Privacy policy

1. Who is responsible

A.R.P. Studio is the data controller for the personal information described in this policy. A.R.P. Studio is a sole proprietorship owned by Chiara Renée Podbielski, CVR 41730382, Fadet 43, st. tv., 1799 København V, Denmark.

If you have questions about this policy or about your information, write to hello@arpstudio.co.

2. What we collect

What we collect depends on how you are in touch with us.

• When you use the contact form: your name, email address and message, and, if you fill them in, a subject and the package you are interested in. We also note the language you wrote in and the page you wrote from.
• Spam protection: the contact form also stores a scrambled code (a hash) made from your IP address. The code changes every day and can’t be turned back into your IP address. The IP address itself is never stored.
• When you write or talk to us: what you tell us by email, in calls and in meetings, for example about your home and what you need.
• When you become a client: your contact details, the address of the home we work on, measurements, photos, videos and drawings of your space, your wishes and needs, our agreement, invoices and payments.
• When you visit the website: technical information your browser sends, such as IP address, browser type, the page you asked for and the time. It is kept in short-lived security logs.

3. Why we use it, and our legal basis

We only use your information for the purposes below, and each purpose has a legal basis in the EU General Data Protection Regulation (GDPR). We don’t make automated decisions or profiles about you.

You decide what you share. But without your name, email address and message we can’t answer you, and without the information a project needs we can’t do the work.

• Answering your enquiry: to reply and help you choose the right package. Basis: steps you ask us to take before an agreement (art. 6(1)(b)) and our legitimate interest in answering messages (art. 6(1)(f)).
• Doing your project: to plan, design and manage the work and keep in touch along the way. Basis: our agreement with you (art. 6(1)(b)).
• Bookkeeping: to invoice and keep accounting records. Basis: our legal duty under the Danish Bookkeeping Act (art. 6(1)(c)).
• Questions and claims: to answer questions after a project and to establish or defend legal claims. Basis: our legitimate interest (art. 6(1)(f)).
• A safe website: to keep the site running and protect it and the contact form against misuse and spam. Basis: our legitimate interest (art. 6(1)(f)).
• Showing your project: only with your consent (art. 6(1)(a)). See section 5.

4. Information about health and wellbeing

Many of our clients design their homes around sensory needs, neurodivergence or health. If you choose to tell us about this, for yourself or someone in your household, it is sensitive information under the GDPR.

We use it only to design your home, and only with your explicit consent (art. 9(2)(a)). You can withdraw your consent at any time; this doesn’t affect what we did before. Share only what you are comfortable with and what helps the design.

We keep it with your project files, share it with no one unless you ask us to, and delete it when the project is finished.

5. Photos of your home and our portfolio

We only show photos, drawings or descriptions of your home on our website, on Instagram or in other promotion if you have said yes. We ask before we do it, and we never show your name, your address or anything else that identifies you without your permission.

You can withdraw your permission at any time by writing to us. We then take the project down from our website and our own social media.

6. Who we share it with

We don’t sell personal information and we don’t share it for marketing. Our data processors may only handle it on our instructions and under a data processing agreement. We share personal information only with:

• Cloudflare: hosts our website, counts visits without cookies (Web Analytics) and stores enquiries, images and security logs. Cloudflare is our data processor.
• Google: Google Workspace provides our email, so your messages and the email copy of each enquiry are stored there. Google is our data processor.
• Banking and bookkeeping: the bank that handles your payment, and anyone who helps us with our accounts, as far as they need it.
• Builders and suppliers: only when you have asked us to coordinate with them, and only what they need for their part of the work.
• Public authorities: when the law requires it.

7. Transfers outside the EU/EEA

Cloudflare and Google are US companies and may process information outside the EU/EEA, including in the United States.

Both are certified under the EU–US Data Privacy Framework, which the European Commission has found to give an adequate level of protection (GDPR art. 45). As an extra safeguard, both also use the European Commission’s standard contractual clauses in their data processing agreements (art. 46).

You can ask us for more information about these safeguards.

8. How long we keep it

• Enquiries: deleted automatically 12 months after we receive them, together with the spam-protection code. We delete the email copies in our inbox on the same schedule. If your enquiry leads to a project, it becomes part of your client file.
• Client and project files: kept while the project runs and for up to 3 years after it ends, so we can answer questions and deal with any claims. Three years is the general limitation period in Danish law.
• Accounting records: agreements, invoices and payments are kept for 5 years from the end of the financial year they relate to, as the Danish Bookkeeping Act requires.
• Health and wellbeing: deleted when the project is finished, or sooner if you withdraw your consent.
• Portfolio material: kept for as long as your permission stands.
• Website security logs: deleted after 3 days.

9. Cookies and your browser

To see how many people visit and how quickly the pages load, we use Cloudflare Web Analytics. It sets no cookies, uses no local storage and doesn’t fingerprint your device, so it can’t recognise you from one visit to the next. It records the page you open, the website that sent you, your country, the type of device and browser, and loading times, as totals.

We don’t use advertising tools, social media pixels or embedded content from other companies, and our fonts are served from our own website. The website links to our Instagram profile; if you follow the link, Instagram’s own privacy policy applies.

10. Security

We protect your information with access control, encrypted connections and a careful choice of providers. Only studio staff can sign in to the website’s admin, and every sign-in is checked with a one-time code sent by email.

If a security breach puts your information at risk, we will tell you and the Danish Data Protection Agency as the law requires.

11. Your rights

Under the GDPR you have the rights listed below. To use them, write to hello@arpstudio.co. We reply within one month. If a request is complex, we may need up to two more months, and we will tell you why.

• Access: see the information we hold about you and get a copy.
• Correction: have wrong or incomplete information corrected.
• Deletion: have your information deleted when we no longer need it or have no legal basis for keeping it. We may have to keep accounting records.
• Restriction: ask us to limit how we use your information for a period, for example while we check that it is correct.
• Objection: object to the use we base on our legitimate interest.
• Portability: receive the information you gave us under an agreement or a consent in a common, machine-readable format.
• Withdrawing consent: withdraw any consent you have given, at any time.
• Complaints: if you are unhappy with how we handle your information, please tell us. You can always complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, www.datatilsynet.dk.

12. Changes to this policy

We update this policy when the way we handle personal information changes. The date at the top shows when it was last updated. If a change matters to you as a client, we will tell you directly.