Privacy statement

01Who I am

Atelier Erfstuk is my one-woman studio in Veenendaal. I am Nicola van der Walt, and I decide what happens with your personal data. In privacy law, that makes me the controller.

Atelier Erfstuk · KvK 42215666 · BTW-id NL005591959B19 · Veenendaal, the Netherlands
artist@atelier-erfstuk.com · +31 6 4580 4292

02What I collect, and why

• When you write to me. Through the letter on my website, by email, phone or WhatsApp: your name, email address, phone number if you give it, and your message. I use it to answer you.
• When you book a conversation or a workshop. Your name and email address, your phone number if you would like me to call, the meeting place you choose (and the address, if we meet at your office or home), your answers to the booking questions and how you found me. I use it to plan, confirm and remind.
• When you fill in your list (De inventaris). Your name, email address, the pieces you tick and your notes. I use it to write your proposal.
• When you become a client. Your contact and billing details (name, business name, address, KvK and VAT number), the proposal you sign, invoices and payments, and everything we make together: your story, workshop notes, your answers to The First Turn, files and messages. I use it to do the work, to invoice, and to keep the records the law asks for.
• In your chest (De kist), the client portal. Your sign-in email address, when you sign in and with what kind of device, what you download, and what you or I place in it. I use it to share the work with you safely, and so you can see every time your chest was opened.
• When you visit my website. My web host, Cyso, keeps short technical logs (such as your IP address, browser and the time of your visit) to keep the site safe. A few small choices, such as your language, are kept in your own browser and never sent to me. The fonts come from my own website, so your visit is not shared with anyone else.

I ask only for what I need. I do not use advertising or tracking cookies, I do not build profiles, and no computer makes decisions about you.

03Why I am allowed to

• To answer you and to prepare a proposal: because you asked me to, before we agree on anything.
• To do the work: because it is needed for our agreement.
• To keep invoices and records: because Dutch law requires it.
• To keep my website and accounts safe: because I have a fair interest in it, and it protects you too.
• To show your work in my portfolio: only with your permission, which you can take back at any time.

04Who else sees it

I work alone, so I am the only person who reads your details. I use a few trusted services to do the work. Each one only gets what it needs, and works under a data processing agreement. I never sell your details or share them for advertising.

Zeeg (Germany)

Booking conversations and workshops, with confirmations and reminders.

Microsoft 365 (EU)

My email, calendar and Teams video calls.

Moneybird (the Netherlands)

Proposals, signatures, invoices and bookkeeping.

Mollie (the Netherlands)

Payments by iDEAL.

Supabase (servers in Frankfurt, Germany)

Your chest, the client portal.

Brevo (France)

Sign-in and notification emails from your chest.

Cyso (the Netherlands)

Hosting my website, and passing messages from the forms on my website, and a copy of each letter you write in your chest, straight to my mailbox. Nothing is kept on the website.

The tax authorities (Belastingdienst) can see my records when the law requires it.

05Outside the EU

Everything is stored in the European Union. Microsoft and Supabase are American companies with servers in Europe, so I use them only under a data processing agreement with the safeguards the GDPR asks for, such as the EU's standard contractual clauses.

06How long I keep it

• Messages, bookings and lists that do not lead to work: up to twelve months, then I delete them.
• Your chest: open for as long as a care plan runs. Without one, it closes three months after the handover, with a month's warning, and its contents are removed. You keep your files as downloads.
• Project files and correspondence: up to two years after we last worked together, so I can help if you have a question. Ask me to delete them sooner, and I will.
• Proposals, invoices and payments: seven years, because Dutch tax law requires it.
• Website logs: only as long as my host needs them for security, usually a few weeks.

07How I keep it safe

Security comes first in everything I make, and that includes my own studio. My accounts use two-step sign-in, everything travels encrypted, your details sit with providers in Europe wherever possible, and only I have access. If something ever goes wrong with your details, I will tell you and, where the law requires it, the Dutch Data Protection Authority.

08Your rights

Your details are yours. You can ask me to show you what I keep, to correct it, to delete it, to send it to you or someone else, to use it less, or to stop using it. Write to artist@atelier-erfstuk.com and I will answer within a month. I may ask you to confirm it is really you, so nobody else can ask for your details.

Not happy with how I handle it? Please tell me first, so I can put it right. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

09When this changes

If I start using a new service or change how I work, I update this statement and the date at the top. If a change matters for you as a client, I will tell you myself.