Red Management / Privacy statement
Privacy statement
Draft for review by our legal adviser. Not yet finalised.
Let’s talk ↗Explore the possibilities ↓
Draft for legal review, 30 September 2026
This version has not yet been finalised. The marked points must be completed and checked before publication.
1. Who is responsible
Red Management helps professionals and businesses in the adult industry with web design, online marketing, and creative and business support. For questions about personal data, email info@redmanagement.nl.
Red Management is responsible for the processing described in this statement.
2. Which data we use and why
A question or collaboration idea: your name or work name, email address, subject and the information you send us yourself. We use these to respond and discuss possible next steps. If the enquiry concerns a possible assignment, the legal basis is taking steps at your request before entering into a contract. For other business correspondence, we assess our legitimate interest in handling enquiries, taking your privacy into account.
An assignment: contact and billing details, agreements, feedback and material needed to produce the agreed work. We process these data to perform the contract. If other people’s data are involved, we establish beforehand which legal basis and arrangements are needed.
Administration: information on quotations, contracts and invoices for our business administration and legal obligations.
Website operation and security: technical data, such as IP address, time and information about requests to the server. These may be needed for security and investigating errors. We weigh that interest against the consequences for visitors.
Fields needed to answer an enquiry are marked as required. Without a reachable email address, we cannot reply by email. A work name is sufficient for initial contact; a contract or invoice may require additional information.
3. Photographs, videos and sensitive information
Images and information about work can be particularly sensitive. Do not send identity documents, passwords or intimate images in an initial contact message. We agree on an appropriate method for supplying project material.
Where material reveals data about someone’s sex life, sexual orientation or other special categories of personal data, an applicable exception to the prohibition on processing is needed in addition to an ordinary legal basis for processing. An assignment alone is not sufficient. Before processing, we record whether and on what basis the material may be used. If explicit consent is needed, we request it separately for a clearly defined purpose.
Consent to carry out an assignment does not automatically include consent to use material in our own portfolio or on social media. We agree on this separately with the relevant rights holders and people depicted. You can withdraw consent. This does not affect the lawfulness of earlier use based on valid consent; we assess which further processing must stop and what deletion is possible.
4. Who receives data
We share data only where necessary for an agreed purpose, a legal obligation or another valid legal basis. This may involve hosting, email, administration or a specialist contributing to an assignment. Where a party processes personal data on our behalf, appropriate data processing arrangements are needed. A service provider acting as an independent controller also has its own obligations.
Still to be established: the final list of service providers and their roles. The preview is hosted by Hostinger and the domain email points to Microsoft 365. Google Analytics is used only after consent and is described in section 6. Form delivery is still being adjusted. Cloudflare is planned but may only be described as an active service once its setup has been confirmed. Any project storage, bookkeeping services and participating creators must also be included.
Still to be checked: the countries in which data are processed, any transfers outside the European Economic Area and the applicable safeguards. If transfers take place, we will state the relevant adequacy decisions or other safeguards and how you can obtain information about them. We do not currently promise that all data remain exclusively in the Netherlands or Europe.
5. Retention periods
We do not retain data longer than needed for the purpose for which they were received, unless a statutory retention obligation or a specific legal claim makes longer retention necessary.
Basic tax administration is generally subject to a seven-year retention period; other statutory periods may apply to certain data.
To be established: specific periods for enquiries that do not lead to an assignment, project correspondence, original photograph and video files, selections and backups. The periods must match the actual storage and deletion options.
To be established: retention periods for server and security logs in the final hosting, form and Cloudflare setup.
A statutory obligation to retain invoices does not mean that all photographs, messages and other project files must be kept for the same length of time.
6. Cookies, statistics and external content
The current preview uses a technical session cookie with the form to secure the request. The final form solution and the associated cookie lifetime still need to be checked.
Statistics with Google Analytics. Only if you allow statistics in the cookie notice do we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This shows us which pages are viewed, how visitors reach us and whether the contact form or email button is used. We load Google Analytics through Google Tag Manager, also from Google. Tag Manager does not itself set cookies. The contents of messages you send through the form are not sent to Google. The legal basis is your consent. You can withdraw it at any time through Cookie settings at the bottom of every page; we then also remove this website’s Google Analytics cookies from your browser.
After consent, Google Analytics sets the cookies _ga and _ga_ followed by a code. Both distinguish visits and have a retention period of no more than 14 months. Google Analytics 4 does not store IP addresses. Advertising features and Google signals are disabled, there is no link with advertising accounts, and visits from our own office are filtered out. Visitor-level data are automatically deleted after 14 months. Google processes the data for us as a processor under the Google Analytics data processing terms. Google may also process data in the United States; Google LLC is certified under the EU-US Data Privacy Framework. Further information is available in Google’s explanation of how it uses data from websites using Google services.
Without consent, Google Analytics does not set cookies. Through Google Consent Mode, Google then receives only a limited signal without cookies, for example that a page has been viewed, so total visits can be estimated without recognising you. Advertising storage is always disabled. We keep your cookie choice in your browser for no more than 180 days under red-cookie-choice-v1; these data are not sent to us.
An external virtual tour is loaded only when you click its button. The provider may then receive technical data and use cookies. Before launch, the provider, purpose and any consent requirements must be checked. Clicking a button does not in itself replace legally valid consent where that is required.
7. Security and roles in client projects
We adapt organisational and technical measures to the nature and sensitivity of the data. These include restricted access, secure transfer and arrangements for storage and deletion. Absolute security cannot be guaranteed. Report suspected misuse or a data breach through our email address.
If we manage personal data on behalf of a client, for example through their website, we record the roles and instructions separately. This privacy statement does not replace a data processing agreement or the client’s own privacy statement.
8. Your rights
Depending on the processing, you can request access to, correction, deletion, restriction or portability of your data. You can object to processing based on a legitimate interest and withdraw consent previously given. These rights are not unlimited in every situation, for example where a statutory retention obligation applies.
Email your request to info@redmanagement.nl. In principle, we respond within one month. If a permitted extension is needed, we will explain within that month why and when you will receive an answer. We verify your identity appropriately; do not send a full copy of your identity document on your own initiative.
You can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority. You are of course also welcome to contact us first. The current website does not make decisions with legal effects based solely on automated processing; this must be reassessed when new functionality is introduced.
9. Changes
We update this statement when our services or data processing change. We will show the date at the top of the final version. For important changes, we inform the people concerned where necessary.
Further sources
Google: how Google uses data from sites using its services ↗
Autoriteit Persoonsgegevens: Dutch data protection authority ↗