Privacy Policy

Last updated: [INSERT DATE BEFORE PUBLISHING]

Before you publish this: This policy is a starting draft, not legal advice. Several sections below have bracketed placeholders — like which email tool you use for the newsletter, or which analytics tool (if any) is installed — that need your specific details filled in. Please have a lawyer (or a qualified privacy consultant) review the final version before it goes live, especially since this covers EU/Dutch data protection law (GDPR and the Dutch UAVG), where getting it wrong carries real penalties.

The Colour Lab ("we," "us," "our") is a stop motion and photography studio based in the Netherlands. This Privacy Policy explains what personal data we collect through thecolourlab.nl, why we collect it, how we use it, and what rights you have over it — in line with the EU General Data Protection Regulation (GDPR) and the Dutch Uitvoeringswet AVG (UAVG).

1. Who we are

The Colour Lab is operated by Pooja, trading as The Colour Lab (KVK: 98413759), based in Velp, the Netherlands. For any questions about this policy or your personal data, you can reach us at createwithcolourlab@gmail.com.

2. What personal data we collect

We only collect personal data that you provide to us directly, or that is generated through your use of this website. This includes:

Enquiry and free trial forms: your name, email address, and any project details, messages, or files you choose to share with us when making an enquiry or requesting a free trial.
Newsletter sign-up: your email address, if you choose to join our mailing list.
Correspondence: if you email us directly, we keep a record of that conversation, including your email address and message content.
Basic technical data: [INSERT: if you use any analytics tool such as Google Analytics, Plausible, Fathom, etc., describe it here — e.g. "we use [tool name] to understand how visitors use our site, which may collect your IP address, browser type, device type, and pages visited." If you use no analytics at all, this section can be removed.]

We do not knowingly collect any special categories of personal data (such as health information, religious beliefs, or political opinions) through this website.

3. Why we collect it, and our legal basis

Responding to enquiries and free trial requests — legal basis: performance of a contract, or steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)).
Sending you our newsletter — legal basis: your consent (GDPR Art. 6(1)(a)), given when you sign up. You can withdraw this consent at any time (see Section 7).
Replying to direct emails — legal basis: our legitimate interest in responding to correspondence sent to us (GDPR Art. 6(1)(f)).
Basic site analytics (if applicable) — legal basis: legitimate interest in understanding and improving our website, or consent, depending on the tool used and whether it sets non-essential cookies.

4. How long we keep your data

We keep enquiry and correspondence data for as long as reasonably necessary to respond to you and, where a project goes ahead, for the duration of our working relationship plus a reasonable period afterward for accounting and legal purposes (in the Netherlands, financial records generally need to be kept for 7 years under tax law). Newsletter data is kept until you unsubscribe or request deletion.

5. Who we share your data with

We do not sell your personal data. We may share it with a small number of trusted third parties who help us run this website and our business, including:

Email newsletter provider: [INSERT NAME OF PROVIDER — e.g. Mailchimp, ConvertKit, Flodesk — once chosen. These providers act as our data processor for your email address and may store data outside the EU; reputable providers offer EU-approved safeguards such as Standard Contractual Clauses.]
Website hosting provider: [INSERT HOSTING PROVIDER NAME], who stores the website's underlying files and any form submissions technically passing through the server.
Instagram / Meta: some pages on this site display embedded Instagram posts or link to our Instagram profile. If you interact with that content, Meta's own privacy policy and cookie practices apply — we do not control what data Instagram/Meta collects through their embeds.

We only work with providers who we reasonably believe handle your data securely and in compliance with GDPR.

6. International data transfers

Some of the tools listed above may store or process data outside the European Economic Area (EEA), most commonly in the United States. Where this happens, we rely on the safeguards those providers have in place, such as Standard Contractual Clauses approved by the European Commission, to ensure your data remains protected to a standard equivalent to GDPR.

7. Your rights

Under the GDPR, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten"), where applicable.
Restrict how we process your data in certain circumstances.
Object to processing based on legitimate interest.
Data portability — receive your data in a structured, commonly used format.
Withdraw consent at any time, for anything we process based on consent (like the newsletter) — you can unsubscribe using the link in any email, or by contacting us directly.

To exercise any of these rights, email us at createwithcolourlab@gmail.com. We'll respond within one month, as required under GDPR.

You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, if you believe your data has been handled unlawfully.

8. Cookies

[INSERT: describe what cookies your site actually sets. If you use no analytics or marketing cookies and this site is purely static/informational, you can state: "This website does not use cookies for tracking or advertising purposes. Any cookies used are strictly necessary for the website to function." If you later add analytics, update this section and consider adding a cookie consent banner, which is required under Dutch/EU e-Privacy rules for non-essential cookies.]

9. Children's privacy

This website and our services are not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page will always reflect the most recent version.

12. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at createwithcolourlab@gmail.com.