Welcome to Studio Nina
Select your country and preferred language to personalise your experience.
Language
Welcome to Studio Nina
Select your country and preferred language to personalise your experience.
The data controller responsible for your personal data is:
| Company name | Studio Nina |
| Registered address | Netherlands (exact address available upon written request) |
| privacy@studionina.co | |
| Website | https://demo.studionina.co/ |
| KvK number | Available upon request |
If you have any questions about how we handle your personal data, please contact us at the email address above before submitting a formal complaint to the supervisory authority.
We collect personal data only when it is necessary and proportionate to the purpose for which it is processed. Below is an overview of the categories of data we may collect.
We do not store payment card data on our servers. All payment transactions are processed directly by Shopify Payments and its underlying payment processors (Stripe). Only a tokenised reference and the last four digits of a card (if applicable) may be visible to us for order management purposes.
When you submit a message via our contact form, we collect your name, email address, and the content of your message. This data is transmitted via FormSubmit.co to our inbox and is not stored in a database by us.
Under Article 6 of the GDPR, every processing activity requires a lawful basis. We rely on the following bases:
| Processing Purpose | Legal Basis (Art. 6 GDPR) |
|---|---|
| Processing and fulfilling your order | Art. 6(1)(b) — Contract performance |
| Sending order confirmations and shipping updates | Art. 6(1)(b) — Contract performance |
| Handling returns, exchanges, and customer support | Art. 6(1)(b) — Contract performance |
| Complying with tax, accounting, and VAT obligations | Art. 6(1)(c) — Legal obligation |
| Preventing fraud and ensuring website security | Art. 6(1)(f) — Legitimate interest |
| Website analytics to improve user experience | Art. 6(1)(f) — Legitimate interest |
| Sending marketing emails and newsletters | Art. 6(1)(a) — Consent |
| Setting non-essential cookies (analytics, marketing) | Art. 6(1)(a) — Consent |
We use the personal data we collect for the following purposes:
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
Our website uses cookies and similar technologies. Cookies are small text files stored on your device that help us provide a better experience. Below is a breakdown of the cookies we use.
These cookies are essential for the website to function and cannot be disabled. They do not require consent.
| Cookie | Purpose | Duration |
|---|---|---|
| nina_cart | Stores your shopping cart contents (localStorage, not a cookie) | Until cleared |
| nina_wishlist | Stores your wishlist (localStorage) | Until cleared |
| nina_lang | Remembers your language preference | Until cleared |
| nina_dismissed_* | Remembers dismissed banners and announcements | Until cleared |
| _shopify_* | Shopify session and cart management (set after checkout redirect) | Session / 1 year |
These cookies are set by our payment provider Mollie when you proceed to checkout. They are strictly necessary for processing your payment securely and cannot be disabled.
| Cookie / Storage | Provider | Purpose | Duration |
|---|---|---|---|
| mollie_* | Mollie B.V. | Secure payment session management, fraud prevention, payment form state | Session |
We do not currently use any analytics cookies or third-party tracking services (e.g. Google Analytics). If this changes in the future, we will update this policy and request your consent before setting any analytics cookies.
You can manage or delete cookies through your browser settings. Please note that disabling strictly necessary cookies may affect how the website functions. For analytics cookies, you can withdraw your consent at any time by adjusting your browser settings or by contacting us.
We use a limited number of third-party services to operate our website and business. Each has its own privacy policy and, where applicable, standard contractual clauses (SCCs) for international transfers.
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Shopify Inc. | E-commerce platform, order management, payments, checkout | Name, address, email, order data, payment tokens | USA (SCCs / EU-US Data Privacy Framework) |
| Amazon Web Services, Inc. | Website hosting (S3), content delivery (CloudFront CDN), and backend API infrastructure (ECS, API Gateway, DynamoDB, Aurora) | IP address, request logs (transient), order and account data (encrypted at rest) | EU (eu-central-1, Frankfurt) / USA (SCCs / EU-US Data Privacy Framework) |
| FormSubmit.co | Contact form submission forwarding | Name, email, message content | USA (data in transit only) |
| Google LLC | Google Fonts (typography CDN) — no cookies, IP only | IP address (transient, not stored by Google per their policy) | USA (SCCs) |
| Stripe Inc. | Payment processing (via Shopify Payments) | Payment card data (PCI-DSS compliant) | USA / EU (SCCs) |
We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.
As a data subject under the GDPR (Articles 15–22), you have the following rights. To exercise any of them, contact us at privacy@studionina.co. We will respond within 30 days.
You have the right to obtain a copy of the personal data we hold about you, and information about how we process it.
You have the right to request correction of inaccurate personal data we hold about you without undue delay.
You have the right to request deletion of your personal data ("right to be forgotten"), subject to our legal retention obligations.
You may request that we restrict processing of your data in certain circumstances — for example, while a dispute is being resolved.
You have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller.
You may object at any time to processing based on legitimate interest or for direct marketing purposes (including profiling for marketing).
Where processing is based on consent (e.g. marketing emails), you may withdraw consent at any time without affecting prior processing.
You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not use such systems.
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.
| Data Category | Retention Period | Basis |
|---|---|---|
| Order & transaction records | 7 years from transaction date | Dutch tax law (Art. 52 AWR) — legal obligation |
| Customer account data | Duration of account + 2 years after last activity | Contract / legitimate interest |
| Marketing subscription data | Until consent is withdrawn | Consent (Art. 6(1)(a)) |
| Contact form messages | 12 months from receipt | Legitimate interest (customer support) |
| Server & access logs (Netlify) | 30 days (Netlify default) | Legitimate interest (security) |
| Analytics data | 14 months (Google Analytics default) | Consent |
After the applicable retention period, data is securely deleted or anonymised so it can no longer be associated with an individual.
Studio Nina is based in the Netherlands (EU). However, some of the third-party services we use are based outside the European Economic Area (EEA), primarily in the United States. These transfers are subject to appropriate safeguards in accordance with Chapter V of the GDPR.
You can request a copy of the relevant safeguards by contacting us at privacy@studionina.co.
We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware, and affected individuals without undue delay where required by Art. 34 GDPR.
Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@studionina.co and we will delete it promptly.
Under the Netherlands' implementation of the GDPR (UAVG, Art. 8), the minimum age of consent for information society services is 16. Parental or guardian consent is required for individuals below this age.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.
We encourage you to review this policy periodically. Your continued use of our website after any changes indicates your acknowledgement of the updated policy.
Previous versions of this policy are available upon request.
For any questions, requests, or concerns about how we handle your personal data, please contact our privacy team:
| privacy@studionina.co | |
| Subject line | GDPR Request – [your request type] |
| Response time | Within 30 days of receipt (GDPR Art. 12) |
| Identity verification | We may ask you to verify your identity before processing your request |
You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe we have not handled your data in accordance with the GDPR. We would, however, appreciate the opportunity to address your concern directly before you approach the supervisory authority.
| Authority | Autoriteit Persoonsgegevens (AP) |
| Website | www.autoriteitpersoonsgegevens.nl |
| Address | Hoge Nieuwstraat 8, 2514 EL Den Haag, Netherlands |
| Telephone | +31 (0)70 888 85 00 |
