Privacy policy

Vyral Studio® is the controller for personal data collected through this site. The studio is based in Groningen, The Netherlands.

This section also needs the registered name, the business address, the Dutch Chamber of Commerce number and the VAT number: [Add registered name, address, KvK number and VAT number]. No data protection officer has been appointed; if one is, the name belongs here.

The contact form asks for your name, your e-mail address, your company if you want to give it, and a description of your project. There are no other fields, and what goes in the description is up to you.

Your browser also sends technical data on every visit, such as an IP address and the page requested. What the hosting provider keeps of that, and for how long, needs writing out here: [Describe hosting provider logging].

• Name
• E-mail address
• Company name, optional
• Description of your enquiry
• Technical web server logs

An enquiry is stored and e-mailed to the studio. That is the whole of it: we use it to reply, and to find the correspondence again if the enquiry turns into work.

Your data does not go into advertising audiences, no profile is built from it, and no automated system makes decisions about you. If the studio ever adds a newsletter or a CRM, that purpose needs its own description here: [Describe new purposes once they exist].

Handling your enquiry rests on Article 6(1)(b) GDPR, steps taken before entering a contract. For questions that never become work, the basis is the studio’s legitimate interest in being able to answer its post.

Invoices and the records around them are kept under a statutory obligation. All three bases need checking by someone qualified before this policy is adopted: [Have legal bases reviewed].

Enquiries that do not lead to work are deleted after a fixed period. Anything that forms part of the accounts is kept for seven years, because Dutch tax law requires it.

The period for everything else is not set: [Add retention period for enquiries]. Nor is the one for server logs: [Add retention period for server logs].

The studio does not sell data and shares it only with the providers needed to run the site and the mail. Each of those needs a processing agreement in place.

Which providers those are is not settled. Record the name, the role and the country of processing for each: [Add hosting provider], [Add e-mail provider], [Add form submission processor]. If a provider processes outside the European Economic Area, the basis for that transfer belongs here too.

The site sets no tracking cookies and uses no advertising pixels. Fonts are served from our own server, so your browser fetches nothing from a third party while you read.

Whether any analytics run at all, and if so which package and whether consent is required, has to be filled in before this policy is adopted: [Add analytics package, or record that there is none]. Functional preferences the site remembers itself, such as your language, belong here with their retention period: [Check functional storage].

The site runs entirely over https, and access to the mailbox and the submissions is limited to the people working on them.

The rest of the measures — two-factor authentication, backups, who can reach what — belongs here, along with what happens in the event of a breach: [Record security measures and breach procedure].

You can ask what data the studio holds about you, have it corrected or deleted, have processing restricted, object to it, and receive your data in a portable file. Send a request to Hello@vyralstudio.nl.

The studio answers within a month. To keep data from reaching the wrong person, we may ask you to confirm who you are; what that check looks like still needs deciding: [Record identity check for requests].

• Access to what we hold
• Rectification of anything that is wrong
• Erasure, once there is no ground to keep it
• Restriction of processing while a request is open
• Objection to processing based on legitimate interest
• Portability: your data in a common file format

If you and the studio cannot resolve it, you can complain to the Autoriteit Persoonsgegevens, the Dutch supervisory authority, at autoriteitpersoonsgegevens.nl.

That is separate from your right to go to court. We would rather hear it first, if only because then we can still put it right.

This text changes when the studio changes tools or starts processing different data. The date at the top says when it was last adopted.

There is no date yet, because the document has not been reviewed. Once it has, this section also needs to say how existing clients hear about a change: [Add how changes are communicated].

Questions about this policy or about your data go to Hello@vyralstudio.nl. The studio is in Groningen, The Netherlands.

A postal address and a phone number belong here as well, since a request has to be possible by other means than e-mail: [Add postal address and phone number].