Privacy Policy
& GDPR Statement
Data Controller
The data controller responsible for your personal data is:
| Company name | Studio Nina |
| Registered address | Netherlands (exact address available upon written request) |
| privacy@studionina.co | |
| Website | https://studionina.co/ |
| KvK number | Available upon request |
If you have any questions about how we handle your personal data, please contact us at the email address above before submitting a formal complaint to the supervisory authority.
Data We Collect
We collect personal data only when it is necessary and proportionate to the purpose for which it is processed. Below is an overview of the categories of data we may collect.
Account & Order Data
- Full name, email address, telephone number
- Delivery address and billing address
- Order history, product selections, sizes, and colour preferences
- Return and exchange requests
- Communication history with our customer service team
Payment Data
We do not store payment card data on our servers. All payment transactions are processed directly by Shopify Payments and its underlying payment processors (Stripe). Only a tokenised reference and the last four digits of a card (if applicable) may be visible to us for order management purposes.
Browsing & Technical Data
- IP address and approximate geographic location (country/city level)
- Browser type, operating system, device type
- Pages visited, products viewed, time spent on pages
- Referring website or search query that brought you to our site
- Add-to-cart and checkout events (via Shopify analytics)
Marketing Preferences
- Newsletter subscription status and category preferences (Women, Campaigns, New Arrivals)
- Email open and click events (if you have consented to marketing)
- Wishlist items saved in browser localStorage (stored locally on your device only)
Contact Form Data
When you submit a message via our contact form, we collect your name, email address, and the content of your message. This data is transmitted via FormSubmit.co to our inbox and is not stored in a database by us.
Legal Basis for Processing
Under Article 6 of the GDPR, every processing activity requires a lawful basis. We rely on the following bases:
| Processing Purpose | Legal Basis (Art. 6 GDPR) |
|---|---|
| Processing and fulfilling your order | Art. 6(1)(b) — Contract performance |
| Sending order confirmations and shipping updates | Art. 6(1)(b) — Contract performance |
| Handling returns, exchanges, and customer support | Art. 6(1)(b) — Contract performance |
| Complying with tax, accounting, and VAT obligations | Art. 6(1)(c) — Legal obligation |
| Preventing fraud and ensuring website security | Art. 6(1)(f) — Legitimate interest |
| Website analytics to improve user experience | Art. 6(1)(f) — Legitimate interest |
| Sending marketing emails and newsletters | Art. 6(1)(a) — Consent |
| Setting non-essential cookies (analytics, marketing) | Art. 6(1)(a) — Consent |
How We Use Your Data
We use the personal data we collect for the following purposes:
- Order fulfilment: Processing, packaging, and delivering your purchase; communicating about delivery status, delays, or issues.
- Customer support: Responding to your enquiries, handling complaints, and processing returns or exchanges.
- Payment processing: Securely transmitting payment data to our payment processor (Shopify Payments / Stripe).
- Account management: If you create an account, maintaining your profile, order history, and saved preferences.
- Legal compliance: Retaining transaction records for Dutch tax and VAT purposes (Belastingdienst) as required by law.
- Fraud prevention: Detecting and preventing fraudulent orders or abusive behaviour on our platform.
- Website improvement: Analysing aggregated browsing data to understand how visitors use our site and make improvements.
- Marketing (consent only): Sending you newsletters, new collection announcements, and promotional offers — only if you have subscribed and with the ability to unsubscribe at any time.
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
Cookies & Tracking Technologies
Our website uses cookies and similar technologies. Cookies are small text files stored on your device that help us provide a better experience. Below is a breakdown of the cookies we use.
Strictly Necessary Cookies
These cookies are essential for the website to function and cannot be disabled. They do not require consent.
| Cookie | Purpose | Duration |
|---|---|---|
| nina_cart | Stores your shopping cart contents (localStorage, not a cookie) | Until cleared |
| nina_wishlist | Stores your wishlist (localStorage) | Until cleared |
| nina_lang | Remembers your language preference | Until cleared |
| nina_dismissed_* | Remembers dismissed banners and announcements | Until cleared |
| _shopify_* | Shopify session and cart management (set after checkout redirect) | Session / 1 year |
Payment Processing Cookies
These cookies are set by our payment provider Mollie when you proceed to checkout. They are strictly necessary for processing your payment securely and cannot be disabled.
| Cookie / Storage | Provider | Purpose | Duration |
|---|---|---|---|
| mollie_* | Mollie B.V. | Secure payment session management, fraud prevention, payment form state | Session |
Analytics Cookies
We do not currently use any analytics cookies or third-party tracking services (e.g. Google Analytics). If this changes in the future, we will update this policy and request your consent before setting any analytics cookies.
Managing Cookies
You can manage or delete cookies through your browser settings. Please note that disabling strictly necessary cookies may affect how the website functions. For analytics cookies, you can withdraw your consent at any time by adjusting your browser settings or by contacting us.
