Short, direct, and aligned with the GDPR. What we collect, why, who we share it with, and what you can do about it.
We're Studio Bast, a Belgian creative studio of two people: a psychologist-designer and a developer.
For any privacy question, write to hello@studio-bast.be. We don't have a designated Data Protection Officer; the founders handle privacy matters directly and respond within 24 hours on weekdays.
We try to keep this short.
When you fill in the contact form: your name, email address, company name (optional), a project brief, budget range, and timeline. You choose what to share. The 'name' and 'email' fields are required so we can reply.
When you visit the site with analytics enabled: pseudonymous data about which pages you view, how you got there, and how you interact with them. Collected through Google Analytics 4 and Hotjar, only after you opt in via the cookie banner.
We don't collect special category data (health, beliefs, biometrics, etc.). We don't ask you to log in or create an account.
We process your data on three legal bases under GDPR Article 6.
Contractual necessity (Art. 6(1)(b)): to respond to a project enquiry, scope a possible engagement, and stay in touch about it.
Consent (Art. 6(1)(a)): for analytics and any non-essential cookies. You can withdraw consent at any time, without affecting processing that already happened.
Legitimate interest (Art. 6(1)(f)): to operate the website itself, including security, fraud prevention, and basic server logs. Limited to what's strictly necessary.
Contact form messages: kept in our inbox for the duration of the conversation and up to two years after, then deleted unless we've started working together.
If we work together: we keep what's needed to deliver the project plus relevant accounting records. Belgian law requires keeping invoices and contracts for up to 7 years.
Analytics: per-cookie durations are listed on the cookie policy page. GA4 user-level retention is set to 14 months. Hotjar session recordings are deleted automatically after 365 days.
We use the following processors. Each has signed a Data Processing Agreement with us.
We don't sell your data, ever. We don't share it with anyone outside this list except where required by law.
Email delivery for contact form messages.
Hosting and server logs.
Content management. No end-user personal data stored.
Pseudonymous analytics. Only after consent.
Behavioural session analytics. Only after consent.
Some of our processors are based in the United States. Where personal data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework.
If you'd like a copy of the safeguards in place for a specific transfer, write to hello@studio-bast.be.
Under the GDPR you can, at any time, exercise the rights listed below.
Get a copy of the personal data we hold about you.
Correct inaccurate or incomplete data.
Request erasure of your data.
Limit how we process your data.
Receive your data in a portable, machine-readable format.
Object to processing based on legitimate interest.
At any time, without affecting earlier processing.
To exercise any of these rights, write to hello@studio-bast.be. We respond within 30 days as required by GDPR, usually much sooner.
Reasonable technical and organisational measures: encryption in transit (TLS), encryption at rest where supported by our processors, principle-of-least-privilege access controls, regular software updates, and signed Data Processing Agreements with every processor.
If we ever become aware of a personal-data breach that's likely to result in a risk to your rights and freedoms, we notify the Belgian Data Protection Authority within 72 hours and inform you directly when required.
For the full breakdown of cookies set by this site (name, provider, purpose, duration), see the cookie policy. You can review and change your consent there at any time.
Read the full cookie policyWe update this page when our practices change. The 'Last updated' date at the top reflects the most recent change. We surface material changes when you next visit the site.
For privacy questions or to exercise any of your rights: email hello@studio-bast.be or post to our studio at Allerheiligenberg 27b, 3945 Tessenderlo-Ham, Belgium.
We respond within 24 hours on weekdays for general questions, and within 30 days for formal data subject requests as required by the GDPR.
If you're unsatisfied with how we handle a request, you can file a complaint with the Belgian Data Protection Authority.