What we collect, and what we do with it.

Who we are

STUDIO SEM is operated by our registered company in Romania, which is the controller for the personal data described on this page. Full company details are available on request at noras@studiosem.se.

You can reach us at noras@studiosem.se for anything on it, including the requests listed further down. We are not required to appoint a data protection officer and have not appointed one, so that address reaches us directly.

When you visit this site

This site runs no analytics and no advertising pixels. Most of it sets no cookies and stores nothing on your device at all.

There is one exception. Our booking page loads a calendar from Calendly, and Calendly sets its own cookies so that a booking works. It is the only third party the site loads, and it only appears on that one page. Their terms are at calendly.com/privacy. If you would rather not load it, email us instead and we will find a time by hand.

Our host keeps standard server logs, which include IP addresses, for security and troubleshooting. The legal basis is our legitimate interest in keeping the site running and safe.

Two pages link out: our booking page at Calendly, and our Instagram profile. Once you follow either link you are on their site and their privacy terms apply, not ours.

When you get in touch

If you email us or book a call, we keep what you send: your name, your email address, whatever you tell us about your business, and the time of the meeting. We keep it because we cannot have a conversation without it, and because we may want to follow it up. The legal basis is our legitimate interest in responding to people who contact us, and where a contract follows, the performance of that contract.

If we contacted you first and you would rather we did not again, reply and say so. We will stop and we will keep a note of your address for the sole purpose of not contacting it again.

When we work for you

For clients, we handle personal data belonging to their customers, mostly names and phone numbers from advertising enquiries. In that work the client is the controller and we are the processor, acting only on their documented instructions. That relationship is governed by a separate data processing agreement signed before any work starts.

Who else sees it

We use a small number of suppliers who process data on our behalf: email and file storage, a booking tool, a customer and campaign system, and a payment and invoicing provider. Each is bound by terms that limit them to what we ask of them.

Some of them are outside the EU and EEA, in particular in the United States. Where that is the case we rely on either the supplier's certification under the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. You can ask us which applies to a given supplier and for a copy of the safeguards, and we will send it.

We do not sell personal data, and we do not share it for anyone else's marketing.

Where it is processed

We work remotely and travel, which means we access our own systems from various countries. Access is limited to the two of us, protected by two-factor authentication and encrypted connections.

How long we keep it

• Enquiries that go nowhere: up to twelve months, then deleted.
• Client records: for the length of the relationship, then as long as accounting rules require us to keep the paperwork.
• Data we hold for a client: deleted or returned within 30 days of that agreement ending, whichever they choose.

Do you have to give us anything

No. Nothing on this site asks for personal data, and there is no statutory or contractual obligation to give us any. If you choose not to tell us your email address we simply cannot reply to you, which is the only consequence.

We make no automated decisions about anyone and we do not profile people. Nothing here is decided by a machine.

What you can ask for

You can ask us for a copy of what we hold about you, to correct it, to delete it, to limit what we do with it, to receive it in a portable form, or to object to us handling it at all. Email us and we will deal with it. There is no charge and you do not need a reason.

If you think we have handled your data badly you are entitled to complain to a supervisory authority. Because we are established in Romania that is the Romanian authority, ANSPDCP at dataprotection.ro. You may also complain to the authority where you live or work: in Sweden that is Integritetsskyddsmyndigheten at imy.se. We would rather you told us first so we can put it right.

Changes

If this page changes we will update the date at the top. We will not quietly broaden what we do with your data and tell you about it afterwards.