Privacy policy

Last updated: 22 June 2026

van Rossum Sculptures respects the privacy of its customers and the people represented in its sculptures. This policy explains what information is collected, why it is needed and how long it is retained.

1. Contact details

van Rossum Sculptures is responsible for the processing described in this policy.

van Rossum Sculptures
Email: 
KVK: 
VAT ID: 

The registered visiting address is shielded in the Dutch Business Register.

Privacy questions can be submitted by email or through the website contact form.

2. Information collected

Depending on how the website and service are used, the following information may be collected:

  • Name and email address

  • Billing and delivery details

  • Messages, comments and requested refinements

  • Submitted iCloud links

  • Videos and photographs of the person being portrayed

  • Earlier reference photographs

  • Digital 3D models and files created during the process

  • Order, payment and shipping information

  • Basic website data, including IP address, browser, device and website usage

Full payment-card details are processed by the payment provider and are not stored by van Rossum Sculptures.

3. Images of another person

A customer may submit videos or photographs of another person.

By submitting this material, the customer confirms that the person shown has been informed and has given permission for their images to be used to create the sculpture.

For anyone under 18, permission must be provided by a parent or legal guardian.

Where the person is deceased, the customer confirms that they are entitled to provide the submitted material.

4. How information is used

Information is used to:

  • Review whether the submitted video is suitable

  • Communicate about the request and order

  • Create and refine the digital 3D model

  • Create the portrait bust

  • Process payment

  • Arrange delivery

  • Create additional copies when requested

  • Answer questions and provide customer support

  • Meet accounting, tax and legal obligations

  • Protect and operate the website

Customer contact details are never used for newsletters, advertising or promotional messages.

Videos, photographs, digital models and finished sculptures are never published or used for promotion without separate, explicit permission.

No automated decisions are made about customers or the people portrayed.

5. Legal grounds

Information is processed where necessary:

  • To respond to a request before an order is placed

  • To fulfil the commissioned order

  • To comply with accounting, tax and legal obligations

  • For necessary administration, security and customer support

  • With permission where another person’s images are submitted or publication is separately requested

Permission to create a sculpture is separate from permission to publish images of the person, digital model or finished sculpture.

6. Videos, photographs and digital models

Videos are submitted through an iCloud link so that the original quality is preserved.

Submitted portrait material:

  • Is used only to assess and create the sculpture

  • Is never sold

  • Is never published without permission

  • Is not provided to payment or shipping companies

  • Is not shared with unrelated third parties

  • May be supplied to the customer on request, where technically available

The files may pass through technical services required for transmission, email, secure storage or website operation. These providers may process the information only as needed to provide their service.

7. Retention periods

Personal information is not retained longer than necessary.

  • If a request does not become an order, submitted videos, photographs and digital files are deleted within 90 days after the request is closed.

  • For completed commissions, submitted videos, photographs and the editable digital 3D model are deleted within 90 days after delivery.

  • Final cutting or fabrication files may be retained securely so that additional copies can be made later.

  • These final files are used only to reproduce the original commission and are never reused for another customer.

  • The customer may request deletion of the retained fabrication files. Further copies may then no longer be possible.

  • General order correspondence may be retained for up to two years after delivery.

  • Invoices, payment records and legally required business administration are retained for seven years.

8. Service providers

Limited information may be processed by providers needed to operate the service, including:

  • Shopify, for website hosting and the contact form

  • Apple/iCloud, through which video links are provided

  • Email and secure-storage providers

  • Payment providers

  • Convelio or another delivery provider

Only the information required for each service is provided.

Shipping providers receive the delivery information needed to transport the sculpture. Payment providers receive the information needed to process payment. They do not receive portrait videos, photographs or digital models.

Some providers may process information outside the European Economic Area. Where required, recognised legal safeguards are used.

9. Shopify

The website is hosted by Shopify. Shopify processes certain information relating to website visits, devices, transactions and use of the website to provide, operate and secure its services.

Shopify may process information in countries outside the country where the visitor lives. Shopify is responsible for processing carried out for its own independent purposes.

10. Cookies

The website uses cookies needed for security and normal operation.

Limited website analytics may be used to understand whether the website functions correctly and how it is used. Where consent is legally required, these cookies are activated only after permission has been given.

Cookie preferences can be managed through the website’s privacy or cookie settings.

11. Security

Reasonable technical and organisational measures are used to protect personal information.

No online transmission or storage system can be guaranteed to be completely secure. Customers should not publish their iCloud link publicly and should submit it only through the designated contact form.

12. Your rights

Depending on applicable law, you may have the right to:

  • Access your personal information

  • Correct inaccurate information

  • Request deletion

  • Restrict or object to certain processing

  • Receive certain information in a portable format

  • Withdraw previously given permission

Some financial and administrative records must still be retained where required by law.

Requests can be sent to tbd. Identity may need to be verified before a request is completed.

13. Complaints

Questions or complaints can be sent to:

tbd

A complaint may also be submitted to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

14. Changes to this policy

This policy may be updated when the service, technology or legal requirements change. The latest version and revision date will be published on this website.