Privacy Policy

Studio AOAO is a small design studio in the Netherlands. We make sculptural lighting and ceramic objects, and we sell them directly and through galleries. This page explains what personal information we hold, why we hold it, and what you can ask us to do with it.

We have tried to write it in plain language rather than legal boilerplate. If anything here is unclear, write to us and we will explain it properly.

Who we are

Studio AOAO is the data controller for the information described here.

We do not have a Data Protection Officer. We are not required to appoint one, and for a studio of our size it would be a title rather than a role. Questions about privacy come to the same address as everything else and are answered by us.

What we collect, and why

When you send us an inquiry

Our inquiry and trade account forms ask for your name, your email address and your message, and record which piece you were looking at.

We also record how you arrived: the page you landed on, the website that referred you, any campaign tags in the link you followed, and your answer if you tell us how you heard about us. We use this to understand which of our work brings people to us. It is not used to build a profile of you and it is not shared with advertisers.

Why we may do this: to respond to your request, and because we have a legitimate interest in understanding where our inquiries come from.

When you buy a material sample

Sample orders are handled by Stripe, on Stripe's own checkout page. Stripe collects your delivery address and your payment details.

We never see or store your card number. It does not pass through our website or our systems at any point.

We pass Stripe your name, company, phone number, address, tax ID, email and any note you wrote, so that your payment and your order sit together in one record. Stripe returns the order details and the delivery address so we can send the parcel.

Why we may do this: to perform the contract you entered into when you placed the order.

When you place an order or open a trade account

For commissioned pieces and trade accounts we keep what any studio needs to invoice and deliver: contact names, email addresses, phone numbers, billing and delivery addresses, VAT or EIN numbers, the details of what you ordered, and our correspondence about it.

Why we may do this: to perform our contract with you, and to meet our legal obligations. Dutch tax law requires us to keep our business records, including invoices, for seven years.

Our correspondence with you

Email you send us is stored in our mailbox and, for clients with an open order, synced into our own systems so that the studio can see a piece and the conversation about it in one place. We store the message, its subject, who sent it and when.

We use an automated tool to read that correspondence and suggest values for the fields on an order, for example a deadline you mentioned or a purchase order number. The suggestions are always reviewed by a person before anything is recorded. Nothing about your order is decided automatically.

Why we may do this: to perform our contract with you, and because we have a legitimate interest in keeping accurate records of what was agreed.

When you visit the website

We use Umami for website statistics. It is cookieless and does not follow you between websites. It tells us which pages are read and roughly where in the world our visitors are, in aggregate. It does not tell us who you are.

This is why you will not see a cookie banner on this site.

We also use your IP address briefly when you start a sample checkout, to limit how many attempts can be made in a short time. This protects the payment system from abuse. It is not stored with your order and it is not used to identify you.

Marketing email

If you are a client, or you have asked us to keep you informed, we may write to you about new work, editions and studio news.

Every such message includes a way to stop receiving them, and you can also just reply and say so. We will not pass your address to anyone else for their own marketing, ever.

Why we may do this: your consent, or our legitimate interest in staying in touch with existing clients about work of the same kind.

What we do not collect

We think it is worth being specific, because a lot of websites are vague here.

• No advertising trackers. No Meta pixel, no Google Analytics, no advertising networks of any kind.
• No cookies for tracking. Our statistics tool sets none. The only thing stored in your browser is the list of samples you have put aside, which is what makes the basket work and is deleted when you clear it.
• No card details. These go directly to Stripe and never reach us.
• No profiling and no automated decisions. Nothing about you is decided by a machine.
• Fonts are served from our own site, not from Google, so visiting a page does not tell a third party you were here.

Who else handles your information

We use a small number of established services to run the studio. Each of them processes information only on our instructions, except where noted.

Vercel

hosts the website

Supabase

our database, where orders and client records are stored

Stripe

takes sample payments and stores the payment record

Zoho

our email

Anthropic

reads correspondence to suggest order details, as described above

Umami

website statistics

UPS

delivers parcels and provides tracking

Etsy

where some of our pieces are sold; Etsy is a separate controller with its own privacy policy

Where your information is held

Our website and database are hosted in the United States, as are Stripe and the tool we use to read correspondence. Our email is hosted in the European Union.

Transfers outside the European Economic Area are covered by the European Commission's Standard Contractual Clauses, which our providers have in place. If you would like to know more about the safeguards that apply, write to us and we will tell you.

How long we keep things

• Invoices, orders and the records behind them: seven years, because Dutch tax law requires it.
• Inquiries that do not become an order: two years, after which we delete them.
• Correspondence with clients: for as long as the relationship lasts, and then with the order records above.
• Marketing contacts: until you ask us to stop.
• Website statistics: these are aggregated and are not tied to you.

Your rights

Under the GDPR you can ask us to:

• show you what we hold about you,
• correct anything that is wrong,
• delete it, where we are not required to keep it,
• restrict or object to how we use it,
• send it to you or to someone else in a portable form,
• stop marketing to you, at any time and without giving a reason.

Where we rely on your consent, you can withdraw it at any time. That does not affect anything we did before you withdrew it.

Write to studio@aoao.nl and we will answer within one month. We will not charge you and we will not make it difficult.

If you think we have handled your information badly, please tell us first so we can put it right. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in the country where you live.

Keeping it safe

Our systems require two-factor authentication. Our database enforces access controls at the row level, so a client record can only be read by the studio. Backups are encrypted. Payment information never reaches us.

No system is perfect, and we will not pretend otherwise. If something goes wrong in a way that affects you, we will tell you.

Children

Our work is not sold to children and our site is not aimed at them. We do not knowingly collect information about anyone under 16.

Changes

If we change how we handle personal information we will update this page and change the date at the top. If a change matters to you, we will say so rather than leave you to notice.