Skip to content
Legal

Privacy policy.

Last updated:

Who we are

Sorora Studio is a registered ZZP business in the Netherlands (KVK: 42052713, VAT: NL005458670B21), operated by Paulina Ambroziak (Randwijkstraat 47, 5035 AM, Tilburg). When this policy says "we" or "the studio", that's who it means. We are the controller of your personal data under the GDPR. For anything about your data, email hello@sorora.studio.

What we collect, why, and on what legal basis

We collect the minimum needed to do good work and meet our legal obligations. For each purpose, this is what we use and the legal basis in the GDPR (Article 6(1)):

When you contact us

  • What: your name, email, phone number, company and message when you fill out a form, email us, call us or message us on WhatsApp, your answers if you use the marketing quiz, and the website or online profile you ask us to check if you request a free website check. With a form we also note the country your internet connection comes from (our host Cloudflare derives it from your IP address) and how you found us: the page you sent the form from, including any campaign tags in its address, and, if you allowed analytics or marketing cookies, the page you landed on, the site that sent you and campaign tags in the link. If you came through one of our Google or Meta ads and allowed marketing cookies, also the ad's click ID (see cookies).
  • Why: to answer your enquiry, which may include a phone call from us, prepare a quote, and see which of our pages and campaigns bring enquiries.
  • Legal basis: taking steps at your request before a contract (b), and our legitimate interest in answering enquiries and knowing where they come from (f).
  • Do you have to give it? No, but without your contact details we can't reply.

When you visit the site

  • Security: Cloudflare, our host, processes your IP address to deliver the site and block attacks. To stop forms being flooded, we use your IP address as a counter for about 10 minutes after you send a form, then it's gone. Legal basis: our legitimate interest in a safe, working site (f).
  • Cookieless statistics: Simple Analytics counts page views without cookies and without collecting personal data, and skips visitors who have "Do Not Track" switched on. Legal basis: our legitimate interest in knowing how the site is used (f).
  • Google Analytics, only if you allow analytics cookies: how you use the site, under a random ID. Legal basis: your consent (a).
  • Advertising, only if you allow marketing cookies: Google Ads and the Meta pixel record whether you came from one of our ads and can show you our ads again later. Legal basis: your consent (a).

Details on the cookies are in the cookies section below. We don't make decisions about you by automated means alone, and we don't build profiles of you beyond the advertising lists described there.

Post to local businesses

Now and then we send a local business one postcard or letter about our websites. If you run a sole trader business (eenmanszaak) or a partnership (vof), your business's name and address can count as personal data, so this is how we use them.

  • You can always object: email "stop" to hello@sorora.studio and we'll never send you post again.
  • What: your business's name, address, KVK number and sector, and a short note about its website or online listing.
  • Where it comes from: the KVK business register, your Google Business Profile or your website.
  • Why, and on what legal basis: to tell your business once what we could do for its website. Legal basis: our legitimate interest in telling local businesses about our work (GDPR Article 6(1)(f)).
  • Who receives it: the print company that prints and posts the card, PostNL, and our email and office software providers (see "Transfers outside the EU").
  • How long: 12 months after we sent the card. If you reply, we keep your message like any other enquiry. If you object, we keep only your business's name and address on a stop list, so we never write to you again.

Your other rights and how to complain are in "Your rights under GDPR" and "Complaints" below.

Who receives your data

We do not sell your data. We share it only with those we need to do our work, and only what they need:

  • Cloudflare: hosts the site and stores form submissions as a backup.
  • Resend: sends the emails our forms produce (the notification to us and the confirmation to you).
  • Our email and office software providers: to handle your messages.
  • Simple Analytics: cookieless visit statistics without personal data.
  • Google (Google Ireland Limited): Google Analytics, only if you allow analytics cookies, and Google Ads, only if you allow marketing cookies.
  • Meta (Meta Platforms Ireland Limited): the Meta pixel and the Conversions API, only if you allow marketing cookies.
  • WhatsApp (WhatsApp Ireland Limited): only if you message us on WhatsApp, which then carries your number and messages.
  • Independent partners who work with us: they receive your enquiry or quiz answers and your contact details so they can respond, for example by calling you.
  • Authorities: only when the law requires it.

Everyone who processes data for us does so on our instructions and only for these purposes.

Transfers outside the EU

Cloudflare, Resend, Google and Meta are, or belong to, companies in the United States, so your data can be processed there. Where the company is certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision covers the transfer; otherwise it's covered by the European Commission's standard contractual clauses in that company's data processing terms. Simple Analytics is a Dutch company and keeps its data in the EU.

How long we keep it

  • Enquiries: up to 3 years, unless you become a client or we're still in conversation.
  • Google Analytics: 14 months. Advertising lists: at most 540 days on Google's and 180 days on Meta's (see cookies).
  • Simple Analytics: statistics contain no personal data.

Your rights under GDPR

  • Access: get a copy of the data we hold about you.
  • Correction: fix anything that's wrong.
  • Deletion: have it removed.
  • Restriction: ask us to pause using your data while a question about it is sorted out.
  • Portability: receive the data you gave us in a machine-readable format.
  • Objection: object to processing based on our legitimate interest.
  • Withdraw consent: at any time, through "Cookie settings" in the footer. This doesn't affect what happened before you withdrew it.

To exercise any of these, email hello@sorora.studio. We respond within one month.

Complaints

If you think we handle your data wrongly, please tell us first so we can fix it. You also have the right to complain to a data protection authority: in the Netherlands the Autoriteit Persoonsgegevens, or the authority in the EU country where you live or work, such as the Polish UODO.

Security

Data lives on encrypted infrastructure (Cloudflare), and we don't keep more than we need.

