- 01Who we are
- 02What data we collect
- 03Why we collect it & legal basis
- 04Third-party services
- 05How long we keep your data
- 06Your rights under the GDPR
- 07Data security
- 08Changes to this statement
- 09Contact & complaints
This privacy statement applies to Clay Studio Leiden, a ceramics studio based in the Netherlands offering courses, workshops, team events, private bookings, open studio access memberships, and the sale of products including but not limited to porcelain, stoneware, glazes, underglazes and tools.
We are the data controller responsible for the personal data you share with us through our website. Our website is hosted on Squarespace.
If you have any questions about this statement or how we handle your data, please see Section 09 (Contact).
Depending on how you interact with our website, we may collect the following categories of personal data:
When you book a workshop or open studio session: your name, email address, phone number, and any information you provide in notes or special requests fields.
When you purchase services and/or products from our online shop, we require your name, billing address, email address, phone number and order details relating to your purchase as required by Dutch law. Payment card data is processed directly and securely by Stripe or Mollie.
When you subscribe to our newsletter, we ask for your email address, and optionally your first name and/or last name.
Our website uses cookies and similar tracking technologies, including analytics tools provided by Squarespace and Google Analytics. If you are subscribed to our newsletter, Mailchimp may also place cookies. These collect information such as your IP address, browser type, pages visited, and time spent on the site. See Section 04 for more detail.
If you contact us through any contact form or by email: your name, email address, and any content you include in your message.
Under the GDPR, we must have a lawful basis for processing your personal data. The table below explains our purposes and the legal ground we rely on for each.
| Processing your booking or order | Necessary to perform a contract with you (Art. 6(1)(b) GDPR) |
| Processing payment via Stripe or Mollie | Necessary to perform a contract with you (Art. 6(1)(b) GDPR) |
| Sending transactional emails (booking confirmations, order confirmations, shipping updates) | Necessary to perform a contract with you (Art. 6(1)(b) GDPR) |
| Sending our newsletter | Based on your consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time by clicking "unsubscribe" in any email. |
| Website analytics | Based on your consent via our cookie banner (Art. 6(1)(a) GDPR) |
| Responding to enquiries | Our legitimate interest in communicating with prospective and existing customers (Art. 6(1)(f) GDPR) |
| Complying with legal obligations (e.g. tax records) | Legal obligation (Art. 6(1)(c) GDPR) |
We use a small number of trusted third-party services to operate our website and business. Each acts as a data processor on our behalf and is bound by appropriate data processing agreements.
Our website is built and hosted on Squarespace (Squarespace, Inc., USA). Squarespace may process data including IP addresses, cookies, and usage data as part of hosting and analytics. Squarespace is certified under the EU–US Data Privacy Framework. For more information, see Squarespace's Privacy Policy.
Online payments are processed by Stripe (Stripe, Inc., USA / Stripe Payments Europe, Ltd., Ireland). Stripe collects and processes your payment details directly. We do not have access to your full card number. For more information, see Stripe's Privacy Policy.
Some payments are processed by Mollie (Mollie B.V., Netherlands). Mollie collects and processes your payment details directly and we do not have access to your full card details. For more information, see Mollie's Privacy Policy.
We use Mailchimp (The Rocket Science Group, LLC, USA) to manage our newsletter and email marketing. If you subscribe to our newsletter, your email address and name are stored with Mailchimp. Mailchimp is certified under the EU–US Data Privacy Framework. For more information, see Mailchimp's Privacy Policy.
We use Google Analytics (Google LLC, USA) to understand how visitors use our website. Google Analytics collects data such as your IP address, browser type, pages visited, and time on site. This data is anonymised where possible. Google is certified under the EU–US Data Privacy Framework. For more information, see Google's Privacy Policy.
We do not sell your personal data to third parties. We do not share your data with any parties other than those listed above, except where required by law.
- Essential cookies — required for the site to function (e.g. your shopping cart). These do not require consent.
- Analytics cookies — used to understand how visitors use our site (via Squarespace Analytics and Google Analytics). These are only placed with your consent.
You can manage your cookie preferences through the cookie banner shown when you first visit the site, or by adjusting your browser settings.
- Order & booking records — retained for 7 years to comply with Dutch tax and accounting obligations (Belastingdienst).
- Newsletter subscribers — retained for as long as you remain subscribed. If you unsubscribe, we remove your data within 30 days.
- Enquiries & correspondence — general enquiries are retained for up to 2 years, then deleted unless an ongoing relationship exists. Communication related to payments and transactions is retained for 7 years in accordance with Dutch tax and accounting law (Belastingdienst).
- Analytics data — retained according to Squarespace's default settings (typically 26 months).
After the relevant retention period, your data is securely deleted or anonymised.
As a resident of the European Union, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention obligations.
- Right to restriction of processing — ask us to pause processing your data in certain circumstances.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us using the details in Section 09. We will respond within 30 days.
We take reasonable technical and organisational measures to protect your personal data against loss, misuse, or unauthorised access. Our website uses HTTPS encryption. Payments are handled entirely by Stripe using industry-standard security measures including TLS encryption and PCI-DSS compliance.
No method of transmission over the internet is 100% secure, but we continually work to ensure your data is handled responsibly.
We may update this privacy statement from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.
For significant changes, we will take reasonable steps to notify you — for example, by sending an email to newsletter subscribers.
If you have questions about this privacy statement, or wish to exercise your rights, please contact us:
Clay Studio Leiden
Haagweg 4/F14
2311 AA Leiden, Netherlands
Email: workshops@claystudioleiden.com
KVK number: 65568036
If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens (AP)
www.autoriteitpersoonsgegevens.nl
Tel: +31 (0)70 888 85 00