GDPR Compliance

Our Commitment to Data Protection

Studio Amsterdam is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and Norwegian data protection laws.

This page outlines how we comply with GDPR requirements and explains your rights regarding personal data.

Data Controller

Studio Amsterdam is the data controller responsible for your personal information.

Contact details:
Studio Amsterdam
Thorvald Meyers gate 47
0555 Oslo, Norway
[email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

Consent

When you submit an inquiry form, you provide explicit consent for us to process your contact information to respond to your request.

Legitimate Interest

We maintain project correspondence for business record purposes and to provide continuity across long-term projects.

Contractual Necessity

For active clients, data processing is necessary to fulfill service agreements and project requirements.

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You can request a copy of all personal data we hold about you. We will provide this information in a structured, commonly used format within 30 days.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request corrections.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data when it is no longer necessary for the purposes it was collected.

Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances, such as when you contest data accuracy.

Right to Data Portability

You can request your personal data in a portable format to transfer to another service provider.

Right to Object

You can object to processing of your data based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent

Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling. All project assessments and decisions involve human judgment.

How to Exercise Your Rights

To exercise any of these rights, send a request to [email protected] with:

• Your full name
• The email address associated with your inquiry or project
• Specific right you wish to exercise
• Any relevant details or time periods

We will respond within 30 days. If your request is complex, we may extend this period by up to 60 additional days and will notify you of the extension.

Data Retention

We retain personal data for the following periods:

• Inquiry data with no follow-up: 12 months
• Active project data: duration of project plus 3 years
• Completed project data: 3 years following completion
• Financial records: 5 years (legal requirement)

After these periods, data is securely deleted unless legal obligations require longer retention.

Data Security Measures

We implement appropriate technical and organizational measures to protect personal data:

• Encrypted data storage
• Access controls limiting who can view data
• Regular security assessments
• Secure backup procedures
• Staff training on data protection

Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will:

• Notify the Norwegian Data Protection Authority within 72 hours
• Inform affected individuals without undue delay if the breach poses high risk
• Provide details about the nature of the breach and measures taken

International Data Transfers

We do not transfer personal data outside the European Economic Area. All data storage and processing occurs within EEA servers.

Children's Privacy

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly.

Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the supervisory authority:

Datatilsynet (Norwegian Data Protection Authority)
Website: www.datatilsynet.no

We encourage you to contact us first so we can address your concerns directly.

Updates to GDPR Compliance

We review our data protection practices regularly and update this page as needed to reflect current procedures and regulatory requirements.