Effective date: 26 August 2026 | Last updated: 26 August 2026
1. Who we are
Picturae B.V. (“we”, “us”, “our”), registered at J. Duikerweg 14, 1703 DH Heerhugowaard, the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 37124060, is the data controller responsible for the personal data processed through picturae.com (the “Website”).
If you have any questions about this Privacy Policy or how we handle your personal data, you can contact us at privacy@picturae.com.
Data Protection Officer: we have not formally appointed one. Under GDPR Article 37, a DPO is only mandatory for public authorities, or organisations whose core activities involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special category data — this does not currently apply to Picturae, and we review this assessment periodically as our services evolve.
2. What personal data we collect
Depending on how you interact with the Website, we may collect the following categories of personal data:
- Contact details you provide, such as your name, email address, phone number, and organisation, when you fill in a contact form, request information, or subscribe to a newsletter.
- Technical and usage data, such as your IP address, browser type, device information, pages visited, and referring website, collected automatically through cookies and similar technologies (see our Cookie Policy).
- Communications, such as the content of emails or messages you send us, and records of correspondence.
- Any other information you choose to provide, for example through a job application or vacancy response, or details submitted as part of a client project enquiry.
3. Why we process your data and our legal basis
We process personal data for the following purposes, on the legal bases indicated:
| Purpose | Examples | Legal basis (GDPR Art. 6) |
|---|---|---|
| To respond to enquiries | Answering contact form submissions, quote requests | Legitimate interest / pre-contractual steps (Art. 6(1)(b)/(f)) |
| To provide our services | Delivering contracted digitisation/data services to clients | Performance of a contract (Art. 6(1)(b)) |
| To operate and improve the Website | Analytics, security, troubleshooting | Legitimate interest (Art. 6(1)(f)), or consent for non-essential cookies (Art. 6(1)(a)) |
| To send marketing communications | Newsletters, event invitations | Consent (Art. 6(1)(a)), withdrawable at any time |
| To comply with legal obligations | Tax, accounting, regulatory record-keeping | Legal obligation (Art. 6(1)(c)) |
4. Cookies and similar technologies
The Website uses cookies and similar technologies, some of which require your consent under the Dutch Telecommunicatiewet (art. 11.7a) and the GDPR. When you first visit the Website, a cookie consent banner lets you accept or manage these preferences. For full details on the specific cookies used, their purpose, and retention period, see our separate Cookie Policy.
5. Who we share your data with
We do not sell your personal data. We may share personal data with:
- Google, via Google Tag Manager and Google Analytics, for website analytics.
- Service providers and processors who support our operations, such as our hosting provider, and any email or CRM platforms we use. Each processor is bound by a data processing agreement.
- Professional advisers, such as accountants or legal counsel, where necessary.
- Authorities, where required by law or to protect our rights.
6. International data transfers
Google processes analytics data outside the European Economic Area (EEA), including in the United States. Google self-certifies under the EU-U.S. Data Privacy Framework and/or relies on the European Commission’s Standard Contractual Clauses (SCCs) for such transfers. Where any other processor we work with transfers data outside the EEA, we ensure appropriate safeguards are in place.
7. How long we keep your data
We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law. Dutch tax law, for example, requires certain financial and administrative records to be kept for 7 years.
8. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data (“right to be forgotten”), where applicable
- Restrict or object to certain processing
- Data portability, where processing is based on consent or contract and carried out by automated means
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, contact us at privacy@picturae.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl), or the supervisory authority in your own EU member state.
9. Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including an encrypted (HTTPS/TLS) connection, access controls, and confidentiality obligations for our staff.
10. Children’s privacy
The Website is not directed at children under 16, and we do not knowingly collect personal data from children.
11. Changes to this policy
We may update this Privacy Policy from time to time. The “last updated” date at the top of this page indicates when it was last revised. We encourage you to review this page periodically.
12. Contact us
Questions, requests, or concerns about this policy or how we handle your data can be sent to privacy@picturae.com or by post to Picturae B.V., J. Duikerweg 14, 1703 DH Heerhugowaard, the Netherlands.