Last updated 31 August 2026.

Who we are

This website is operated by XPR Visual, the photography practice of James Djordjevic.

Trading name: James Djordjevic / XPR Visual
Chamber of Commerce (KvK): 76131408
VAT (BTW-ID): NL003045706B46
Address: Amsterdam, The Netherlands
Email: james@jamesdjordjevic.com
Website: www.jamesdjordjevic.com

XPR Visual is the “controller” for the personal data described in this policy — meaning we decide why and how it is processed.

What this policy covers

This policy explains what personal data we collect through this website and in the course of our photography work, why we use it, how long we keep it, who we share it with, and the rights you have under the General Data Protection Regulation (GDPR / AVG). Details of the individual cookies are in our Cookie Policy.

The personal data we collect

Information you send us

When you use the contact / booking form, we collect the name, email address, city or location and message you provide. We use this only to read and respond to your enquiry.

Technical data

Our hosting provider automatically records standard server logs — such as IP address, browser type and the date and time of each request — for security and to keep the site running. These logs are kept for a short period and are not used to identify or profile visitors.

Photographs

In our photography work we take portrait and other photographs that may show identifiable people (clients, models and other participants in a session). How those images may be used is described under “Photography, portfolio and model releases” below.

Analytics and cookies

With your consent, we use Google Analytics 4 to understand how the site is used — for example how many people visit, which pages they look at, and where they arrive from. Google Analytics sets cookies and processes data such as a randomised identifier, IP address (shortened by Google), pages viewed and approximate location. We have IP-anonymisation enabled and do not use Google Analytics for advertising.

Analytics only runs after you accept it in the cookie banner. If you decline, or before you make a choice, no analytics cookies are set and no analytics data is sent. You can change or withdraw your choice at any time via the Cookie Policy page.

We also use Google Search Console to see how the site performs in Google Search. Search Console does not set cookies on your device and works from Google’s own crawl data.

Aside from the analytics cookies above, this site only sets a small number of strictly necessary cookies (for example to remember your cookie choice, or if you log in to the dashboard). It does not use advertising or social-media tracking cookies, and it does not embed third-party content that tracks you. The full list is in the Cookie Policy.

Why we use your data, and our legal basis

Responding to enquiries and preparing a possible booking — legal basis: taking steps at your request before entering into a contract, and our legitimate interest in answering people who contact us (Art. 6(1)(b) and (f) GDPR).
Providing photography services you have booked — legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Keeping the website secure and available — legal basis: our legitimate interest in protecting the site (Art. 6(1)(f) GDPR).
Website analytics (Google Analytics) — legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time.
Showing photographs in our portfolio and marketing — legal basis: your consent, and/or a separate model / usage agreement (Art. 6(1)(a) and (b) GDPR).
Meeting legal and tax obligations — legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

How long we keep it

Contact / booking enquiries: kept for up to 12 months if they do not lead to work; if they do, they are kept with the project file.
Client and project records, invoices: kept for 7 years, as Dutch tax law requires.
Server logs: kept for up to 30 days by our hosting provider.
Google Analytics data: user- and event-level data is retained by Google for up to 14 months (the period is configurable in the analytics property); aggregate reports are kept for as long as we use analytics.
Photographs used in the portfolio: kept for as long as they are in use, unless you withdraw permission (see below).

Who we share it with

We do not sell your personal data and we do not share it for advertising. We use a small number of service providers (“processors”) who handle data on our behalf under a data-processing agreement:

Website hosting: Mijndomein (mijndomein.nl), which stores the site and its server logs.
Email: Mijndomein (mijndomein.nl), used to send and receive messages from the contact form.
Google (Google Ireland Ltd.) — for Google Analytics and Google Search Console, only where analytics is used with your consent.
Professional advisers such as our accountant, where necessary for invoicing and tax.

We may also disclose data if we are legally required to do so, or to establish or defend legal claims.

Where your data is stored

Our website and email are hosted in the Netherlands. Google Analytics data may be transferred to and processed on servers operated by Google in the United States; for those transfers Google relies on the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses. If any other provider processes data outside the European Economic Area, we ensure an appropriate safeguard is in place.

Photography, portfolio and model releases

Photographs from a session may be used on this website, in our portfolio, on social media and in other promotional material. Where an image shows an identifiable person, we rely on that person’s consent and/or a written model or usage agreement, which sets out what is permitted.

You can ask us at any time to stop using a photograph of you in our own marketing. We will do so for future use, and remove it from material we control within a reasonable time. Images already printed, published by third parties, or held as part of a legal or contractual record may not always be retrievable.

Your rights

Under the GDPR you have the right to:

ask what personal data we hold about you and get a copy (access);
have inaccurate data corrected (rectification);
ask us to delete your data (erasure), where no overriding obligation or interest applies;
ask us to restrict processing, or object to it;
receive certain data in a portable format;
withdraw consent at any time, where we rely on consent (including for analytics) — without affecting processing already carried out.

To exercise any of these rights, email us at james@jamesdjordjevic.com. We will respond within one month. We may ask you to confirm your identity first.

If you are not satisfied with how we handle your data, you have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Security

The site is served over an encrypted connection (HTTPS). Access to enquiries and client files is limited to people who need it, and protected by strong passwords and, where available, two-factor authentication. No system is completely secure, but we take reasonable measures to protect your data.

Children

This website is not directed at children. Where we photograph a minor, we obtain consent from a parent or legal guardian.

Links to other websites

Our site may link to external sites such as Instagram. We are not responsible for the privacy practices of those sites; please read their own policies.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Significant changes will be highlighted on this page.

Contact

Questions about this policy or your personal data: XPR Visual, Amsterdam, The Netherlands, james@jamesdjordjevic.com.