Privacy Policy
Yana Studio
Last updated: 5 November 2026
1. General
Yana Studio is committed to protecting personal data and processes such data in accordance with the General Data Protection Regulation (GDPR) and other applicable laws and regulations.
This Privacy Policy explains what personal data Yana Studio processes, the purposes and legal bases for such processing, the parties to whom data may be disclosed, the applicable retention periods, and the rights of data subjects.
This Privacy Policy applies to the use of the website https://yanastudio.nl/, contact and quotation requests, orders, and other communications with Yana Studio.
2. Identity and Contact Details
The data controller responsible for its own business activities is:
Yana Studio
Kleine Schelluinsekade 3
4204 TZ Gorinchem
The Netherlands
Chamber of Commerce (KvK) number: 42201417
VAT identification number: NL005578943B84
Email: yanastudio.nl@gmail.com
Telephone: +31 6 137 67 457
Website: https://yanastudio.nl/
For questions concerning this Privacy Policy or the processing of personal data, Yana Studio can be contacted using the email address provided above.
For assignments in which Yana Studio processes personal data exclusively on behalf of a business client, Yana Studio may act as a data processor. This is explained further in Section 6.
3. Categories of Personal Data
Depending on the nature of the contact, enquiry or order, Yana Studio may process the following categories of personal data.
3.1 Identification and Contact Details
First and last name;
Company name;
Name of the contact person;
Email address;
Telephone number;
Billing and delivery addresses.
3.2 Order and Design Information
Information relating to enquiries and orders;
Product types, quantities and specifications;
Logos and design files provided by customers;
Names and text to be added to products;
Design approvals;
Correspondence concerning quotations and orders.
3.3 Financial Information
Invoice details;
Bank account details, where necessary;
Payment references;
Information concerning received and outstanding payments.
3.4 Technical Data
When visiting the website, technical data necessary for providing, operating and securing the website may be processed.
Depending on the systems actually used, this may include IP addresses, browser information, device information and technical usage data.
Additional processing through analytics or marketing technologies takes place only when such technologies have been enabled and the applicable legal requirements have been met.
4. Purposes and Legal Bases for Processing
Yana Studio processes personal data only for specified purposes and on a legal basis as defined in Article 6 of the GDPR.
4.1 Contact and Quotation Requests
Personal data is processed to respond to enquiries, handle requests, prepare quotations and maintain communication regarding potential assignments.
Legal basis: Article 6(1)(b) GDPR, insofar as processing is necessary to take steps at the request of the data subject prior to entering into a contract. For certain business contact details, Article 6(1)(f) GDPR may apply, based on the legitimate interest in business communication.
4.2 Orders and Contracts
Personal data is processed to prepare designs, produce and personalise products, fulfil orders and maintain communication regarding their progress.
Legal basis: Article 6(1)(b) GDPR, insofar as processing is necessary for the performance of a contract with the data subject. For personal data relating to other individuals, such as business contact persons, the applicable legal basis is determined separately.
4.3 Payments and Administration
Personal data is processed to issue invoices, verify and record bank transfers, and comply with tax and administrative obligations.
Legal basis: Article 6(1)(b) and Article 6(1)(c) GDPR.
4.4 Shipping and Delivery
The contact and delivery information necessary to fulfil orders is processed and shared with DHL.
Legal basis: Article 6(1)(b) GDPR, for the performance of a contract with the data subject. For business contact persons, another applicable legal basis may apply depending on the circumstances.
4.5 Website Management and Security
Technical data may be processed to make the website available, monitor its operation, and prevent misuse or security incidents.
Legal basis: Article 6(1)(f) GDPR, insofar as processing is necessary for Yana Studio's legitimate interest in maintaining a secure and properly functioning website.
5. Contact Forms and Email
The Yana Studio website is built using Framer.
When a contact or quotation request form is submitted, the personal data provided is processed and stored through Framer. The form information is also forwarded to Yana Studio's business email address.
Gmail, a service provided by Google, is used to receive and process email correspondence.
This information is used to respond to enquiries, prepare quotations and fulfil potential orders.
Submitting a form does not automatically result in registration for newsletters or commercial email marketing campaigns.
6. Personal Data Received from Business Clients
Business clients may provide personal data relating to third parties, such as employees' names, for the production of personalised name badges.
Where Yana Studio processes such data exclusively on behalf of and in accordance with the instructions of the business client, the client may act as the data controller and Yana Studio as the data processor within the meaning of the GDPR.
In such cases, personal data is processed exclusively for the agreed assignment and in accordance with the applicable instructions.
Where required under Article 28 of the GDPR, the arrangements concerning data processing are documented in a Data Processing Agreement.
Responsibility for providing information to the employees concerned and determining the applicable legal basis is established in accordance with the GDPR and the actual division of responsibilities between the parties.
