Privacy Policy
1. Who is responsible
The controller under the GDPR is:
Byunggyu Woo
Genthiner Str. 51, 10785 Berlin, Germany
woo@seoulofberlin.com
2. The short version
This website sets no cookies of its own and uses no analytics, advertising or tracking tools. It has no newsletter and no user accounts. Fonts and images are served from this website’s own host. Third parties only come into play if you press Play on a film, open the booking calendar, send the contact form or follow a link to another service, as explained below. The booking calendar loads from Cal.com only when you press Request a shoot on the contact page (section 8).
3. Hosting and server logs
This website is hosted by Netlify, Inc., San Francisco, USA. When you visit, your browser sends technical data that the host may record in server logs: IP address, date and time, the page or file requested, referring page, and browser and operating system.
This is needed to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is a working, secure website. Netlify processes this data on my behalf under its data processing agreement (Art. 28 GDPR), which forms part of its subscription agreement. The Netlify documents available to me do not state a specific retention period for these logs on my plan. That agreement provides for Netlify to delete customer data after the service ends, in line with its deletion policies. Netlify and its sub-processors may process data outside the European Economic Area, including in the USA. The agreement states that Netlify has certified to the EU-U.S. Data Privacy Framework and that transfers of data from me to Netlify take place on that basis; if the framework does not apply, the EU standard contractual clauses apply to those transfers.
4. Contacting me
If you write to me by email or through the contact form, I process what you send me (usually your name, contact details and message) to answer you and, where relevant, to prepare or carry out our work together. The legal basis is Art. 6(1)(b) GDPR for enquiries about a project, and otherwise Art. 6(1)(f) GDPR; my legitimate interest is replying to the messages I receive.
If you use the contact form, I receive your name, your email address and your message. The form is handled by Netlify Forms, a service of Netlify, Inc. Netlify stores each submission and sends me a copy by email. It filters submissions for spam using Akismet, a service of Automattic, Inc. in the USA, which Netlify engages as a sub-processor. As on any visit, the host may also record the technical data described in section 3. The form has a hidden spam-trap field, and uses no CAPTCHA or tracking.
The legal basis is the same as for other messages, as described above. The data processing agreement and transfer safeguards described in section 3 also apply to the form. I delete submissions from Netlify once they are no longer needed, unless statutory retention duties require me to keep them longer.
Email is handled by Google. Messages may be processed in the USA; Google states that Google LLC is certified under the EU-U.S. Data Privacy Framework. I delete messages once they are no longer needed, unless statutory retention duties, such as tax and commercial record-keeping, require me to keep them longer.
5. YouTube films
Some films are hosted on YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Until you press Play you only see an image stored on this website, and nothing is requested from YouTube.
When you press Play, the player loads from youtube-nocookie.com for that film. Your browser then connects to Google’s servers, which receive at least your IP address and the page you are on. Google may store or read information on your device, such as cookies or local storage, and may link the visit to your Google account if you are logged in. I have no control over this processing. Data may also be transferred to Google LLC in the USA; Google states that Google LLC is certified under the EU-U.S. Data Privacy Framework.
The legal basis is your consent, given by pressing Play (Art. 6(1)(a) GDPR and § 25(1) TDDDG). The consent is not remembered: you decide again each time a film page loads. You can withdraw it for the future at any time by leaving the page and not pressing Play again; to remove anything Google has already stored, clear that data in your browser. More information is in Google’s privacy policy.
6. Vimeo films
Some films are hosted on Vimeo, a service of Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. Until you press Play you only see an image stored on this website, and nothing is requested from Vimeo.
When you press Play, the player loads from player.vimeo.com for that film. Your browser then connects to Vimeo’s servers, which receive at least your IP address and the page you are on. The player is requested with Vimeo’s “do not track” setting. According to Vimeo, the player then sets only the cookies it considers essential to its secure operation, but your browser may still send cookies stored during earlier visits to Vimeo. I have no control over this processing. Data is processed in the USA; Vimeo.com, Inc. is certified under the EU-U.S. Data Privacy Framework.
The legal basis is your consent, given by pressing Play (Art. 6(1)(a) GDPR and § 25(1) TDDDG). The consent is not remembered: you decide again each time a film page loads. You can withdraw it for the future at any time by leaving the page and not pressing Play again; to remove anything Vimeo has already stored, clear that data in your browser. More information is in Vimeo’s privacy policy.
7. Instagram
This website links to my Instagram profile, @seoulofberlin, with an ordinary link. No Instagram content or script is embedded, so nothing is sent to Instagram unless you follow the link. Instagram is then responsible for what happens on its own service, which is operated in the EU by Meta Platforms Ireland Limited. See Instagram’s privacy policy.
8. Booking a shoot
Booking requests are handled by Cal.com, a scheduling service of Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Until you press Request a shoot on the contact page, nothing is requested from Cal.com.
