What I do with your data.

Who is responsible for your data?

Aivion Studios B.V., registered at Krakelingweg 103 in Zeist, the Netherlands, is responsible for the processing of personal data described below. Questions or requests can be sent to mail@aivionstudios.nl. You get a personal answer, not a ticket number.

This policy covers this website, aivionstudios.nl. The Aivion Studios products run on their own domains and each get their own policy when they launch. BankBird is open source and installed on your own server, so none of that data ever reaches Aivion Studios.

What data is processed

This site collects nothing on its own. There are two moments where data does come in.

The contact form. You fill in your name, your email address and your message yourself. There are no other fields. Those three details arrive by email at Aivion Studios, and you receive a confirmation at the address you entered.

A brake on that same form. To stop it being abused for spam there is a limit of five messages an hour. To count that limit your IP address is written to the server in encrypted form, together with the timestamp. That small file is deleted automatically once the hour has passed. Nothing is linked to it, and no browsing behaviour is tracked with it.

Why, and on what basis

What you type into the form is used solely to answer your message and, where there is reason to, to discuss working together. The basis is your own request: you send the message yourself and tick that you agree to this policy.

Temporarily keeping an encrypted IP address rests on legitimate interest. A public form without a brake gets found by spammers within a week.

Nothing is used for profiling, advertising or automated decision-making.

How long it is kept

Messages are kept for as long as needed to handle your question and allow any follow-up. Once a conversation is finished and no follow-up is expected, the message goes. There is deliberately no fixed period: a quote that goes ahead a year later is normal, and keeping a message for three years without reason is not.

The encrypted IP address behind the spam brake disappears after an hour at most, automatically.

If you want a message gone sooner, just ask. That is easily arranged.

Who else sees the data

Data is not sold and not shared for marketing purposes. Some parties are needed to run a website and email. They process only what that service requires:

• Hetzner Online GmbH provides the servers this site runs on, and the first backup. Those servers are in Helsinki and Nuremberg, both within the EU.
• Vimexx and TransIP, both based in the Netherlands, handle email traffic, including the messages from the contact form.
• Wasabi Technologies handles the second, offsite backup. It sits in the Amsterdam region and therefore stays within the EU. Wasabi does have a US parent company, so the processing also rests on the European Commission's standard contractual clauses.

A data processing agreement is in place with Hetzner, stating that they may only process the data to deliver the service and may do nothing else with it. Beyond that, data may be shared where the law requires it.

What this site does not do

There are no trackers, no analytics, no ad networks and no social media pixels on this site. There is no embedded video, map or timeline either. Everything your browser loads comes from aivionstudios.nl itself: the typefaces and the music playlist images sit on the same server. No other party learns about your visit.

That is a deliberate choice. Loading typefaces from an external service looks harmless, but sends your IP address to that party on every page you open.

Security

The site is only reachable over an encrypted connection. The servers are kept up to date with security patches, and a backup is made every day: one at the hosting provider and one offsite, both within the EU.

Your rights

You have the right to see your data, have it corrected, have it deleted or have it transferred. You can also object to the processing or withdraw consent you gave. Send a message to mail@aivionstudios.nl. You get an answer within a month, in practice much sooner.

If we cannot resolve it together, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

If anything changes in how this site handles data, this policy is updated. The date at the top of this page shows when that last happened.