Personal data processed exclusively on behalf of a business client is not used for Yana Studio's own purposes without an appropriate legal basis.
7. Recipients and Service Providers
Yana Studio discloses personal data only where necessary for the provision of its services, compliance with legal obligations or another lawful purpose.
Depending on the processing activity, personal data may be accessible to:
Framer B.V. — website hosting and the processing and storage of form submissions;
Google (Gmail) — receipt and processing of business email correspondence;
DHL — shipping and delivery of orders;
Banking institutions — execution and administration of bank transfers;
Public authorities — where disclosure is required by law.
Where service providers act as data processors, the necessary contractual arrangements are established in accordance with Article 28 of the GDPR.
Yana Studio does not disclose personal data to third parties for their own independent marketing purposes.
8. Cookies and Similar Technologies
The website may use technical technologies necessary for its operation and security.
Functional cookies and similar technologies that are strictly necessary for the requested functionality may be used without prior cookie consent, provided that the applicable legal requirements are met.
Yana Studio intends to introduce Google Analytics 4, Google Ads and Meta Pixel in the future for website analytics, advertising measurement and potential marketing activities.
These services are not considered active tracking technologies solely on the basis of this intention.
Before activating non-essential tracking technologies requiring consent, Yana Studio will implement appropriate measures to:
Inform website visitors clearly in advance;
Obtain freely given, specific and informed consent;
Prevent tracking without the required consent;
Make accepting and refusing consent equally accessible;
Allow consent to be withdrawn easily.
9. Transfers Outside the European Economic Area
The use of external digital service providers, including Framer and Google, may involve the processing or transfer of personal data outside the European Economic Area (EEA).
Where a transfer within the meaning of Chapter V of the GDPR takes place, it must be based on an applicable adequacy decision or appropriate safeguards, such as approved Standard Contractual Clauses, where required.
Information regarding the applicable safeguards may be requested using Yana Studio's contact details.
10. Data Retention Periods
Yana Studio retains personal data no longer than necessary for the purposes for which it was collected, unless a legal obligation or another lawful necessity justifies a longer retention period.
The following retention periods apply.
10.1 Quotation Requests That Do Not Result in an Order
Personal data relating to enquiries that do not result in an order is retained for a maximum of 12 months after the last relevant contact.
10.2 Logos and Design Files
Logos and design files are retained for a maximum of 24 months after completion of an order, including for the purpose of facilitating potential follow-up and repeat orders.
Where personal data is processed exclusively on behalf of a business client, the applicable contractual instructions and arrangements concerning deletion or return of data apply.
10.3 Customer Correspondence
Ordinary correspondence relating to orders is retained for a maximum of 24 months after completion of the order.
10.4 Financial Administration
Basic tax and accounting records are generally retained for 7 years.
For records falling under certain European VAT One Stop Shop (OSS) schemes, a statutory retention period of 10 years may apply.
10.5 Technical Data
Technical data is retained no longer than necessary for the relevant functionality, security purposes or applicable legal obligations.
Data may be retained for longer where necessary to comply with a legal obligation, manage an ongoing dispute or establish, exercise or defend legal claims.
After the applicable retention period, personal data is deleted or anonymised unless further retention remains necessary and lawful.
11. Data Security
Yana Studio implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse and unlawful processing.
Access to personal data is restricted to individuals and service providers who require such data to perform their duties.
12. Rights of Data Subjects
Under the GDPR, data subjects have the following rights, where applicable:
Right of access;
Right to rectification;
Right to erasure;
Right to restriction of processing;
Right to data portability;
Right to object to certain processing activities;
Right to withdraw previously given consent.
Requests to exercise these rights may be submitted to:
Yana Studio generally responds within one month of receiving a request. Where permitted by the GDPR, this period may be extended. The data subject will be informed of any extension within the applicable time limit.
Where necessary, additional information may be requested to verify the identity of the individual submitting the request.
For processing activities in which Yana Studio acts exclusively as a data processor, requests are handled in accordance with the applicable arrangements with the data controller.
13. Complaints
Questions or complaints concerning the processing of personal data may be submitted to:
Data subjects also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Website: https://autoriteitpersoonsgegevens.nl/
14. Email Marketing
Yana Studio does not automatically register individuals for newsletters or commercial email marketing campaigns based on information submitted through contact forms.
Email communication is used to respond to enquiries, discuss quotations, process orders and conduct other necessary business communications.
15. Automated Decision-Making
Yana Studio does not use solely automated decision-making in handling enquiries or orders that produces legal effects concerning data subjects or similarly significantly affects them, as referred to in Article 22 of the GDPR.
Enquiries and orders are reviewed individually.
16. Changes to This Privacy Policy
Yana Studio may amend this Privacy Policy where changes in business activities, systems used or applicable laws and regulations make such amendments necessary.
The most recent version will be published at:
The date displayed at the beginning of this Privacy Policy indicates when the document was last updated.