When you press it, the booking calendar loads from Cal.com in a window on this page. Your browser then connects to Cal.com’s servers, which receive at least your IP address, browser and device details, and the page you are on. If the window cannot load, the page offers a direct link to the same booking page on cal.com. Opening that link, or pressing the button with JavaScript turned off, opens the booking page in a new tab and connects you to Cal.com in the same way.
When the calendar loads, Cal.com may set a security cookie, __cf_bm, which its provider Cloudflare uses to protect the service against automated traffic. According to Cloudflare, it expires after 30 minutes of inactivity. Cal.com decides which cookies and similar technologies its service uses, and these may change. Cal.com states that its app uses cookies for logging in, remembering preferences and security, and no third-party advertising cookies.
Once the calendar has loaded, Cal.com also sends technical diagnostics from your browser to Sentry, an error-monitoring service of Functional Software, Inc., San Francisco, USA, which Cal.com engages as a sub-processor. According to Cal.com, this data consists of internal IDs, error messages and stack traces, the requested URL, and your browser and operating system type, without names, email addresses or IP addresses, and is kept for 90 days. Because your browser connects to Sentry directly, Sentry’s servers still receive your IP address as part of that connection.
If you send a booking request, Cal.com processes what you enter in the booking form: your name, email address, preferred date and time, type of shoot, number of participants, preferred shooting location and, if you add them, notes. Notes are optional; all other details are required to submit a request. Providing them is not a legal or contractual obligation, but without them a booking request cannot be submitted. I use these details to review your request, confirm or decline it, contact you about it and, if we go ahead, to prepare and carry out the shoot. Each request stays pending until I confirm or decline it, and Cal.com emails you about it at the address you give. Please only give details about other participants if they have agreed.
Cal.com is connected to my Google Calendar. To show available times, it checks the calendars I have selected for conflicts; according to Cal.com, it reads only whether I am free or busy, not the details of my events. According to Cal.com, a request that needs confirmation is added to my calendar only once I accept it. When I confirm a booking, Cal.com adds it to my calendar, together with details of the booking. I have not verified exactly which booking details Google stores with the event. Google is also my email provider, and the information on Google in section 4 applies.
For booking requests, Cal.com acts as my processor under its data processing agreement (Art. 28 GDPR), which Cal.com states forms part of its terms of service. Cal.com states that it acts as an independent controller when it processes data for its own purposes, such as account administration, billing, security and compliance; that processing is governed by Cal.com’s own privacy policy.
The legal bases are as follows. Loading the calendar and processing your booking request are based on Art. 6(1)(b) GDPR, as steps taken at your request before a contract and, if we agree on a shoot, to carry it out. If you only open the calendar to look at available dates, the basis is Art. 6(1)(f) GDPR; my legitimate interest is offering a simple way to request a shoot. The security cookie is stored and read without consent because it is strictly necessary to provide the booking calendar you have asked for (§ 25(2) no. 2 TDDDG); the related processing is based on Art. 6(1)(f) GDPR, with my legitimate interest being a booking service protected against abuse. The diagnostics sent to Sentry are based on Art. 6(1)(f) GDPR; the legitimate interest is a booking calendar that works reliably and securely. Checking my calendar and adding confirmed bookings to it are based on Art. 6(1)(b) and (f) GDPR; my legitimate interest is organising my schedule and avoiding double bookings. You can object to processing based on legitimate interests, as described in section 9.
Cal.com processes data in the USA. Cal.com, Inc. is certified under the EU-U.S. Data Privacy Framework and was listed as an active participant on the official Data Privacy Framework list when I checked on 2 November 2026. Transfers to Cal.com therefore take place on the basis of the European Commission’s adequacy decision for that framework (Art. 45 GDPR). Cal.com’s data processing agreement provides for the EU standard contractual clauses where the framework does not apply. Cal.com lists its sub-processors, including Sentry and Cloudflare, on its trust center.
Booking requests remain in my Cal.com account and, once confirmed, in my calendar until I delete them. I delete booking data once it is no longer needed for your request or our work together, unless statutory retention duties, such as tax and commercial record-keeping, require me to keep it longer. Data that Cal.com processes for its own purposes is kept according to Cal.com’s own retention periods.
Your rights are described in section 9. To use them for your booking data, write to me at the address in section 1. For processing Cal.com carries out for its own purposes, you can also contact Cal.com at privacy@cal.com. More information is in Cal.com’s privacy policy.
9. Your rights
You have the right to access your personal data (Art. 15 GDPR), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), and to receive it in a portable format (Art. 20). You can withdraw consent at any time, with effect for the future (Art. 7(3)).
Where processing is based on legitimate interests, you can object to it on grounds relating to your particular situation (Art. 21 GDPR).
To use any of these rights, write to me at the address in section 1. You can also complain to a data protection authority. The one responsible for Berlin is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
You are not required to provide personal data to view this website. I do not use automated decision-making or profiling.
10. Changes
I update this policy when the website or the services it uses change. Last updated: 3 November 2026.