Privacy notice

What we do with your data

Last updated 30 October 2026

This notice explains which personal data Dara Web Studio collects through darawebstudio.com, the contact form and our emails, why we use it, and what rights you have under the General Data Protection Regulation (GDPR).

Dara Web Studiothe Netherlands[email protected]

  • No analytics
  • No tracking cookies
  • No advertising trackers
  • We never sell your data

1Who we are

1.1

Dara Web Studio ("dara.", "we") is a small web studio in the Netherlands. We are the controller for the personal data described in this notice.

1.2

Our details: Dara Web Studio, a web studio based in the Netherlands. Email [email protected]. Our postal address and Netherlands Chamber of Commerce (KvK) number will be added here once registration is complete.

1.3

This notice does not cover personal data we process for our clients, for example messages sent through a client's website that we host. For that data the client is the controller and we act as processor. The client's own privacy notice applies.

2What we collect

2.1

The contact form. When you send a request, we store in a Cloudflare D1 database:

  • your name and email address;
  • your business or project name, if you give it;
  • your message;
  • the country your request came from and your browser type, which we use to fight spam.
2.2

Email. Your email address, your name and whatever you write or attach when you email us.

2.3

Previews and projects. Information about your business, and the texts, photos, logos and other files you send us, plus any access details you share with us for your domain or other accounts.

2.4

Payments. PayPal handles payments. We receive your name, email address, the amount, the date and the transaction reference. We never see your card or bank details.

2.5

Technical data. When you visit our website, your browser sends your IP address and basic request details to Cloudflare, which hosts the site, and to Google, which serves the fonts. This is needed to show the page and protect it from attacks.

2.6

We do not ask for special categories of personal data, such as health information. Please do not send them to us.

3Why, and on what legal basis

3.1

We only use your data for the purposes below. Each purpose has a legal basis under article 6(1) of the GDPR.

Reply to your request and prepare a free preview or a quote.

Art. 6(1)(b)Steps at your request before a contract

Carry out the work you order: build, deliver, host and support it, and send invoices.

Art. 6(1)(b)Performance of a contract

Keep invoices and payment records for 7 years, as Dutch tax law requires.

Art. 6(1)(c)Legal obligation

Fight spam and abuse on the contact form, using the country and browser type of a request, and keep our website secure.

Art. 6(1)(f)Legitimate interest in a safe, working website and inbox

Show our website in its fonts, which your browser loads from Google Fonts.

Art. 6(1)(f)Legitimate interest in a readable, consistent website

Show finished work in our portfolio, unless the client objects.

Art. 6(1)(f)Legitimate interest in showing our work

Handle disputes, such as unpaid invoices or legal claims.

Art. 6(1)(f)Legitimate interest in protecting our rights

3.2

Where we rely on a legitimate interest, we have weighed it against your interests and rights. You can object at any time, see section 8.

3.3

If you do not give us the data we need for a quote or an agreement, we cannot do the work.

3.4

We never sell your data, never add you to a newsletter without asking, and do not use automated decision-making or profiling.

4Who receives it

4.1

We share your data only with these companies, and only as far as they need it:

Cloudflare, Inc. United States

Hosts our website on Cloudflare Pages and stores contact form requests in its D1 database. Cloudflare acts as our processor.

Google LLC United States

Serves the fonts on our website through Google Fonts. Your browser connects to Google when a page loads.

Resend United States

May send emails for us, such as replies and confirmations. Resend acts as our processor.

PayPal (Europe) S.à r.l. et Cie, S.C.A. Luxembourg

Handles payments. For the payment itself PayPal is an independent controller, and its own privacy statement applies.

4.2

We have agreements with our processors that oblige them to protect your data and use it only for us.

4.3

We may also give data to the Dutch Tax and Customs Administration (Belastingdienst), a court or another authority when the law requires it.

5Transfers outside the EU

5.1

Cloudflare, Google and Resend are based in the United States, and PayPal may also process data there. Your data can therefore be transferred outside the European Economic Area.

5.2

We only allow this with proper safeguards: the EU–US Data Privacy Framework, where the company is certified under it, or the standard contractual clauses approved by the European Commission.

5.3

Email us if you want more information about these safeguards.

6How long we keep it

6.1

Requests that do not become a project are deleted within 12 months.

6.2

Client records are kept for as long as we work together. After that we delete them, except what we must keep by law or need to handle a dispute.

6.3

Invoices and payment records are kept for 7 years, because Dutch tax law requires it.

7Security

7.1

We protect your data with appropriate technical and organisational measures. Our website uses encrypted connections (HTTPS), access to your data is limited to the people who need it, and we only work with established providers.

7.2

No system is completely secure. If a data breach is likely to put your rights at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours and inform you when the law requires it.

8Your rights

8.1

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • correct data that is wrong or incomplete;
  • delete your data;
  • restrict how we use your data;
  • receive your data in a common format, or have it sent to someone else (portability);
  • object to our use of your data based on a legitimate interest;
  • withdraw your consent at any time, where we asked for it. This does not affect what we did before.
8.2

To use your rights, email [email protected]. We may ask you to confirm your identity. We answer within one month. If a request is complex, we may extend this by two more months and tell you why.

8.3

Using your rights is free. Some rights have limits, for example when the law requires us to keep invoices.

9Cookies

9.1

We do not use analytics, advertising trackers or tracking cookies, so we do not show a cookie banner.

9.2

Our hosting provider Cloudflare may place a strictly necessary security cookie to tell real visitors apart from bots. It is not used to track you.

10Children

10.1

Our website and services are not aimed at children under 16. We do not knowingly collect their personal data. If you believe a child has sent us data, email us and we will delete it.

11Changes to this notice

11.1

We may update this notice when our services or the law change. The date at the top shows the latest version. If a change matters for our clients, we tell them by email.

12Contact and complaints

12.1

Questions or concerns about your data? Email [email protected]. We would like to solve any problem with you first.

12.2

You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl, or to the data protection authority in the EU country where you live or work.

Questions about your data?

Email [email protected] and we answer within one month.

Dara Web Studio, the Netherlands.