Privacy Policy.

Your data is handled with the same care as our craft. This policy explains what we collect, why, and the rights you hold under the GDPR.

1. Who we are

The Creativity Lab (“we”, “us”) is a digital studio based in Amsterdam, the Netherlands (KvK 42039477). We act as the data controller for personal data processed through this website and our client engagements. Contact: hello@thecreativitylab.nl.

2. Data we collect

Contact data you submit (name, email, company, project brief).
Communication data (emails, call notes, proposals).
Technical data (IP address, browser, device, pages viewed) via privacy-respecting analytics.
Client project data processed strictly to deliver the agreed work.

3. How we use it

To respond to enquiries and prepare proposals.
To deliver, support and improve contracted services.
To meet legal, tax and accounting obligations.
To understand, in aggregate, how the site is used.

4. Legal bases

We rely on: performance of a contract; your consent (e.g. optional analytics cookies); our legitimate interests in running and securing the studio; and compliance with legal obligations.

5. Sharing & sub-processors

We never sell personal data. We share it only with vetted sub-processors that help us operate (e.g. hosting, email, analytics, payments), each bound by data-protection terms. A current list is available on request.

6. International transfers

Where data leaves the EEA, we rely on adequacy decisions or Standard Contractual Clauses to keep your data protected to EU standards.

7. Retention

Contact-form data: up to 12 months.
Client data: contract term plus 7 years (statutory retention obligation).
Analytics data: up to 26 months.

8. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing. To exercise these rights, email us at hello@thecreativitylab.nl. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Security

We apply appropriate technical and organisational measures, encryption in transit, access controls and least-privilege practices, to protect personal data.