Privacy

Who runs this site

• Controller: Tjeerd van der Heeft, eenmanszaak (KvK 75602172), trading as StudioTJ (also registered under the trading name Definitive015)
• BTW: NL002283139B11
• Post: Keurenplein 41, Box D2818, 1069CD Amsterdam
• Privacy contact: thestudiotj@gmail.com

For privacy questions or to exercise any of the rights described below, email the address above.

What StudioTJ collects, and why

When you place an order

Stripe handles checkout. You enter your payment details, billing address, and email directly into Stripe's hosted payment page. Stripe is the controller of that payment data; their own privacy notice covers it.

After payment, Stripe sends StudioTJ the order details: your name, email, shipping address, and what you ordered. That information is then sent to the print-on-demand fulfilment partner — currently Printify — which produces and ships the order. Legal basis: performance of a contract (AVG Art. 6(1)(b)) — without these details, the order cannot be fulfilled.

A copy of the order is also kept for tax bookkeeping, which Dutch tax law requires for seven years (Algemene wet inzake rijksbelastingen, Art. 52). Legal basis: legal obligation (AVG Art. 6(1)(c)).

When you write in

If you email thestudiotj@gmail.com, your email address and the contents of your message are visible to Google (which provides the inbox) and to me. Replies are sent the same way. Email is kept as long as needed to handle the conversation and any reasonable follow-up. Legal basis: legitimate interest in answering correspondence (AVG Art. 6(1)(f)).

When you submit your email for updates

The newsletter signup on the homepage stores your email address so you can be notified when StudioTJ has new work to share. The signup form is active and collects email addresses now, but no newsletter emails are being sent yet — the sending side is not yet set up. When sending begins, addresses already on file will be used only for that purpose, and you can unsubscribe at any time. You can also request removal at any point before sending begins, by emailing the privacy contact above. Legal basis: consent (AVG Art. 6(1)(a)).

When you visit the site

The hosting provider (Vercel) keeps standard server logs — IP address, browser type, timestamp, and which pages were requested. These are used for security, debugging, and capacity. The CDN (Cloudflare) sets a small bot-management cookie called __cf_bm to distinguish humans from automated traffic. Stripe Checkout sets its own cookies on its own pages while you are paying. The shopping cart uses a small amount of browser storage — a session cookie or local storage in your browser, depending on your setup — to remember what you have added while you browse.

That's the full list of what the site sets today. If analytics or other tracking is added later, this section is updated and, where required, consent is collected first. Legal basis for the strictly necessary items above: legitimate interest in keeping the site secure and functional (AVG Art. 6(1)(f)).

Who else processes your data

StudioTJ uses the following processors. Each only sees what it needs to do its job.

• Stripe — payments
• Print-on-demand fulfilment partner (currently Printify) — order fulfilment, and through them, the print provider that physically produces and ships your order
• Resend — transactional emails such as order confirmations
• Cloudflare — DNS and CDN
• Vercel — hosting
• Hetzner — server hosting for backend automation workflows that may process order data (located in Germany)
• Google — inbox provider for thestudiotj@gmail.com

Each has its own privacy policy describing what it does with the data it receives. As StudioTJ adds further fulfilment partners — for example, additional partners for fine art prints — they will be listed here before any customer data starts flowing to them.

Where your data goes

Most processors are EU-based or have EU operations. Some (Stripe, Cloudflare, Vercel, Google) are headquartered in the United States, and the fulfilment partner's print providers may be located worldwide depending on which provider physically produces your order. Where data is transferred outside the EU/EEA, the transfer is covered by Standard Contractual Clauses or equivalent safeguards under AVG Chapter V.

How long it is kept

• Order and invoice records: seven years, per Dutch tax law
• Transactional email logs: per Resend's retention policy
• Email correspondence: as long as needed for the conversation, then deleted on a periodic basis
• Server and security logs: short-term, per Vercel and Cloudflare default retention
• Newsletter email addresses: until you unsubscribe or request removal

Your rights

Under the AVG you have the right to:

• Access the personal data StudioTJ holds about you
• Have inaccurate data corrected
• Have your data deleted (subject to legal retention obligations such as the seven-year tax record)
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent (where consent is the legal basis)

Email thestudiotj@gmail.com to exercise any of these. A response goes out within 30 days at the latest.

If StudioTJ does not handle a privacy concern to your satisfaction, you have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Cookies and tracking

The site itself does not currently set analytics, advertising, or tracking cookies. The cookies and equivalent browser storage used during normal visits are:

• __cf_bm — Cloudflare bot management, set automatically on traffic served through Cloudflare's CDN
• Stripe Checkout cookies — set by Stripe on its own checkout pages while you are paying
• Cart storage — a small amount of browser storage (session cookie or local storage, depending on your browser) used to remember what you have added to your cart while browsing

If analytics or other non-essential cookies are added later, this section is updated and consent is collected first where required.