Privacy Statement

1. Who are we?

Siendr is an online marketplace for sports video clips, based in the Netherlands. Siendr acts as the data controller for personal data processed through the platform.

Trade name: Siendr
Address: The Netherlands
Email: louiejaysienders@gmail.com

2. What personal data do we process?

Buyers

• Email address: provided at purchase; used to deliver the download link and look up previous purchases. Providing this is required to perform the contract; without your email address we cannot deliver your download.
• Payment data: processed via Stripe; Siendr does not store card details.
• Technical data: IP address and session data, automatically collected for security and functionality.

Creators (videographers)

• Name and email address: provided at registration. Required for account management; without these no account can be created.
• Business name and VAT number: where applicable; required for correct tax processing.
• Banking details (IBAN): shared with Stripe for payouts via Stripe Connect.
• Upload metadata: title, description, and file information for uploaded clips.

3. Legal basis for processing

• Performance of a contract (Art. 6(1)(b) GDPR): processing purchases, delivering download links, and paying out creators.
• Legal obligation (Art. 6(1)(c) GDPR): retaining financial and tax records for 7 years under Dutch law.
• Legitimate interest (Art. 6(1)(f) GDPR): securing the platform and preventing fraud and abuse. The legitimate interest pursued is: (a) protecting platform integrity, (b) fraud detection and prevention, and (c) securing accounts and transactions. This interest outweighs data subject privacy interests because processing is minimal and limited to what is necessary for security purposes.

4. Retention periods

• Buyer email address: retained for 7 years after the purchase date under Dutch tax retention law.
• Creator account data: retained while the account is active, plus 7 years after closure due to tax retention obligations.
• Creator banking details: retained while the Stripe Connect account is active; upon closure per Stripe's policy.
• Upload metadata: retained while the clip is listed; deleted when a clip is removed.
• Technical log data: retained for a maximum of 90 days.

5. Processors and transfers outside the EEA

We only share personal data with the following processors. We have a data processing agreement (Art. 28 GDPR) with each of them, or they are certified under the EU-US Data Privacy Framework (DPF).

• Stripe (VS): payment processing and Stripe Connect payouts. Transfer to the US under the EU-US DPF. Stripe is DPF-certified.
• Supabase (VS): database and authentication. Transfer to the US under Standard Contractual Clauses (SCCs).
• Resend: transactional email (download links, confirmations).
• Cloudflare R2 (VS): video file storage. EU-region storage where possible. Transfer to the US under the EU-US DPF.
• Vercel (VS): website hosting platform. Transfer to the US under SCCs.

We never sell your data to third parties.

6. Cookies

Siendr only uses functional cookies required for login, session management (via Supabase Auth), and remembering your language preference. We do not place tracking, analytics, or advertising cookies. No consent is required for these functional cookies.

7. Automated decision-making

Siendr does not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals (Art. 22 GDPR).

8. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR): request what data we hold about you.
• Rectification (Art. 16 GDPR): correct inaccurate data.
• Erasure (Art. 17 GDPR): request deletion, where no legal retention obligation applies.
• Restriction (Art. 18 GDPR): restrict processing in certain circumstances.
• Portability (Art. 20 GDPR): receive your data in a structured format.

To exercise any right, email louiejaysienders@gmail.com with subject"GDPR request". Include your name and email address. We respond within 30 days. We may ask you to verify your identity.

9. Filing a complaint

If you believe we are not processing your personal data correctly, you may file a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
PO Box 93374, 2509 AJ The Hague, Netherlands
www.autoriteitpersoonsgegevens.nl

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS/TLS), role-based access controls, and secure storage through certified processors.

11. Changes

We may update this privacy statement. For material changes we will notify you by email. The current version is at siendr.com/privacy. Questions? louiejaysienders@gmail.com