Legal
Privacy Policy
PLACEHOLDER: template text — have it reviewed by a qualified lawyer before launch.
1. Who is responsible
VelvettaStudio (VelvettaStudio)
Sialkot, Punjab, Pakistan, Sialkot, Pakistan
Email: info@velvettastudio.com
VelvettaStudio is based in Pakistan. Because we offer our services to businesses in the European Union, we apply the principles of the EU General Data Protection Regulation (GDPR) to personal data we collect through this website.
2. What we collect
- Quote, sample and contact forms: name, company, job title, business email, phone, country, website, product requirements, and any files you upload.
- Attribution data: the page you first landed on, the referring website and campaign (UTM) parameters, so we understand which channels bring enquiries.
- Security data: a one-way hashed form of your IP address, used for spam and abuse prevention.
- Analytics (only with your consent): anonymised usage data via Google Analytics 4.
We do not ask for sensitive personal data and ask that you don’t include it in messages or files.
3. Why we use it and our legal basis
- Responding to your request and preparing quotes or samples — steps taken at your request before a contract (GDPR Art. 6(1)(b)), with your consent given in the form.
- Marketing updates — only if you tick the optional box (Art. 6(1)(a)). You can withdraw at any time.
- Analytics — only with cookie consent (Art. 6(1)(a)).
- Security and fraud prevention — our legitimate interest in protecting the website (Art. 6(1)(f)).
4. Who receives your data
Our website host and email provider (Hostinger), Google (analytics, only with consent), and — only with your agreement for a specific project — manufacturing partners who need product specifications. We never sell personal data. Contact details are not shared with workshops without your agreement.
5. International transfers
Your data is processed by VelvettaStudio in Pakistan and stored on our hosting provider’s servers. Pakistan does not have an EU adequacy decision. We transfer data to Pakistan because it is necessary to respond to your request and carry out steps you ask for (GDPR Art. 49(1)(b)), and we apply appropriate security measures. PLACEHOLDER: confirm hosting server location and transfer safeguards with your lawyer.
6. How long we keep it
- Enquiries and uploaded files: up to 24 months after our last contact, unless a business relationship follows, in which case commercial records are kept as long as legally required.
- Marketing consent: until you withdraw it.
- Rate-limit records: up to one hour.
7. Your rights
You can request access, correction, deletion, restriction, data portability, or object to processing, and withdraw consent at any time. See Data Protection & Your Rights. You may also complain to the data protection authority in your EU country of residence.
8. Security
Data is transmitted over HTTPS, stored in an access-controlled database, and uploaded files are kept outside the public website with randomised file names.