Legal
Privacy Policy
Effective date: 25 October 2026
Last updated: 25 October 2026
1. Controller
Stone Hair Studio
Van IJsendijkstraat 144G
1442 CS Purmerend
The Netherlands
Email: privacy (at) stonehairstudio.nl
Graham Stone is the controller responsible for the processing of personal data through this website.
2. Data Protection Officer
No Data Protection Officer has been appointed. Stone Hair Studio does not meet the criteria under Article 37(1) GDPR that require a mandatory appointment.
3. EU Representative
No EU representative has been appointed. Stone Hair Studio is established in the Netherlands and is therefore directly subject to the GDPR.
4. Personal data we process
Apart from the photos described in section 6, this website processes only the data automatically recorded in server log files:
- IP address
- Browser and operating system (user-agent string)
- Requested URL
- Date and time of the request
Through the website itself we do not collect names, email addresses, phone numbers or other contact details. There are no contact forms on this website.
5. Purpose and legal basis
Server log data is processed for the following purposes: website security, fault detection and resolution, and capacity management.
The legal basis is Article 6(1)(f) GDPR: the legitimate interests of the controller. Those interests are keeping the website secure and stable, preventing misuse and resolving technical issues. We have weighed these interests against the interests and fundamental rights of data subjects, and they are proportionate given the minimal scope of the data processed and the short retention period.
6. Photos on this website
The Showcase on the home page and the Gallery show photos of our work, and some of them show clients. We only publish a photo in which a client can be recognised with that client's explicit consent, and we keep a record of that consent. For a client under 16, we ask a parent or guardian.
- Purpose: showing our work to visitors of this website.
- Legal basis: your consent (Article 6(1)(a) GDPR).
- Withdrawing consent: you can withdraw your consent at any time by emailing privacy (at) stonehairstudio.nl. We will then remove the photo from the website without undue delay. Withdrawing consent does not affect its publication before then.
- Retention: a photo stays on the website until you withdraw your consent or we remove it.
- We publish photos without location or other camera data. They are stored on our hosting provider's servers (Bluehost, see section 9) and can be seen by anyone who visits the website.
7. Privacy by design
This website is built with minimal data processing as a starting point. All fonts and images are hosted on our own server, so no external requests are made when a page loads. No third-party analytics or advertising scripts are loaded. The map on the home page is an image on our own server: clicking it opens Google Maps in a new tab, where Google's privacy policy applies.
8. Cookies and storage
This website does not use cookies, local storage or any other tracking technologies for its visitors. We do not store information on your device or read information from it. The only cookies are on the gallery manager, a page for the studio only: when Graham logs in to manage the Gallery, his device stores a session cookie and a cookie that keeps him logged in for 30 days. Both are strictly necessary for logging in. There is no cookie banner because one is not required.
9. Recipients and processors
We use the following processors, who may have access to server log data and, in Bluehost's case, the photos on the website:
Bluehost Inc. (subsidiary of Newfold Digital, Inc.)
5335 Gate Pkwy, Jacksonville, FL 32256, USA
Email: [email protected]
Role: web hosting and server log processing
Cloudflare, Inc.
101 Townsend St, San Francisco, CA 94107, USA
Role: CDN, DDoS protection, TLS termination and request logging
We do not sell your data to third parties or share it for marketing purposes.
10. International transfers
Both processors are based in the United States. Transfers to Bluehost are made on the basis of the European Commission's Standard Contractual Clauses under Decision 2021/914, incorporated into the Newfold Digital Data Processing Addendum. Transfers to Cloudflare are made on the basis of the EU–U.S. Data Privacy Framework (DPF, certified 1 August 2023), with SCCs Module 2 as an additional safeguard.
11. Retention
Server log files are kept by Bluehost for a limited period and deleted automatically; we do not keep our own archive of them. Cloudflare retains log data in accordance with its own policy. We have not set any additional retention periods beyond the default settings of our processors. Photos stay on the website until consent is withdrawn or we remove them (section 6).
12. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): you may request details of the data we hold about you.
- Right to rectification (Art. 16): you may request correction of inaccurate data.
- Right to erasure (Art. 17): you may request deletion of your data, to the extent technically possible.
- Right to restriction (Art. 18): you may request that processing be temporarily restricted.
- Right to data portability (Art. 20): you may request your data in a structured format.
- Right to object (Art. 21): you may object to processing carried out on the basis of legitimate interests.
- Right to withdraw consent (Art. 7(3)): for a photo of you, see section 6.
Send requests to privacy (at) stonehairstudio.nl. We will respond within one month. Please note that server logs hold only an IP address, with no name or contact details, so we may not be able to tell which log entries are yours.
13. Right to complain
If you believe we are not handling your data correctly, you may lodge a complaint with:
Autoriteit Persoonsgegevens (for EU/EEA visitors)
autoriteitpersoonsgegevens.nl
Information Commissioner's Office (for UK visitors)
ico.org.uk
14. Automated decision-making
We do not engage in automated decision-making or profiling within the meaning of Article 22 GDPR.
15. Children
This website is intended for a general audience. We do not knowingly collect personal data from children under the age of 16. If you believe a child has submitted personal data, please contact us at privacy (at) stonehairstudio.nl.
16. Do Not Track
We do not respond to browser-based Do Not Track (DNT) signals because we do not engage in tracking regardless of the DNT setting you have configured.
17. Governing law
This privacy policy is governed by the laws of the Netherlands. Disputes will be submitted to the competent court in the Netherlands.
18. Changes to this policy
We may update this privacy policy from time to time. Changes will be published on this page with an updated effective date. We recommend checking this policy periodically.
19. Contact
For questions about this privacy policy: privacy (at) stonehairstudio.nl