Who is responsible

Controller

GuusLab

Address

Emmaweg 46, 3603 AN Maarssen, Netherlands

Chamber of Commerce

95954600

Email

guus@guuslab.com

The studio is one person. Nobody else reads your messages or your orders, and nothing is sold, rented or handed to advertisers.

What is recorded, and why

When you order, the studio keeps your name, email address, delivery address, what you bought and what you paid. That is what it takes to make the thing, send it, and answer you afterwards. The basis is performing our contract, and Dutch law requires the records to be kept for seven years for tax.

When you write through the contact form, the studio keeps your name, email address and message, so it can reply. The basis is a legitimate interest in answering people who write.

When you sign in, the studio stores your email address and a temporary sign-in link, so you can see your own orders. There is no password to lose. The basis is performing our contract.

When the server is asked for something, it briefly holds the requesting IP address to stop a script hammering the forms. It is kept in memory only and is never written to disk. The basis is a legitimate interest in keeping the site standing.

Who else sees it

Only these, only for the part they perform, and none of them for their own purposes:

Stripe

Takes the payment. Receives your email address, the order number and what you bought. It never receives your delivery address, because the studio does not send it. Card details are entered on Stripe's own pages and never reach this site.

Printful

Makes and ships the order. Receives your name and delivery address.

Amazon SES

Sends the email. Receives your email address and the message.

PDOK and Photon

Look up addresses while you type at checkout. They receive the text you type and nothing else. The lookup runs through this server rather than from your browser, so your IP address never reaches either of them.

Order records live in a database the studio runs itself, in the Netherlands. Stripe and Printful are outside the EU and transfer data under the European Commission's standard contractual clauses.

Cookies

Two, both strictly necessary, neither used to follow you. One keeps you signed in. One lets the type page load the typeface. There is no analytics, no advertising pixel and no third party watching you here, which is why there is no cookie banner to dismiss.

How long it is kept

Orders and invoices

Seven years, because Dutch tax law requires it.

Account and sign-in

Until you ask for the account to be deleted.

Contact messages

Two years, then deleted.

Rate-limiting records

Minutes, in memory, never stored.

What you can ask for

You can ask to see what is held about you, to correct it, to delete it, to take it elsewhere, or to object to it being held. Write to guus@guuslab.com and you get an answer within a month. Orders that tax law requires to be kept cannot be deleted before their seven years are up, and you will be told plainly if that is the reason.

If you are not satisfied with how that is handled, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.