Privacy Policy

The short version

This site collects the minimum needed to answer purchase enquiries and ship ceramics: your enquiry details, your message when you write, and anonymous page statistics. There is no advertising, no third-party tracking, no profiling, and your data is never sold or shared for marketing.

Who is responsible

The data controller is Studio Esja, Iceland — reachable at studio@studioesja.com. Iceland is part of the EEA, so the GDPR applies to everything described here.

What is collected, and why

Purchase enquiries and orders. When you enquire about a piece, the studio stores your name, email address, phone number, country, delivery address, optional message, and the piece you asked about. These details are used to answer you, prepare the payment link, and fulfil the purchase if you proceed. Legal basis: performance of the contract — this is what makes it possible to pack, ship, and stand behind your order. Order records are kept for as long as bookkeeping and warranty obligations require.

Payment. If you choose to proceed, the studio sends a secure payment link by email. The payment provider processes the payment under its own privacy terms. The studio receives payment confirmation and order details, but never your card number.

Messages. If you write through the contact form or by email, your name, email address, and message are kept to answer you and for as long as the conversation is relevant. Legal basis: legitimate interest in replying to you. Nothing is added to a mailing list without your explicit consent.

Order and contact emails. Transactional emails (order confirmation, shipping notice, replies) are delivered through Resend, an email service processing the message and your address on the studio’s behalf.

Analytics. The site counts page views with a random, anonymous per-session identifier that disappears when you close the browser tab. It stores the page path and coarse location context provided by the network (country, city, time zone, and a location rounded to roughly ten kilometres) — no IP address, no fingerprinting, no cross-site tracking — and it is switched off entirely if your browser sends Do Not Track. Legal basis: legitimate interest in knowing which pages are read and roughly where visitors come from. Details are in the cookie policy.

Newsletter. Joining the studio’s letters is double opt-in: entering an address sends one confirmation email, and nothing else is ever sent unless you click it. Legal basis: your consent, which you can withdraw at any time — every letter carries a one-click unsubscribe link, and unsubscribed addresses are added to a suppression list so they are not emailed again. The same applies to Collector Access membership emails, which you join by application and can leave with one click.

Hosting. The site runs on Cloudflare Pages. Like any host, Cloudflare processes technical request data (such as IP addresses) for security and delivery, acting as a processor under its own data processing terms.

Who receives data

Only the service providers needed to run the site, each bound by data-processing terms: Cloudflare (hosting, storage), the secure payment provider named in your payment link, Resend (transactional email), and the postal or courier service that carries your parcel (name and address — they cannot deliver without it). No data is sold, rented, or shared for advertising, ever.

Your rights

Under the GDPR you can ask at any time for access to the data held about you, correction, deletion, restriction of processing, a portable copy, or object to processing based on legitimate interest. Write to studio@studioesja.com and it will be handled personally, without forms or delay. You also have the right to complain to a supervisory authority — in Iceland, Persónuvernd (the Icelandic Data Protection Authority), or the authority in your own country.

What this site does not do

No advertising networks. No social media pixels. No third-party analytics. No profiling or automated decision-making. No newsletters without your explicit, confirmed consent. No data transfers beyond the processors named above.