Last updated: 7 September 2026
1. About this policy
This policy explains how I collect, use and protect personal data in Studio A's business. It applies to you if you visit bystudioa.se, send me an enquiry, engage me for a project, or work with me as a supplier or contractor.
I collect only what I need. I never sell data on.
2. Data controller
Studio A AB
Company registration number: 559028-1530
Regementsgatan 19, Malmö, Sweden
Email: info@bystudioa.se
Telephone: +46 70 585 60 29
Studio A AB is the data controller. I, Ayse Özen, am the person who handles the data in practice. Studio A has no appointed data protection officer, and none is required for a business of this size. You can reach me directly at the details above.
3. What data I process and why
3.1 You visit the website
Data: IP address, approximate location, browser, device, which pages you visit and for how long.
Purpose: to understand how the website is used and improve it.
Legal basis: your consent, given through the cookie banner.
Retention: up to 14 months.
Necessary cookies that make the site work and store your cookie choice are processed without consent. See section 9.
3.2 You send an enquiry
Data: name, email, telephone, and whatever you choose to tell me about your project. Often address, property type, approximate budget and timeline.
Purpose: to answer your enquiry, arrange a meeting and prepare a proposal.
Legal basis: steps taken at your request prior to entering a contract. For general questions unrelated to a project, the basis is my legitimate interest in being able to reply.
Retention: 12 months after our last contact if no engagement follows. The data is then deleted.
3.3 You become a client
Data: contact details, property or premises address, floor plans and measurements, photographs of the spaces, your preferences and the decisions made during the project, budget, contract, invoicing records and correspondence. Sometimes details about the household that affect the layout, such as the number of people, how you use the rooms, or accessibility requirements.
Purpose: to plan, design, procure and deliver the project, and to invoice and handle any complaints.
Legal basis: performance of our contract. For accounting records, the basis is legal obligation.
Retention: for the duration of the project and afterwards for as long as needed to handle complaints and any disputes. For projects involving buildings this is normally ten years after completion. Accounting records are kept for seven years under the Swedish Accounting Act.
In a project I often process details about people other than you, such as someone living in the property or someone else involved in the decisions. The duty to inform that person is mine, not yours. When a project starts I therefore send this policy to the named person, so they know what details I hold and what rights they have. Just tell me who it concerns and I will take care of it.
3.4 You represent a supplier, contractor or partner
Data: name, role, email, telephone and company details.
Purpose: to order, coordinate and follow up work and deliveries on live projects.
Legal basis: performance of a contract, or my legitimate interest in running project coordination.
Retention: for the duration of the working relationship and three years afterwards. Accounting records seven years.
3.5 You follow or contact me on social media
Data: your username and the content of what you send me.
Purpose: to reply.
Legal basis: my legitimate interest in responding to people who get in touch.
Note that Meta is the controller for the platform itself. Their processing is governed by their own terms.
4. Photographs and publishing projects
Finished projects are my most important marketing material. Your home is also private. So the following applies.
I photograph and document during the project for my own working purposes, for example as a basis for drawings, material choices and orders. This forms part of the engagement.
I never publish images of your home on the website, on social media, in award entries or in any other marketing material without your written consent. That consent is given separately, not by your accepting this policy.
You set the scope in the consent itself. You can allow publication without the address or town being named. You can allow certain rooms and not others. You can allow the website but not social media.
You may withdraw your consent at any time. I will then remove the images from my own channels as soon as practicable. Material already published in print or shared onward by others cannot always be recalled, which is worth knowing before you give consent.
Legal basis: your consent. Retention: until you withdraw consent.
5. Who I share data with
I share data only where it is needed to deliver a project or run the business.
Contractors and tradespeople. Carpenters, electricians, plumbers, painters and others working on your project receive the details they need, usually name, address, contact details and the relevant drawings.
Suppliers. Furniture, lighting and material suppliers receive the delivery address and contact details for orders placed for your project.
Accountant and auditor. For invoicing and bookkeeping.
IT suppliers. The services I use to run the business, listed in section 6.
Public authorities. Where I am required by law to disclose information.
I never release your data for anyone else's marketing.
Suppliers that process personal data on my behalf do so as processors, under agreements governing how the data may be handled. Contractors and suppliers that decide on their own processing are separate controllers in their own right.