Third-Party Services
We use a limited number of third-party services to operate our website and business. Each has its own privacy policy and, where applicable, standard contractual clauses (SCCs) for international transfers.
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Shopify Inc. | E-commerce platform, order management, payments, checkout | Name, address, email, order data, payment tokens | USA (SCCs / EU-US Data Privacy Framework) |
| Amazon Web Services, Inc. | Website hosting (S3), content delivery (CloudFront CDN), and backend API infrastructure (ECS, API Gateway, DynamoDB, Aurora) | IP address, request logs (transient), order and account data (encrypted at rest) | EU (eu-central-1, Frankfurt) / USA (SCCs / EU-US Data Privacy Framework) |
| FormSubmit.co | Contact form submission forwarding | Name, email, message content | USA (data in transit only) |
| Google LLC | Google Fonts (typography CDN) — no cookies, IP only | IP address (transient, not stored by Google per their policy) | USA (SCCs) |
| Stripe Inc. | Payment processing (via Shopify Payments) | Payment card data (PCI-DSS compliant) | USA / EU (SCCs) |
We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.
Your Rights Under the GDPR
As a data subject under the GDPR (Articles 15–22), you have the following rights. To exercise any of them, contact us at privacy@studionina.co. We will respond within 30 days.
You have the right to obtain a copy of the personal data we hold about you, and information about how we process it.
You have the right to request correction of inaccurate personal data we hold about you without undue delay.
You have the right to request deletion of your personal data ("right to be forgotten"), subject to our legal retention obligations.
You may request that we restrict processing of your data in certain circumstances — for example, while a dispute is being resolved.
You have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller.
You may object at any time to processing based on legitimate interest or for direct marketing purposes (including profiling for marketing).
Where processing is based on consent (e.g. marketing emails), you may withdraw consent at any time without affecting prior processing.
You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not use such systems.
Data Retention
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.
| Data Category | Retention Period | Basis |
|---|---|---|
| Order & transaction records | 7 years from transaction date | Dutch tax law (Art. 52 AWR) — legal obligation |
| Customer account data | Duration of account + 2 years after last activity | Contract / legitimate interest |
| Marketing subscription data | Until consent is withdrawn | Consent (Art. 6(1)(a)) |
| Contact form messages | 12 months from receipt | Legitimate interest (customer support) |
| Server & access logs (Netlify) | 30 days (Netlify default) | Legitimate interest (security) |
| Analytics data | 14 months (Google Analytics default) | Consent |
After the applicable retention period, data is securely deleted or anonymised so it can no longer be associated with an individual.
International Data Transfers
Studio Nina is based in the Netherlands (EU). However, some of the third-party services we use are based outside the European Economic Area (EEA), primarily in the United States. These transfers are subject to appropriate safeguards in accordance with Chapter V of the GDPR.
Safeguards We Rely On
- Standard Contractual Clauses (SCCs): Approved by the European Commission and incorporated into our data processing agreements with Shopify, Amazon Web Services, Google, Stripe, and FormSubmit.
- EU–US Data Privacy Framework (DPF): Where applicable, transfers to US entities certified under the DPF are covered by the European Commission's adequacy decision of July 2023.
You can request a copy of the relevant safeguards by contacting us at privacy@studionina.co.
Data Security
We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:
- HTTPS encryption for all data in transit (TLS 1.2 or higher)
- Access controls limiting data access to personnel on a need-to-know basis
- Secure payment processing via PCI-DSS Level 1 compliant provider (Stripe/Shopify)
- Security headers enforced at CDN level (HSTS, Content Security Policy, X-Frame-Options, and others) via AWS CloudFront Response Headers Policy
- No storage of payment card data on our own infrastructure
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware, and affected individuals without undue delay where required by Art. 34 GDPR.
Children's Privacy
Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@studionina.co and we will delete it promptly.
Under the Netherlands' implementation of the GDPR (UAVG, Art. 8), the minimum age of consent for information society services is 16. Parental or guardian consent is required for individuals below this age.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.
We encourage you to review this policy periodically. Your continued use of our website after any changes indicates your acknowledgement of the updated policy.
Previous versions of this policy are available upon request.
Contact & Complaints
Data Protection Enquiries
For any questions, requests, or concerns about how we handle your personal data, please contact our privacy team:
| privacy@studionina.co | |
| Subject line | GDPR Request – [your request type] |
| Response time | Within 30 days of receipt (GDPR Art. 12) |
| Identity verification | We may ask you to verify your identity before processing your request |
Supervisory Authority
You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe we have not handled your data in accordance with the GDPR. We would, however, appreciate the opportunity to address your concern directly before you approach the supervisory authority.
| Authority | Autoriteit Persoonsgegevens (AP) |
| Website | www.autoriteitpersoonsgegevens.nl |
| Address | Hoge Nieuwstraat 8, 2514 EL Den Haag, Netherlands |
| Telephone | +31 (0)70 888 85 00 |