Privacy policy

Who is responsible

STUDIO SEM is run by STUDIO SEM OPT. S.R.L., a company registered in Romania, which is responsible for the personal data described on this page.

Trade register number: J2025080628007
Registration code (CUI): 52741457
Registered office: B-dul Iuliu Maniu nr. 57, bl. OD16, sc. E, et. 2, ap. 188, Sector 6, Bucharest, Romania

For anything about your data, including the requests further down, email noras@studiosem.se.

When you visit the site

The site has no advertising pixels. Nothing is stored on your device before you have said yes.

To see how many people find the site and which pages get read, we use Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser and does not follow individual visitors. We see counts and pages, not people. We rely on our legitimate interest in knowing whether the site works.

The site is hosted by Cloudflare. To deliver each page and protect the site from attacks, Cloudflare handles your IP address and basic details about your browser. We do not keep any of it ourselves. We rely on our legitimate interest in a site that works and is safe.

Cookies, if you say yes

The first time you come here you get a question at the bottom of the page. Answer Accept and we use Google Analytics to see how the site is used. Answer Decline and nothing is set and nothing is sent to Google.

On a yes, two cookies are set, _ga and _ga_8VMF3QYW0X, which tell one visit from another. They last up to two years, which is Google's default. We rely on your consent and nothing else.

Your answer is kept in your browser for a year, so we do not have to ask every time. To change it, click Manage cookies at the bottom of any page. You can also clear the cookies in your browser's own settings.

Google processes the data for us and may do so outside the EU. Google LLC has certified to the EU-US Data Privacy Framework, which is what makes that transfer lawful.

The booking calendar

Calls are booked through Calendly, which sets its own cookies.

• On the services page and the clinics page the calendar only loads when you click to open it. No cookies are set before that.
• Everywhere else, booking is a plain link to Calendly's own site.

If you would rather not use Calendly, email us and we will find a time. Calendly's own terms are at calendly.com/privacy.

When you get in touch

If you use the contact form, email us, book a call or message us on Instagram, we get what you send: usually your name, your email address, your brand and your message, and for a call, the time you booked.

We use it to answer you and, if you want to work with us, to put an offer together. The legal basis is taking the steps you ask for before a possible agreement, and our legitimate interest in replying to people who write to us.

The contact form is not stored on the site. It is sent through Resend, which delivers it as an email to our inbox at Google Workspace. Messages on Instagram pass through Meta, under Meta's own privacy terms.

When we contact you first

To find businesses and creators we could work with, we note contact details they publish themselves, on their website, on Instagram or in a business register: a business name, an email address, a phone number, and sometimes the name of the person who runs it.

We do this based on our legitimate interest in offering our work to businesses. If we get in touch and you would rather we did not, say so. We stop, delete your details, and keep only your address on a do-not-contact list so it does not happen again.

When we work together

For clients and creators we work with, we keep contact details, what we agreed, and what was invoiced and paid. The legal basis is the agreement, and the accounting rules we have to follow.

In client work we also handle the client's own customers' data, mostly names and phone numbers from advertising enquiries. There the client is responsible and we only act on their instructions, under a data processing agreement signed before any work starts.

Who else handles it

A few suppliers handle data for us, and only for what we use them for:

• Cloudflare hosts the site.
• Resend delivers the contact form.
• Google Workspace holds our email and files.
• Calendly runs the booking calendar.

All four are American companies, so data may be handled in the United States. Each is certified under the EU-US Data Privacy Framework, and their data processing terms add the European Commission's standard contractual clauses on top. Ask us and we will send you the details.

We do not sell personal data, and we do not share it for anyone else's marketing. When we add a supplier that handles your data, it goes on this list.

Where we work from

We work remotely and sometimes from outside the EU, so we may open our own email and files from other countries. Only we have access, and our accounts are protected with two-factor authentication.

How long we keep it

• Messages and bookings that lead nowhere: up to twelve months, then deleted.
• Contact details we noted but never used: up to twelve months, then deleted.
• Clients and creators we work with: for as long as we work together, then as long as accounting rules require us to keep the paperwork.
• Data we handle for a client: returned or deleted within 30 days of the agreement ending, whichever the client chooses.

Resend keeps its own copy of a contact form message for 30 days, then deletes it.

Do you have to tell us anything

No. Nothing is required by law or by contract. Without an email address or a phone number, we simply cannot reply.

No decision about you is made automatically, and we do not build profiles of people.

What you can ask for

You can ask for a copy of what we hold about you, and ask us to correct it, delete it, limit how we use it, or send it to you in a format you can take elsewhere. You can also object to us using it at all. Email us. It is free, and you do not have to give a reason.

If you think we have handled your data badly, you can complain to a data protection authority. We are established in Romania, so that is ANSPDCP at dataprotection.ro. You can also go to the authority where you live: in Sweden that is Integritetsskyddsmyndigheten, at imy.se. We would rather hear it first, so we can put it right.

Changes

When this page changes, the date at the top changes with it. We will never start doing more with your data without saying so here first.