STstudio (생태제작소) Privacy Policy

Effective 17 September 2026 · Version 1

This policy explains how STstudio (생태제작소), run by Yirang Ok (“the studio”, “we”), handles personal data through the website www.ststudio.co.kr, its contact form and the address contact@ststudio.co.kr. It is written to meet Article 13 of the EU General Data Protection Regulation (GDPR) and Article 30 of the Korean Personal Information Protection Act (PIPA); the Korean version is equally complete. We process only the data we need, we do not advertise, and we do not sell personal data.

1. Who is responsible
2. What we process, why, and on what legal basis
3. How long we keep it
4. How we delete it
5. Sharing with third parties
6. Service providers (processors)
7. Transfers outside the EU and Korea
8. Cookies and similar storage
9. Information external services receive directly
10. Security
11. Your rights
12. Privacy contact
13. Complaints
14. Other information
15. Changes to this policy

1. Who is responsible

• Controller: Yirang Ok (옥이랑), trading as STstudio (생태제작소) — a sole proprietorship (eenmanszaak) in the Netherlands and an individual business (개인사업자) in Korea
• Netherlands: · KvK 98086030 · VAT ID NL005307209B29
• Korea: · business registration no. 398-55-00964
• Email: contact@ststudio.co.kr

We work from the Netherlands and Korea and follow both the GDPR and the Korean PIPA. We have not appointed a data protection officer, because the GDPR (Article 37) does not require one for a studio of this kind; the privacy contact in section 12 handles all privacy questions.

2. What we process, why, and on what legal basis

We use personal data only for the purposes below. If a purpose changes, we will first take the steps the law requires.

a. Processing that does not rely on consent

Where we rely on legitimate interest, we have weighed it against your rights and kept the processing to what the purpose needs. You can object to it at any time (section 11).

b. Processing based on your consent

Google Analytics is loaded only after you press “Allow” in the cookie notice; until then nothing is sent to Google. Declining does not limit your use of the site in any way. We have switched off Google signals (cross-device tracking) and ad personalisation.

3. How long we keep it

4. How we delete it

When data reaches the end of its retention period or is no longer needed, it is deleted without delay. The owner identifies and deletes it personally: electronic files (email, records at the form provider, server files) are deleted so they cannot be recovered, including emptying the trash, and printouts are shredded. Records the law requires us to keep are stored separately from other personal data.

5. Sharing with third parties

We do not give personal data to third parties, except where the law requires it.

6. Service providers (processors)

Each provider is bound by its data processing terms, which limit use to our instructions and require appropriate security. If a provider changes, we update this policy.

7. Transfers outside the EU and Korea

Because we work from both the Netherlands and Korea and use the providers above, personal data is transferred across borders as follows. Every transfer is an encrypted transmission over the internet (HTTPS/TLS).

How to refuse, and what happens: you can stop the Google Analytics transfer by pressing “Decline”, with no disadvantage. The transfers for the contact form and email are needed to receive and answer an enquiry, so without them we cannot receive your message; write to us and we can agree another way to talk. You can ask us for a copy of the safeguards at contact@ststudio.co.kr.

8. Cookies and similar storage

A cookie is a small file a website stores in your browser; local storage (localStorage) is a similar way to keep a setting in your browser. This site uses:

Local-storage values stay on your device and are never sent to our server. The today’s-visitor dots and the server logs use no cookies.

Refusing or withdrawing. Press “Decline” in the notice on your first visit, or change your choice at any time with “Cookie settings” at the bottom of every page. Withdrawing consent also deletes the _ga cookies; it does not affect processing that happened before.

Open cookie settings

You can also delete or block cookies and site data in your browser settings (menu names vary by version): Chrome — Settings › Privacy and security; Edge — Settings › Cookies and site permissions; Safari on Mac — Settings › Privacy › Manage Website Data; Safari on iPhone — Settings › Apps › Safari › Clear History and Website Data; Firefox — Settings › Privacy & Security › Cookies and Site Data; Samsung Internet — Settings › Privacy and security › Delete browsing data. The site keeps working if you block cookies.

9. Information external services receive directly

These services do not receive data from us. When a page opens, your browser fetches a typeface or video from them and in doing so sends them some information directly. We do not receive that information, and neither we nor they use it here to identify you or for targeted advertising. Under the GDPR we are jointly responsible with them for that transmission.

If you prefer, you can block these services with a browser extension; some typefaces or videos may then not appear. Adobe and Vimeo are certified under the EU–U.S. Data Privacy Framework.

10. Security

• Organisational: only the owner has access to personal data, and data past its retention period is deleted.
• Technical: the website and the contact form are served over HTTPS. The today’s-visitor feature stores only a keyed hash of the IP address, in a folder that cannot be reached from the web. To reduce transfers, the Jost and Space Mono typefaces and the three.js script are served from our own server, and the statistics tool is not loaded before consent.

11. Your rights

You can ask us at any time to:

• give you access to your personal data, correct it, delete it, or restrict its processing;
• stop processing that relies on legitimate interest (objection);
• give you the data you sent through the contact form in a portable format;
• and you can withdraw consent at any time, without affecting processing before the withdrawal.

Email contact@ststudio.co.kr. We confirm who you are and reply within 10 days (and never later than one month). Someone acting for you can make the request with written authorisation. Server logs and today’s-visitor records carry no names, so to find them we need the date of your visit and your IP address. If the law limits a request, we tell you why and how to challenge the decision. Statistics consent can be withdrawn immediately under “Cookie settings”.

12. Privacy contact

Yirang Ok, owner, is responsible for personal data at the studio and handles questions, complaints and access requests: contact@ststudio.co.kr.

13. Complaints

You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl), or to the authority in the EU/EEA country where you live or work. In Korea you can contact the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Privacy Infringement Report Center at KISA (118, privacy.kisa.or.kr), the Supreme Prosecutors’ Office (1301, spo.go.kr) or the National Police Agency’s cyber crime reporting system (182, ecrm.police.go.kr).

14. Other information

• Nobody is required to give us personal data. To answer an enquiry we need a name, an email address, the enquiry type and a message; without an email address we cannot reply.
• The website is not aimed at children under 14, and we do not knowingly collect their data.
• We do not process special categories of data or national identification numbers.
• We make no automated decisions and build no profiles.

15. Changes to this policy

This is the first version, effective 17 September 2026. If it changes, we will announce the change on this page before it takes effect and publish what changed together with the previous version.