Privacy policy

The short version: we collect exactly what is needed to send you the audit, and nothing beyond it. We do not sell or pass your data to third parties for marketing. We delete it on the first email asking us to.

Revised 12 September 2026

01Who processes your data

The data controller is [to fill in] (“the Studio”, “we”), registration number [to fill in], registered at [to fill in].

For anything about your data, write to [to fill in].

02What we collect

  • Through the enquiry form: name, phone (WhatsApp), email, site address and the message text — whatever you typed yourself.
  • Technical data: IP address, device and browser type, and the pages you opened, to the extent held in server logs.
  • Analytics data — only if you consented to it; see section 06.

We do not collect special category data: health, beliefs, biometrics. Please do not enter any into the form.

03Why, and on what legal basis

  • To answer your enquiry and send the audit — your request and pre-contractual steps (Art. 6(1)(b) GDPR).
  • To perform a contract, once work has started — Art. 6(1)(b) GDPR.
  • Site security and logs — legitimate interest (Art. 6(1)(f) GDPR).
  • Analytics and tracking — consent only (Art. 6(1)(a) GDPR), withdrawable at any time.

04How long we keep it

Enquiries that did not lead to a contract: 12 months from the last contact, then deleted. Data under an active contract: for the duration of the work and afterwards for as long as accounting and tax law requires. Server logs: up to 90 days.

05Who we share it with

Only the processors the service cannot run without: hosting ([to fill in]), email delivery ([to fill in]), messaging for contact (WhatsApp, Telegram — your choice), analytics (see 06). Each is bound by a data processing agreement. We do not sell your data and do not pass it on for anyone else’s marketing.

Some processors may handle data outside the EEA. Where that happens, the transfer relies on the European Commission’s standard contractual clauses.

06Cookies and analytics

Essential cookies make the site work and are set without consent. Analytics and advertising cookies are set only after you explicitly consent in the banner; declining breaks nothing and degrades nothing.

Services in use: [to fill in]. You can withdraw consent at any time by clearing cookies or writing to us.

07Your rights

  • obtain a copy of the data we hold about you;
  • correct inaccurate data;
  • have data erased (“right to be forgotten”);
  • restrict or object to processing;
  • receive your data in a machine-readable form;
  • withdraw consent without giving a reason;
  • lodge a complaint with a data protection supervisory authority.

Write to [to fill in] — we answer within 30 days. There is no special form; an email is enough.

08Security and changes

The connection is protected by HTTPS, and access to enquiries is limited to people who need it for the work. Nobody has absolute protection; if a breach affecting your rights occurs, we will notify you and the supervisory authority within the required time.

Any new version of this policy is published on this page with a new date. Material changes are emailed to you if we hold your address.

Before launch: fill in every field highlighted in yellow (legal entity, address, contact, processors, analytics) and have the document reviewed by a lawyer in your jurisdiction. This text is a working draft, not legal advice.