This notice explains what personal data Tom van Zantvliet collects through this website and in the course of his work, why it is collected, who else receives it, how long it is kept and what rights you have. It is written to meet the UK GDPR and the EU GDPR.
Last updated 5 October 2026
The controller is Tom van Zantvliet, a sole trader working under his own name (“we”, “us”). Addresses: Rogers Estate, Globe Road, London E2 0JZ, United Kingdom, and Tremolietdijk, 4706 TT Roosendaal, Netherlands. Email: hello@tomvanzantvliet.com.
We are not registered for VAT or btw. A Chamber of Commerce (KVK) number will be added here once registration is complete. Requests concerning personal data may be sent to either address or to the email address above.
Contact form. Name, email address, the service selected and the message. Purpose: to respond to the enquiry. Lawful basis: our legitimate interest in responding to people who contact us, and steps taken at your request before entering into a contract. Providing this information is voluntary, but we cannot reply without a name and a return address.
Direct email. The same categories, held in our mailbox with Proton Mail in Switzerland, on the same basis.
Commissions. Name, organisation, postal address, email address, telephone number, the brief, the agreement, invoices and payment records. Lawful basis: performance of the contract, and our legal obligation to keep business records.
Delivery. Photographs and video are delivered through a download link. The link records when it has been used, so that delivery can be confirmed.
Enquiries are kept for twelve months from the last message, or for the duration of the engagement if the enquiry leads to one.
Contract and accounting records are kept for the period the law requires: six years after the end of the relevant tax year in the United Kingdom and seven years in the Netherlands.
Download links remain active for twelve months from delivery. After that the link is withdrawn and the work is retained in our archive, as described in section 4.
Photographs are the core of our work and many of them show identifiable people. Two situations are distinguished in law.
Commissioned work (events, actions, portrait sessions). The client who books the assignment is responsible for informing attendees that photography or filming is taking place and for obtaining any consent that the client’s own use of the images requires. We use the images for the commission and, where the terms of engagement permit, in our portfolio. A portrait commissioned by a private individual is not published without the consent of the person portrayed, in accordance with articles 19 and 20 of the Dutch Auteurswet and section 85 of the UK Copyright, Designs and Patents Act 1988. We apply both rules regardless of where the photograph was taken.
Documentary and editorial work (demonstrations, public events). We photograph on the basis of legitimate interest and for journalistic and artistic purposes, which are recognised in Schedule 2, Part 5 of the UK Data Protection Act 2018 and article 43 of the Dutch UAVG. A person who appears in a photograph on this site may ask for it to be removed by emailing hello@tomvanzantvliet.com. We remove the photograph unless there is a compelling public-interest reason to retain it, in which case we state that reason.
All photographs are taken by us; we do not obtain images of you from third parties. Photographs are retained as an archive without a fixed retention period, as is customary for a photographic archive.
We do not operate a newsletter or mailing list, do not use advertising tracking or profiling, do not sell or share personal data for marketing, and make no automated decisions with legal or similarly significant effects. This site is not directed at children.
The following organisations receive personal data through this site or in the course of our work. Those that process it on our behalf do so under contracts that oblige them to protect it:
Transfers outside the United Kingdom and the European Economic Area are made under adequacy decisions (Switzerland; the UK and the EU in respect of each other) or under standard contractual clauses and the EU–US and UK–US Data Privacy Frameworks.
This site sets no cookies of its own and uses no analytics. The only item stored in your browser is your language preference (EN or NL), held in local storage on your own device and never transmitted.
The pages with Instagram posts load Instagram’s embed, which can set its own cookies (section 5). The YouTube video on the speaking and chairing page loads only when you press play.
You have the right to access the personal data we hold about you and to request its rectification, erasure or restriction, to object to processing based on legitimate interest, and to receive your data in a portable format. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to hello@tomvanzantvliet.com. We respond within one month and do not charge a fee unless the law permits one.
If you believe we have handled your personal data improperly, we ask that you contact us first so that we can resolve the matter. You also have the right to lodge a complaint with the Information Commissioner’s Office in the United Kingdom (ico.org.uk), the Autoriteit Persoonsgegevens in the Netherlands (autoriteitpersoonsgegevens.nl), or the supervisory authority in the EU member state where you live or work.
This notice may be updated from time to time. The date of the current version appears at the top of the page, and the current version is the one published here.