STstudio Privacy Policy

Effective 17 September 2026 · Version 2 (see version 1)

This policy explains how STstudio, run by Yirang Ok (“the studio”, “we”), handles personal data through the website www.ststudio.co.kr, its contact form and the address contact@ststudio.co.kr. It is written to meet Article 13 of the EU General Data Protection Regulation (GDPR) and Article 30 of the Korean Personal Information Protection Act (PIPA). We process only the data we need, we do not advertise, and we do not sell personal data. This policy is published in Korean and English; if they differ, the Korean text prevails for the Korean PIPA and the English text for the GDPR.

1. Who is responsible
2. What we process, why, and on what legal basis
3. How long we keep it
4. How we delete it
5. Sharing with third parties
6. Service providers (processors)
7. Transfers outside the EU and Korea
8. Cookies and similar storage
9. Information external services receive directly
10. Security
11. Your rights
12. Privacy contact
13. Complaints
14. Other information
15. Changes to this policy

1. Who is responsible

• Controller: Yirang Ok (옥이랑), trading as STstudio (생태제작소) — a sole proprietorship (eenmanszaak) in the Netherlands and an individual business (개인사업자) in Korea
• Netherlands: · KvK 98086030 · VAT ID NL005307209B29
• Korea: · business registration no. 398-55-00964
• Email: contact@ststudio.co.kr

We work from the Netherlands and Korea and follow both the GDPR and the Korean PIPA. We have not appointed a data protection officer, because the GDPR (Article 37) does not require one for a studio of this kind; the privacy contact in section 12 handles all privacy questions.

2. What we process, why, and on what legal basis

We use personal data only for the purposes below. If a purpose changes, we will first take the steps the law requires.

a. Processing that does not rely on consent

These visit records are separate from Google Analytics. They use no cookies and store nothing on your device, so the cookie banner does not cover them — Dutch Telecommunicatiewet Art. 11.7a applies to storing or reading data on your device. You can object to this processing at any time (section 11), and turning JavaScript off in your browser stops the record being made.

Where we rely on legitimate interest, we do so only where that interest clearly outweighs your rights, is substantially connected to the processing, and stays within a reasonable scope. You can object to it at any time (section 11).

b. Processing based on your consent

Google Analytics is loaded only after you tick both “collection and use” and “transfer abroad” in the cookie notice and press “Allow”; until then nothing is sent to Google. Before you choose, the notice shows the data, the recipient and countries, how it is sent, and how long it is kept. Declining does not limit your use of the site in any way. We have switched off Google signals (cross-device tracking) and ad personalisation.

3. How long we keep it

4. How we delete it

When data reaches the end of its retention period or is no longer needed, it is deleted without delay. Email and documents we hold ourselves are identified and deleted by the owner: electronic files are deleted so they cannot be recovered, including emptying the trash, and printouts are shredded. Server logs, today’s-visitor records, email delivery records and the form provider’s copy are deleted automatically by those systems at the end of the periods in section 3. Records the law requires us to keep are stored separately from other personal data.

5. Sharing with third parties

We do not give personal data to third parties, except where the law requires or specifically permits it (Korean PIPA Articles 17 and 18; GDPR Article 6(1)(c)). When a contract is signed, tax law requires us to report transactions to the tax authorities (Korea’s National Tax Service, the Dutch Belastingdienst), including the client’s trade name, representative’s name, business registration or VAT number and the amount.

6. Service providers (processors)

Web3Forms, Cloudflare, fortrabbit and Google Analytics are bound by data processing terms, which limit use to our instructions, require appropriate security, restrict further sub-processing and set out liability. Gmail is used under Google’s standard terms. If a provider changes, we update this policy.

7. Transfers outside the EU and Korea

Because we work from both the Netherlands and Korea and use the providers above, personal data is transferred across borders as follows. Every transfer is an encrypted transmission over the internet (HTTPS/TLS).

How to refuse, and what happens.

• Google Analytics: leave the consents unticked or press “Decline” and nothing is transferred, with no disadvantage.
• Contact form: “Something else” enquiries can be sent only after ticking the form’s consent to the transfer abroad. If you do not want to, or prefer not to use the form, email contact@ststudio.co.kr directly — nothing then goes to Web3Forms (India etc.). Email passes through Cloudflare and Google (USA); if you do not want that either, write to our Netherlands address by post.
• Website hosting (fortrabbit, Ireland): needed to deliver the pages, so it cannot be refused separately; if you prefer, contact us by post instead of using the website. Today’s-visitor records are not created if JavaScript is switched off in your browser.

