Legal slate
Privacy notice
Last updated
This notice explains how ASSI Studio (trading as ASSI Studio) handles personal data when you visit this website, send a project brief, email us, or ask to reserve the studio. It is written for the General Data Protection Regulation (GDPR), called the AVG in the Netherlands.
Controller and privacy contact
The controller is ASSI Studio, established at Utrecht, Netherlands. The full registration and contact record is on the company details page. Privacy requests can be sent to info@assistudio.nl. We have not appointed a data protection officer for the limited processing described here.
What we process and why
Project and studio enquiries
Data: name, email address, production need, brief, booking details, and later correspondence you choose to provide.
Purpose and basis: to answer, prepare a quote, arrange a studio intake, and take steps you request before a contract (Article 6(1)(b) GDPR). When a person contacts us for an organisation, we also rely on our legitimate interest in communicating with that organisation (Article 6(1)(f)).
Retention: an enquiry that does not become a project is deleted 12 months after the last substantive contact. If work goes ahead, contract, invoice, and essential project administration may be retained for 7 years where Dutch tax or legal record-keeping rules require it. Other production material follows the agreed project and archive terms.
Contact-form abuse prevention
Data:a keyed one-way hash derived from the connection IP address, plus submission timestamps. The raw IP address is not written to the form's rate-limit file.
Purpose and basis: to prevent spam and keep the contact channel available, based on our legitimate security interest (Article 6(1)(f)).
Retention: an entry stops affecting requests after 24 hours. Expired entries are erased when the private rate-limit store is next opened or by scheduled server maintenance. The store must remain outside the public website directory.
Website delivery and security logs
Data: the hosting provider may receive IP address, request time, requested path, referrer, browser information, and error or security events as part of ordinary web delivery.
Purpose and basis: to deliver and protect the site, diagnose faults, and investigate abuse, based on our legitimate operational and security interests (Article 6(1)(f)).
Retention:logs are kept only for the production host's documented security and fault-diagnosis period, then deleted or anonymised. The owner must confirm that exact period against the live hosting contract before publication.
Required information and free text
The marked contact-form fields are required because we cannot answer or scope the requested work without them. Using the form is optional; you can email us directly instead. Do not include identity documents, payment-card data, health information, or other sensitive personal data in the brief unless we specifically ask for it through an appropriate channel.
Recipients and external services
We do not sell personal data. Access is limited to ASSI Studio and service providers that are needed to run the website and mailbox, such as the hosting and email providers. We require processors to protect the data and use it only on documented instructions. A professional adviser, insurer, production supplier, or public authority receives data only where it is necessary for the project, a legal claim, or a legal obligation.
Scene images, reel video, fonts, and interface code are served from the ASSI Studio website. The current studio CTA is a direct email link. No external booking provider script, frame, storage, or request loads from this site.
International transfers
Where a provider processes personal data outside the European Economic Area, we use an applicable adequacy decision or approved safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required. The deployed hosting, mail, and booking contracts must be checked against this statement before the legal draft is approved.
Cookies and similar storage
The current site does not use optional cookies, analytics, advertising pixels, fingerprinting, local storage, or session storage. That is why no consent banner appears. The verified inventory and the rule for any future optional technology are set out in the cookie and storage notice.
Your rights
Depending on the processing and legal basis, you can request access, correction, deletion, restriction, or portability of your personal data. You can object to processing based on legitimate interests. If we ever rely on consent, you can withdraw it at any time without affecting earlier lawful processing. We do not use enquiry data for automated decisions, profiling, or direct marketing.
Email info@assistudio.nl to exercise a right. We may ask for proportionate identity verification and normally respond within one month. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the authority where you live or work.
Changes to this notice
We update this notice when the website, providers, or processing changes. Material changes are dated at the top. A new optional tracker or embedded service will not be enabled until its notice and, where required, prior consent controls are in place.