1) Who We Are (Data Controller)

2) Data We Collect

• Identity & Contact: name, email, phone, billing/shipping address.
• Transaction: order details and payment status (payments handled by third-party providers).
• Account: login details and preferences if you create an account.
• Technical: IP address, device, browser, pages viewed (via cookies/similar tech).
• Marketing: your preferences for newsletters or offers (only if you opt in).

3) How We Use Your Data & Legal Bases

• Contract: to process, fulfill, and deliver your orders; provide customer support.
• Legal obligation: tax/accounting, fraud prevention, record-keeping.
• Consent: newsletters and non-essential cookies/analytics (you can withdraw anytime).
• Legitimate interests: to operate, secure, and improve our website and services.

4) Sharing Your Data

We never sell your data. We share it only with:

• Squarespace (host/platform): to operate our webshop and store data securely.
• Payment providers (e.g., Stripe, PayPal, Klarna): to process payments safely.
• Shipping partners: to deliver your orders.
• Analytics/marketing tools (if used, e.g., Google Analytics, Meta Pixel): to understand traffic and improve marketing—only with your consent where required.
• Authorities: when required by law.

Each provider only receives the data needed to perform their service.

5) Cookies

We use cookies and similar technologies:

• Essential cookies: required for core site functions (e.g., cart, checkout, security).
• Analytics/marketing cookies: used only with your consent.

You can manage your preferences anytime via our cookie banner or your browser settings.

6) Data Retention

• Orders & invoices: kept for 7 years to comply with Dutch/EU tax and accounting rules.
• Accounts: kept until you delete your account.
• Marketing: kept until you unsubscribe or withdraw consent.

7) Your Rights (GDPR)

You can request to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (where applicable).
• Restrict or object to processing in certain cases.
• Withdraw consent at any time (for newsletters/cookies).
• Receive a portable copy of your data.

Contact us at contact.studio9109@gmail.com to exercise these rights. We may need to verify your identity.

8) Security

We use reasonable technical and organizational measures to protect your data. However, no Internet transmission or storage system is completely secure.

9) International Transfers

If data is transferred outside the EEA (for example by our processors), we rely on appropriate safeguards such as Standard Contractual Clauses.

10) Changes to This Policy

We may update this policy from time to time. The latest version will always appear on this page with the “Last updated” date above.

11) Contact

If you have questions or concerns, contact: studio.9109 — contact.studio9109@gmail.com.