6. IT services I use
Webflow. The website is built and hosted in Webflow. Contact form submissions pass through their systems.
Google Analytics 4. Visitor statistics, only after your consent.
Google Fonts and Google-hosted scripts. Typefaces and certain technical libraries load from Google's servers, which means your IP address is visible to Google.
Finsweet Cookie Consent. Runs the cookie banner and stores your choice. The script itself is served from the jsDelivr content network, which therefore sees your IP address when the page loads.
Loopia. Email hosting for bystudioa.se addresses.
Google Workspace. Email, documents and storage in my day-to-day work.
7. Transfers outside the EU and EEA
Some of the services above are operated by companies in the United States. Transfers there are made under the European Commission's adequacy decision for organisations certified under the EU-US Data Privacy Framework, or under the European Commission's standard contractual clauses together with supplementary safeguards.
You may request a copy of the safeguards applying to a particular transfer. Get in touch and I will send it.
8. Security
Studio A is a one-person practice. That means the circle of people with access to your data is as small as it can be. I am the only person with access to client material.
Drawings, photographs and project documents are stored with established cloud providers under password-protected accounts. Data is passed to contractors and suppliers only to the extent described in section 5.
No security is complete, and transmitting information over the internet is never entirely secure. Please do not send sensitive information to me by ordinary email unless we have agreed otherwise.
If a personal data breach occurs that is likely to result in a risk to you, I will report it to the Swedish Authority for Privacy Protection within 72 hours and inform you directly.
9. Cookies
A cookie is a small text file stored in your browser. The website uses the following.
Necessary cookies. Set without consent because the site needs them. fs-cc stores your choice in the cookie banner and lasts 180 days. fs-cc-updated records that an active choice was made and is set only when you accept, also 180 days. Both are set by bystudioa.se through Finsweet Cookie Consent.
Analytics cookies. Set only once you have said yes. Google Analytics 4, measurement ID G-37111QTL2L, sets _ga, which distinguishes visitors by a random ID, and _ga_37111QTL2L, which keeps track of the session. Both last 400 days. Statistics are collected through Google's EU regional collection endpoint and are not used for advertising personalisation.
You make your choice in the cookie banner on your first visit. You can change that choice or withdraw your consent at any time through the cookie settings on the website, or by deleting cookies in your browser. Every common browser has settings for blocking or deleting cookies, found under privacy settings.
Beyond these four cookies, no other storage is used in your browser. Neither localStorage nor sessionStorage is used. If you block all cookies, parts of the website will not work as intended.
10. Your rights
You have the right to:
Know what data I hold about you, and receive a copy of it.
Have inaccurate data corrected.
Have data erased, where I no longer have a right or an obligation to keep it.
Ask for processing to be restricted while a question is being resolved.
Object to processing based on legitimate interest.
Receive data you have given me in a machine-readable format, or have it transferred to someone else, where the processing is based on consent or contract.
Withdraw a consent at any time. This does not affect processing already carried out.
Contact me at info@bystudioa.se. I will reply as soon as I can and within one month at the latest. If the matter is complex I may extend that by two months, in which case I will tell you and explain why.
If you are unhappy with how I handle your personal data, you can complain to the Swedish Authority for Privacy Protection.
Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm, Sweden
imy@imy.se
imy.se
11. Changes
I update this policy when the business or the law changes. The current version is always here, and the date at the top shows when it was last amended. For substantial changes, such as new purposes for processing, I will inform those affected in advance and obtain fresh consent where needed.
12. Contact
Questions about this policy or about your data:
Ayse Özen
Studio A AB
info@bystudioa.se
+46 70 585 60 29
Separate notice about your right to object
This is set out separately because the law requires me to bring it to your attention specifically.
Where I process your data on the basis of my legitimate interest, you have the right to object to that processing at any time. This applies when I answer a general enquiry unrelated to a project, when I coordinate with suppliers and contractors, and when I reply to messages on social media. If you object, I stop processing the data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
To object, email info@bystudioa.se. It costs nothing, and you do not need to give reasons.
Information you need to provide
The fields marked * in the contact form are the ones I need in order to answer your enquiry and prepare a proposal. Without them I cannot reply. The remaining fields are optional. There is no statutory obligation to provide the information, and there is no automated decision-making or profiling in my business.