For transfers outside the EU we rely on the European Commission’s EU–U.S. Data Privacy Framework adequacy decision (Cloudflare, Google, and Amazon Web Services as fortrabbit’s subcontractor) and on Standard Contractual Clauses (Web3Forms). fortrabbit stores the website’s data in the EU region we chose (Ireland); where its subcontractor Amazon Web Services (a US company) takes part in processing, the same adequacy decision applies. You can ask us for a copy of the safeguards at contact@ststudio.co.kr.

8. Cookies and similar storage

A cookie is a small file a website stores in your browser; local storage (localStorage) is a similar way to keep a setting in your browser. This site uses:

Local-storage values stay on your device and are never sent to our server. The today’s-visitor dots, the visit records and the server logs use no cookies.

Refusing or withdrawing. Leave the consents unticked or press “Decline” in the notice on your first visit, and withdraw at any time with “Cookie settings” at the bottom of every page. Withdrawing deletes the _ga cookies and shows your Analytics identifier in the cookie settings; send it to contact@ststudio.co.kr and we delete the statistics already collected with Google Analytics’ user-deletion tool within 10 days of your request. Withdrawal does not affect the lawfulness of processing before it.

Open cookie settings

You can also delete or block cookies and site data in your browser settings (menu names vary by version): Chrome — Settings › Privacy and security; Edge — Settings › Cookies and site permissions; Safari on Mac — Settings › Privacy › Manage Website Data; Safari on iPhone — Settings › Apps › Safari › Clear History and Website Data; Firefox — Settings › Privacy & Security › Cookies and Site Data; Samsung Internet — Settings › Privacy and security › Delete browsing data. The site keeps working if you block cookies.

9. Information external services receive directly

We do not pass personal data to these services. When a page opens, your browser fetches a typeface or video from them and in doing so sends them some information directly; each company handles it under its own privacy policy (adobe.com/privacy/policies/adobe-fonts.html, vimeo.com/privacy). We do not receive that information and do not use it to identify you or for advertising. Under the GDPR we are jointly responsible with each company for collecting and transmitting it when the page loads (our legitimate interest in showing the work with its intended typefaces and videos, Art. 6(1)(f)), and you can exercise your rights about it with us or with them; for anything they do afterwards, they alone are responsible.

If you prefer, you can block these services with a browser extension; some typefaces or videos may then not appear. Adobe and Vimeo are certified under the EU–U.S. Data Privacy Framework.

10. Security

• Organisational: only the owner has access to personal data, and data past its retention period is deleted.
• Technical: the website and the contact form are served over HTTPS. The today’s-visitor feature stores only a keyed hash of the IP address, in a folder that cannot be reached from the web. To reduce transfers, the Jost and Space Mono typefaces and the three.js script are served from our own server, and the statistics tool is not loaded before consent.

11. Your rights

You can ask us at any time to:

• give you access to your personal data, correct it, delete it, or restrict its processing;
• stop processing that relies on legitimate interest (objection);
• give you the data you provided to us — through the contact form, by email or for a project — in a structured, commonly used, machine-readable format, or send it to another organisation where technically feasible;
• and you can withdraw consent at any time.

Email contact@ststudio.co.kr. We act on your request and tell you the result within 10 days of receiving it; if we need to confirm that you are the person concerned or their authorised representative, we ask for what we need within that time. Server logs and today’s-visitor records carry no names, so to find them we need the date of your visit and your IP address. If the law limits a request, we tell you why and how to challenge the decision. Statistics consent can be withdrawn immediately under “Cookie settings”.

12. Privacy contact

Yirang Ok, owner, is responsible for personal data at the studio and handles questions, complaints and access requests: contact@ststudio.co.kr · post: .

13. Complaints

You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl), or to the authority in the EU/EEA country where you live or work. In Korea you can contact the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Privacy Infringement Report Center at KISA (118, privacy.kisa.or.kr), the Supreme Prosecutors’ Office (1301, spo.go.kr) or the National Police Agency’s cyber crime reporting system (182, ecrm.police.go.kr).

14. Other information

• Nobody is required to give us personal data. To answer an enquiry we need a name, an email address, the enquiry type and a message; without an email address we cannot reply.
• The website is not aimed at children under 14, and we do not knowingly collect their data.
• We do not process special categories of data or national identification numbers.
• We do not process pseudonymised data under the special regime of PIPA Article 28-2, and we make no automated decisions and build no profiles.

15. Changes to this policy

This is version 2, effective 17 September 2026. It revises version 1, published the same day: separate consents for Google Analytics’ collection and its transfer abroad; a transfer consent for “Something else” enquiries; more precise retention periods (tax records, email delivery records, statistics, the form provider’s copy) and transfer bases and refusal options; visit times no longer published by the today’s-visitor feature; clearer information on Adobe Fonts and Vimeo. If it changes again, we will announce the change on this page before it takes effect and publish what changed together with the previous version.