Tom Loki, registered in the Netherlands under KvK 51427788, is responsible for the personal data described in this notice. Questions or requests concerning personal data can be sent to studio@tomloki.com.

Contact and sitter applications

When you contact the studio or submit a sitter application through Tally, Tom Loki may process information provided by you. This may include your name, email address, the content of your message, age or confirmation that you are over 18, phone number, social-media handles, availability and subsequent communications. It may also include photographs or other material uploaded or otherwise supplied with an application. Age information may be requested to confirm eligibility to participate. This information is used to respond to inquiries, assess applications, arrange and facilitate photographic sessions, and manage related communication and agreements. Tom Loki does not use automated decision-making or profiling to assess applications. Specific arrangements concerning photographs created during a session, including their use, publication or exhibition, are set out in the separate agreement or release made with the sitter or model. If you contact the studio through Instagram, X or another external platform, that platform also processes the communication in accordance with its own privacy policy.

Artwork inquiries and sales

When you inquire about or acquire a work, Tom Loki may process information including your name, email address, correspondence, billing or delivery details, order information and payment status. This information is used to answer the inquiry, administer the transaction, deliver the work and meet applicable legal and accounting obligations. Where a physical work is purchased, information necessary to fulfil the order may be shared with relevant payment, printing or shipping providers.

Legal bases

Tom Loki generally processes personal data on the basis of his legitimate interests in operating the studio, responding to inquiries, assessing sitter applications, arranging photographic sessions, maintaining professional correspondence, and creating, administering and protecting the artistic work and archive. Where processing is necessary to take steps requested by you before entering into, or to perform, a session agreement or artwork sale, the legal basis is the performance of a contract. Data required for invoicing, tax and accounting purposes is processed to comply with legal obligations. The processing of photographs for artistic purposes also takes place within the legal framework protecting freedom of expression and artistic expression.

Providing information

You are free not to provide personal data. However, some information is necessary to assess an application, respond to an inquiry, enter into or perform an agreement, complete a transaction, or meet legal requirements. If required information is not provided, Tom Loki may be unable to proceed.

Website and cookies

This website is hosted by Squarespace. When you visit the website, Squarespace may process technical information such as your browser, device, network, pages viewed, referring page and IP address to operate and secure the website. The site uses only necessary cookies and similar technologies required for basic functionality. Non-essential analytics and marketing cookies are restricted.

Service providers

Contact, application and customer data is not sold. It may be shared with service providers where necessary to operate the website, receive applications, communicate with you, administer transactions and fulfil orders, including Squarespace, Tally and relevant email, storage, payment, printing and shipping providers. It may also be disclosed where required by law or necessary to establish, exercise or defend legal claims. These service providers process personal data in accordance with their respective roles and privacy notices. Some service providers or their subprocessors may process data outside the European Economic Area. Where required, such transfers are made on the basis of an applicable adequacy decision, standard contractual clauses or another recognised legal safeguard. Further information is available through the privacy notices of the relevant providers or on request via studio@tomloki.com.

Payments

Payments made through website checkout, a Squarespace invoice or a private Squarespace Pay Link are processed through Squarespace and its payment service providers. Relevant customer, order, invoice and payment information may be processed as necessary to complete, secure and administer the transaction.

Retention

General inquiries, collector correspondence and sitter applications—including photographs supplied with an application—may be retained for up to 24 months after the last contact where they do not result in a continuing agreement, photographic session or transaction. This allows the studio to maintain continuity in correspondence and, where relevant, to consider applicants for future series. Data may be deleted sooner on request unless retention remains necessary for another lawful reason. Where contact leads to an agreement, session or transaction, relevant correspondence, agreements and related records may be retained for as long as necessary to perform and administer the agreement, comply with legal obligations, protect contractual or legal rights, or maintain the resulting work as part of the artistic practice or archive. Invoices, payment records and other legally required financial administration are retained for the applicable statutory period.

Your rights

You may request:

• access to your personal data;

• correction of inaccurate or incomplete data;

• deletion of data where it is no longer required;

• restriction of processing;

• transfer of data where the right to data portability applies;

• or object to processing based on legitimate interests.

Requests can be sent to studio@tomloki.com. Certain rights may be limited where and to the extent permitted by law, including where personal data must be retained to comply with legal obligations, administer or enforce agreements, protect overriding legitimate interests or the rights and freedoms of others, establish, exercise or defend legal claims, or where the processing of photographs and records integral to the artistic work or archive is necessary for freedom of expression and artistic expression. You also have the right to submit a complaint to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Last updated: August 2026