Changes to this policy

If we update this policy, the "last updated" date at the top changes.

Cookies

We use the cookies needed to make this site work and, only with your consent, Google Analytics cookies to understand how people use it, and Google Ads and Meta cookies to measure and show our ads.

What's a cookie?

A cookie is a small text file a website stores on your device. Some are essential (the site can't function without them); others are optional and only set if you say yes. The same rules apply to similar storage in your browser, which this site also uses.

Strictly necessary

  • Cookie consent: remembers which categories you accepted, so we don't ask again for 12 months.
  • Currency preference: remembers whether you chose EUR or PLN on the pricing pages. Until you choose, prices show in PLN if your internet connection is in Poland and in EUR anywhere else; for this we only use the country, and we don't store it.

These are always on. They are stored in your browser, don't track you and never leave our domain. Our English, Dutch and Polish sites (sorora.studio, sororastudio.nl and sororastudio.pl) each remember your choice separately, so each one asks you once.

How you found us (only with your consent)

If you allow analytics or marketing cookies, your browser remembers how you arrived on this site: the page you landed on, the website that sent you (only its address, such as google.com) and the campaign tags in the link, for example from one of our ads or postcards. If you come back later through another campaign link, it also remembers that latest visit with its date and time. If you allow marketing cookies, it also remembers the click ID from one of our Google ads. This stays on your device and only reaches us when you send a form, as part of your enquiry, so we can see which campaigns bring enquiries. It is deleted from your browser after at most 12 months (the click ID 90 days after the click). If you refuse or withdraw marketing cookies, the click ID is deleted straight away; if you refuse or withdraw both categories, everything is. Without your consent nothing is stored, and we only see the page you send the form from, including any campaign tags in its address. Legal basis: your consent for storing it in your browser (Article 11.7a Telecommunicatiewet; Article 399 of the Polish Electronic Communications Law), then our legitimate interest in knowing where enquiries come from (GDPR Article 6(1)(f)).

We tell Google or Meta that your enquiry came from one of their ads (for Meta also with your email address, phone number and name in hashed form, see below) only if you allowed marketing cookies when you sent the form.

Analytics (only with your consent)

If you allow analytics cookies, we use Google Analytics 4 to see how visitors use the site:

  • What it records: the pages you view, how you arrived (for example a search engine, another site or one of our ad campaigns), your approximate location (country and city), device, browser and screen size, and actions such as clicking a button, opening a question or sending a form. It never receives what you type into a form.
  • Cookies: _ga and _ga_RT0RGMGJ60, which hold a random ID so repeat visits can be recognised. They are deleted after 13 months, or straight away if you withdraw your consent.
  • Our three sites count as one: if you move between sorora.studio, sororastudio.nl and sororastudio.pl, the random ID is passed along in the link, so we see one visit rather than several.
  • Google's role: Google Ireland Limited processes this data for us. Google Analytics doesn't store IP addresses. Data can be transferred to the United States under the EU-US Data Privacy Framework. Google Signals is off, and your Google Analytics data is only used for advertising (remarketing lists, see below) if you also allow marketing cookies. The data is deleted after 14 months.

Marketing (only with your consent)

If you allow marketing cookies, we use Google Ads and the Meta pixel:

  • What they're for: to see which of our ads bring visitors and enquiries (conversions), and to show our ads again to people who visited our site (remarketing): on Google Search, YouTube and websites in Google's network, and on Facebook and Instagram. For this, Google Analytics may also share visits with Google Ads as remarketing lists.
  • What the Meta pixel sends: the pages you view, actions such as sending a form, and technical details such as your IP address and browser. When you send a form, the pixel also reads your email address, phone number and name from it and sends them to Meta in hashed form (turned into a code that can't be read back, only compared), to match your visit to a Facebook or Instagram account. It never sends your message or other form answers. If you're logged in to Facebook or Instagram, Meta can link this to your account.
  • Conversions API: when you send a form with marketing cookies allowed, our server also tells Meta about the enquiry directly. It sends the ad's click ID, the _fbp cookie, your IP address and browser, and your email address, phone number and name in hashed form (turned into a code that can't be read back, only compared). Meta uses the hashed details to match the enquiry to a Facebook or Instagram account, so we can see which ads bring enquiries, and then deletes them. Never your message or other form answers.
  • Google Ads cookies: _gcl_au and, after clicking one of our ads, _gcl_aw, both kept for 90 days on our site, plus Google's own advertising cookies on Google's domains under Google's privacy policy.
  • Meta cookies: _fbp and, after clicking one of our ads, _fbc, both kept for 90 days on our site, plus Meta's own cookies on Meta's domains under Meta's privacy policy.
  • Google's role: Google Ireland Limited. Data can be transferred to the United States under the EU-US Data Privacy Framework. You stay on a remarketing list for at most 540 days, and you can also turn off personalised ads in your Google account at myadcenter.google.com.
  • Meta's role: Meta Platforms Ireland Limited. We and Meta are jointly responsible for collecting this data on our site and sending it to Meta; what Meta then does with it is Meta's responsibility, under Meta's privacy policy. Data can be transferred to the United States under the EU-US Data Privacy Framework. You stay on our Meta audience lists for at most 180 days, and you can manage ads in your Facebook or Instagram settings under "Ad preferences".

Separately, Simple Analytics counts visits for everyone, without cookies and without collecting personal data, so it needs no consent.

How to manage cookies

You can change your choice at any time using the "Cookie settings" link in the footer. If you withdraw consent, Google Analytics, Google Ads or the Meta pixel stops straight away and its cookies on our site are deleted. You can also disable cookies and site data in your browser settings, but note that this will reset preferences like your currency on every visit.

Questions about this policy? Email hello@sorora.studio.