Privacy and cookie policy.

When you use the contact form or request information regarding studio work or collaborations:

• Data Processed: name, email address, topic/subject, and message content (limited to fields filled in the form). During submission, technical transmission data such as IP address, timestamp, referrer, and essential anti-spam parameters (e.g. hidden honeypot field) may also be processed.
• Purposes: to receive, forward, manage, and respond to contact or quote/service requests, and to prevent abuse or spam.
• Legal Basis: execution of pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR); legitimate interest of the controller (Art. 6(1)(f) GDPR) for website security, spam prevention, and managing non-precontractual communications.
• Mandatory Nature: providing mandatory fields (name, email, subject, message) is necessary to send the request; without these details, the message cannot be delivered.
• Processor & Recipients: contact form submissions are sent to the site server, hosted on Cloudflare Workers, and from there transmitted securely via HTTPS to Web3Forms (operated by Web3Creative), acting as a data processor by receiving, verifying, technically holding, and forwarding messages to the controller’s inbox. Web3Forms may engage sub-processors for hosting, infrastructure security, email delivery, and spam filtering. The server applies a per-IP submission limit and does not store message content.
• International Transfers: data may be processed outside the European Economic Area (EEA). Web3Creative states that such transfers are governed by Standard Contractual Clauses (SCCs) under its Data Processing Addendum (DPA). See the Web3Forms Privacy Policy and Web3Forms DPA.
• Data Retention: Web3Forms may technically retain submission records for up to three years (or shorter periods based on plan terms or early deletion). The email copy received by the controller is retained for as long as necessary to manage the inquiry and, if no professional relationship follows, for up to 12 months after the last contact. If a contractual or commercial relationship is established, relevant data is retained according to statutory legal, administrative, and tax retention periods.