Privacy statement
This statement explains which personal data MAAS·studios processes via this website and during projects, for what purpose, and which rights you have under the General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is MAAS·studios, a trading name of Prime Invest B.V., established at Rotterdam.
- Chamber of Commerce (KvK) no.: 93607083
- VAT no.: NL866466095B01
- Privacy contact: privacy@maas-studio.nl
2. Which data we process
Via the contact/audit form and email contact:
- Name and email address;
- (Optional) company name, phone number and the address of your current website;
- The content of your message.
Automatically on visiting the site: technical data such as IP address (truncated/anonymised where possible), browser type and pages visited, in server logs and functional cookies. See the cookie policy.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Responding to your request, preparing an audit/quote | Performance of a (pre-)contract, art. 6(1)(b) |
| Carrying out an assignment / project | Performance of a contract, art. 6(1)(b) |
| Sending the free website-check report or the checklist download | Performance of a (pre-)contract, art. 6(1)(b) |
| Marketing email (occasional tips about your website) | Consent, art. 6(1)(a) |
| Security and proper functioning of the website | Legitimate interest, art. 6(1)(f) |
| Statutory administration (invoices) | Legal obligation, art. 6(1)(c) |
We only send marketing email if you have ticked a separate, voluntary box for it — never automatically just because you requested a report or download. You can withdraw this consent at any time via the unsubscribe link at the bottom of every marketing email, as easily as you gave it.
4. Cookies
This website uses functional storage and, only with your consent, one marketing cookie to measure which source brings visitors to the site. No advertising cookies, no fingerprinting. Details are in the cookie policy.
5. Recipients and processors
Your data is not sold. We engage carefully selected processors under a data processing agreement (GDPR art. 28):
- Vercel Inc. — hosting provider (servers in Frankfurt, Germany/EU) and, via the same provider, Vercel Web Analytics: anonymised visitor statistics without cookies, not traceable back to you personally (see the cookie policy);
- Email and form handling;
There is also one recipient that is not a processor:
- Mollie B.V. (Amsterdam) — payment service provider. If you pay online, for example for the 24-hour Sitefix, Mollie processes your payment details. For executing and settling that payment Mollie is an independent controller under the law; Mollie's own privacy policy applies. From Mollie we only receive whether the payment succeeded, the amount and a transaction reference — never your full account or card number. Legal basis: performance of the contract (GDPR art. 6(1)(b)). Payment and invoice data are kept for 7 years under the Dutch statutory retention obligation (art. 52 AWR).
6. International transfers
We process within the EEA by preference. If a specific service nonetheless processes outside the EEA, this only happens on the basis of an adequacy decision or the European Commission's Standard Contractual Clauses (SCCs).
7. Retention periods
- Requests that don't lead to an assignment: up to 12 months, then deleted;
- Project data and correspondence: during the assignment and 24 months after;
- Invoices and administration: 7 years (statutory tax retention);
- Marketing consent: until you unsubscribe or up to 24 months after the last marketing email;
- Server logs: short-lived, usually a few weeks.
8. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection. Send your request to privacy@maas-studio.nl; you'll get a reply within 30 days. If you disagree, you can lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
9. Security
We take appropriate technical and organisational measures: encryption via HTTPS/SSL, restricted access and regular updates. In the event of a data breach with risk, we report it within 72 hours to the Data Protection Authority and, where required, to you.
10. Changes and contact
We may update this statement; the current version is always at https://maas-studio.nl/en/privacy. Questions? Email privacy@maas-studio.nl.