Privacy Policy

1. Data Controller

The data controller responsible for processing personal data on this website is:

Kleiatelier Noord (trading name of Noor van Linden)
Twijnstraat 27
3511 ZK Utrecht, Netherlands
Email: [email protected]
Phone: +31 30 231 74 58
KVK: 84729136

2. Applicable Law

This Privacy Policy complies with the General Data Protection Regulation (EU) 2016/679 as implemented in the Netherlands through the Algemene verordening gegevensbescherming (AVG) and the Uitvoeringswet AVG (UAVG). Where Dutch law provides additional protection, we apply the standard that affords you greater protection.

3. Personal Data We Collect

• Contact data: name, email, phone number, and message content when you use the contact form, email, or call the studio.
• Booking data: class and workshop preferences, age group for kids’ sessions, and related scheduling notes.
• Technical data: IP address, browser type, device information, and pages visited via cookies (see our Cookie Policy).
• Communication data: correspondence about classes, workshops, or studio visits.

We do not knowingly collect personal data from children under 16 without parental or guardian consent.

4. Purposes and Legal Bases (AVG Art. 6)

• Responding to enquiries and fulfilling bookings — pre-contractual steps and contract performance (Art. 6(1)(b) AVG).
• Operating and securing the website — legitimate interest in a functional, secure online presence (Art. 6(1)(f) AVG).
• Analytics and marketing cookies — only with your consent (Art. 6(1)(a) AVG).
• Legal obligations — including Dutch tax and accounting records (Art. 6(1)(c) AVG).

5. Cookies and Tracking

Essential cookies store your consent preferences. Analytics and marketing cookies run only if you consent. Details are in our Cookie Policy.

6. Data Sharing and Processors

We do not sell personal data. We may share data with:

• Hosting and IT providers under a verwerkersovereenkomst (Art. 28 AVG).
• Analytics providers, only with your consent.
• Payment providers when you pay for classes or workshops.
• Public authorities when required by Dutch law.

Transfers outside the EEA use appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

7. Retention

• Contact messages: up to 24 months after resolution.
• Booking and invoicing records: 7 years (Dutch fiscal retention).
• Cookie consent records: 12 months from consent.
• Server logs: up to 90 days for security.

8. Your Rights Under the AVG

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21)
• Withdrawal of consent (Art. 7(3))

Email [email protected] to exercise your rights. We respond within one month, extendable by two months for complex requests (Art. 12 AVG).

9. Complaint to the AP

You may lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens (AP)
Postbus 93374
2509 AJ Den Haag, Netherlands
Website: autoriteitpersoonsgegevens.nl

10. Security

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, in line with Art. 32 AVG.

11. Changes

We may update this policy from time to time. The “Last updated” date at the top reflects the latest version.