Privacy and cookie policy
This page explains what personal data we collect when you visit creatyvestudio.com, why we collect it, how long we keep it, and what you can ask us at any time.
We wrote it to be read. If something is still unclear after reading it, write to us: answering that question is part of our job, not a favour.
1. Who processes your data
The data controller is:
- Legal name
- CreatyveStudio AI OÜ
- Estonian business registry code
- 17495939
- EU VAT number
- EE102989582
- Registered office
- Järvevana tee 9, Tallinn, 11314, Estonia
- Email for data protection requests
- info@creatyvelab.com
CreatyveStudio AI OÜ is a company incorporated in Estonia. Creatyve Studio is the name it trades under. We state this plainly because it tells you who you are dealing with and which authority supervises the processing.
We have not appointed a Data Protection Officer. For any request about your data, the address above is the correct and only channel.
2. What we collect
a) Navigation data (server and CDN technical logs)
Like every website, the systems that deliver these pages record technical information needed to do so and to protect the site from abuse: IP address, date and time of the request, the address of the page requested, browser and device type, server response code. This data is not used to identify or profile you.
b) Statistical data collected through Google Analytics 4, only with your consent
If you accept statistical cookies, Google Analytics 4 collects: pages visited and the order you visited them in, time on site, the site or search engine you came from, device type, browser, language, screen resolution, approximate location derived from your IP address (typically city or region level), and a random identifier stored in a cookie that recognises your browser across visits.
If you decline, Google Analytics is not loaded and none of this data is collected. Not a reduced version: no collection at all.
c) Data you send us
When you write to us, by email or through the contact form, we process what you send: your name, your email address and the content of your message. The form stores nothing on the site: it forwards the message to our mailbox through the Resend email delivery service.
3. Why we process it, and on what legal basis
| What we process | Why | Legal basis (GDPR) |
|---|---|---|
| Navigation logs | Serve the pages, keep the site secure and available, diagnose faults | Legitimate interest, Art. 6(1)(f): running and protecting our own website |
| Statistical cookies and Google Analytics 4 data | Understand which content is read, and improve it | Your consent, Art. 6(1)(a), and Art. 122 of the Italian Privacy Code for storage on your device |
| Messages you send us, by email or through the contact form | Reply to you and, if something comes of it, discuss working together | Responding to your request, Art. 6(1)(b), pre-contractual steps |
We do not process special categories of data (Art. 9 GDPR) and we do not ask you for any. We do not buy contact lists and we do not add you to anything you did not ask for.
4. Cookies: the complete list
A cookie is a small file a website stores in your browser. This site uses only two kinds.
Technical cookies, no consent required
| Name | Purpose | Duration |
|---|---|---|
cs_consent | Remember the choice you made on the banner, so we do not ask again on every page | 6 months |
NEXT_LOCALE | Remember whether you prefer Italian or English | Until you close the browser |
Statistical cookies, set only after you consent
| Name | Set by | Purpose | Duration |
|---|---|---|---|
_ga | Tell one browser from another using a random identifier | 2 years from last visit | |
_ga_<ID> | Maintain browsing session state | 2 years from last visit |
We do not use advertising or profiling cookies, remarketing tags, social network pixels, heatmaps or session recording. If that ever changes, this page changes first, not afterwards, and the banner will ask you again.
5. Who else sees your data
No data is sold, traded or shared. Only the providers that keep the site running have access, each bound by a contract under Art. 28 GDPR:
| Provider | Role | Where data is processed |
|---|---|---|
| Amazon Web Services | Hosting and content delivery network (CloudFront) | European Union, with possible points of presence outside the EU |
| Google Ireland Limited / Google LLC | Visit statistics (Google Analytics 4) | European Union and United States |
| Google Ireland Limited / Google LLC | Email (Google Workspace): receiving and storing the messages you send us | European Union and United States |
| Resend, Inc. | Forwarding contact form messages to our mailbox | United States |
We disclose data to anyone else only where the law or an authority requires it.
6. Transfers outside the European Union
Google Analytics 4, Google's email service and Resend may involve transferring data to the United States. We say so without hedging, because this is the point you have the most right to be told about.
The transfer relies on the adequacy decision adopted by the European Commission on 10 July 2023 regarding the EU-US Data Privacy Framework, under which Google LLC and Resend are certified, supplemented by the standard contractual clauses under Art. 46 GDPR as an additional safeguard. In our Google Analytics 4 configuration, your IP address is not recorded or stored: it is used transiently to derive an approximate location and then discarded.
If you are not comfortable with this, decline statistical cookies on the banner. The site works exactly the same way.
7. How long we keep data
| Data | Retention |
|---|---|
| Server and CDN technical logs | As long as strictly needed to keep the site running and secure, as configured by the hosting provider |
| Google Analytics 4 data | 2 months |
| Cookies | The durations listed in section 4 |
| Messages you send us | As long as needed to reply and to manage any relationship that follows, and no longer than applicable legal retention periods |
8. Your rights
You can exercise the rights under Articles 15–22 GDPR at any time:
- know whether we process your data and get a copy of it (access);
- correct inaccurate or incomplete data (rectification);
- have it erased;
- restrict processing;
- receive it in a machine-readable format or have it transferred elsewhere (portability);
- object to processing based on legitimate interest;
- withdraw your consent to statistical cookies whenever you want, without affecting the lawfulness of processing carried out before you withdrew it.
Write to info@creatyvelab.com. We reply within one month, as Art. 12 GDPR requires. We will not ask you to fill in a form and we will not ask you to justify the request.
9. Complaining to a supervisory authority
If you believe the processing of your data breaches the GDPR, you can lodge a complaint with a supervisory authority. Because the controller is established in Estonia, the lead authority is the Estonian one; if you live or work in Italy, you can also go to the Italian authority: that is your right, not a courtesy.
| Authority | When | Where |
|---|---|---|
| Andmekaitse Inspektsioon, Estonian Data Protection Inspectorate | Lead supervisory authority for the controller | aki.ee |
| Garante per la protezione dei dati personali, Italy | If you live, work, or the alleged breach occurred in Italy | garanteprivacy.it |
If you are in another EU or EEA country, you may also contact your national data protection authority. You can also bring the matter before a court.
10. Automated decisions and minors
We do not make automated decisions producing legal effects concerning you, and we do not carry out profiling (Art. 22 GDPR).
This site is aimed at businesses and professionals. It is not directed at anyone under 16 and we do not knowingly collect their data.
11. How to withdraw cookie consent
Three ways, all effective:
- On this site: click «Cookie preferences» at the bottom of any page and choose «Decline». Any Google Analytics cookies already stored are deleted.
- In your browser: delete cookies already stored and block future ones in your browser settings.
- With Google's add-on: Google provides a browser extension that disables Google Analytics on every site you visit.
12. Changes to this policy
If we change the tools we use or the purposes of processing, we update this page and change the date at the top. If a change concerns processing that requires your consent, we will ask you again: we do not treat consent given for one thing as consent for another.