements should be agreed for the assignment. If I act solely on an organisation’s documented instructions, the organisation may be the controller for that processing.
Consent-based uses can be stopped for the future by withdrawing consent. Please contact me about any photograph involving you, particularly if there is a safety concern. A request will be assessed in light of privacy rights, the applicable lawful basis and any relevant freedom-of-expression or legal obligations.
Website operation and cookies
The website and hosting systems process technical information needed to serve and secure the site, such as IP addresses, requested pages, timestamps and browser details. My legitimate interests are providing a reliable website, preventing abuse and protecting client access. Cookies may be needed for login, security and remembering cookie choices. Optional tracking requires a valid choice before it is used; a privacy notice by itself does not provide that consent. You can accept, reject or customise optional cookies using the cookie controls, and change your choice later through the cookie preferences icon. The consent setting is configured to expire after 365 days. You can also delete or block cookies in your browser; blocking essential login cookies may prevent access to a client account.
Service providers and international processing
Relevant information may be handled by providers of website hosting, email, secure storage, client delivery, bookkeeping and professional support, only as needed for their role. Information may also be disclosed where the law requires it or where necessary to establish or defend a legal claim.
The tools used in my business include Apple iCloud, Adobe Lightroom and Photoshop, ChatGPT from OpenAI, and WordPress hosted by Namecheap. Apple provides the iCloud services associated with my contact email; Adobe tools support photographic work; WordPress and Namecheap support the website and its client facilities. Cloud processing depends on the features used and the information supplied. Using one tool does not mean that every client’s information is sent to every provider.
These providers may process information outside the European Economic Area, including in the United States. Their published safeguards include European Commission standard contractual clauses and, where applicable, recognised adequacy arrangements. Details and ways to request copies of the relevant safeguards are in the Apple privacy policy, Adobe privacy policy, OpenAI EU privacy policy and Namecheap data processing addendum. You can also contact me about a transfer involving your information.
AI and cloud features have their own account settings and terms. This notice does not promise that all providers store information only in Europe or that every account excludes use for model improvement. Contact me before sharing material that requires particular confidentiality or processing arrangements so these can be agreed for the assignment.
How long information is kept
My retention policy is set out below. A specific agreement, an active dispute or a legal duty may justify a different period. I review the need for continued retention rather than keeping information indefinitely.
| Information | Retention policy |
|---|---|
| Enquiries that do not become assignments | Delete 12 months after the last meaningful contact, unless an active dispute or legal requirement justifies longer. |
| Client access and online galleries | Normally remove access 12 months after final delivery, or at the agreed expiry date. Tell the client the expiry date in advance. |
| Unselected working photographs | Review and delete unnecessary rejected files 90 days after final approval, subject to agreed delivery obligations. |
| Selected photographs and necessary project records | Review after five years. Keep longer only for an identified continuing purpose, such as an agreed archive, active image licence or legal claim, and review that purpose regularly. |
| Invoices and tax records | Retain the legally required records for the applicable statutory period, normally seven years for Dutch basic business administration. Some records require longer; the starting point follows tax rules. |
| Security logs and backups | Retain for the period needed to investigate security events, maintain service continuity or restore data, taking account of the provider’s deletion cycle and legal obligations. My targets are 30 days for routine security logs and 90 days for rolling backups; these are targets, not a guarantee that every provider uses those settings. |
Your choices and rights
You may ask to access or correct your personal data, or request deletion or restricted processing where the conditions apply. You may object to processing based on legitimate interests and, in applicable cases, request a portable copy of data. You may withdraw consent at any time without affecting processing that was lawful before withdrawal. Some data may need to be retained to meet legal duties or handle claims.
Use the enquiry form linked above or write to the postal address above, and describe your request. I may ask for proportionate information to verify your identity; please do not send a full identity document unsolicited. I will normally respond within one month. If a lawful extension is needed, I will explain the reason within that month.
You can complain to the Autoriteit Persoonsgegevens, or another competent data protection authority. Contacting me first is welcome but is not a condition for making a complaint.
Other information and updates
I do not sell client contact information or use it to make solely automated decisions that have legal or similarly significant effects on you. Photographic and assignment decisions involve human review.
This notice covers the commercial photography website and related services. Another website or external service may have its own notice. Material changes will be reflected here with an updated date; where required, affected people will be told directly.