Privacy policy

Surfinbird Studio is run by Sofia Kvarnström, a sole trader, who is the data controller for the processing on https://surfinbirdstudio.com.

Email: sofia@surfinbirdstudio.com · Phone: +46 76 211 63 98

Contact form: name, email address, company/website, phone number (optional), what you would like help with and your message. The details are sent as an email to my inbox. The enquiry itself is not stored in the website's database.

Mailing list (optional): if you tick the box for tips and news, your email address is stored separately from the enquiry, together with the time of consent, the exact consent text and its version, the source (the contact form) and the consent status.

Direct contact: information you provide yourself when you email, call or write via WhatsApp, Instagram or Facebook.

Meta Pixel (only with consent): see the section on cookies below.

Answering enquiries and providing quotes – legitimate interest and steps prior to entering into a contract at your request.

Carrying out client assignments – performance of a contract.

Bookkeeping and other legal requirements – legal obligation.

Measuring advertising with the Meta Pixel – your consent.

Sending tips and news by email (newsletter) – a separate purpose based on your voluntary consent. It is completely independent of the enquiry and of the cookie settings. You can withdraw your consent at any time by emailing sofia@surfinbirdstudio.com and, once mailings have started, via the unsubscribe link in each mailing.

This is my routine for deletion (deletion is done manually, not automatically):

Enquiries that do not lead to a client assignment are normally deleted no later than 12 months after the most recent contact. Client data is kept for as long as it is needed for the assignment and relevant legal obligations. Bookkeeping records are kept in accordance with applicable law.

The mailing list is handled separately. An old enquiry may be deleted while the subscription details needed for the mailing list are kept. Subscription details are not stored indefinitely – I regularly assess whether they are still needed and whether the consent is current. If you withdraw your consent, you are marked as unsubscribed so that you receive no further mailings.

Lovable Labs AB (Stockholm, Sweden) – hosts the website and the contact form, sends the form's notification emails to me from the sender notify.surfinbirdstudio.com, and stores the mailing list's subscription details in a protected database that visitors cannot access. The database is located in the EU (Frankfurt, Germany). Lovable uses its own sub-processors, including for web hosting and email delivery.

Google Workspace – my email service. Enquiries from the form and emails you send me end up in my inbox there.

Faktura.nu – bookkeeping and invoicing. Only details of clients I invoice are transferred here, not all contact enquiries.

Meta Platforms Ireland Ltd – receives data from the Meta Pixel if you have consented, as well as messages you send via WhatsApp, Instagram or Facebook.

Draft – not yet confirmed: Where Lovable's sub-processors for web hosting and email delivery process the data, and where Faktura.nu stores the data, needs to be confirmed.

Meta may transfer data to the United States. Meta states that such transfers are based on the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

Google may process data on servers outside the EU/EEA, including in the United States. Google states that such transfers are based on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Lovable's data processing agreement covers transfers outside the EU/EEA, including on the basis of the EU–US Data Privacy Framework.

Draft – not yet confirmed: Which of Lovable's sub-processors are located outside the EU/EEA, and whether Faktura.nu transfers data outside the EU/EEA, needs to be confirmed.

Essential: the website stores your cookie choice in your browser's local storage so that it applies on your next visit.

Marketing (off by default): if you accept, the Meta Pixel is loaded. It records page views and – when an enquiry has been sent – that an enquiry has been made. Meta then receives, among other things, your IP address, browser information, the page visited and cookies such as _fbp/_fbc. Name, email, phone number and message text are not sent to Meta. The purpose is to measure and improve ads on Facebook and Instagram.

You can change or withdraw your consent at any time. When you withdraw it, the pixel is stopped and the Meta cookies that the website is able to delete are removed.

You have the right to request access to, rectification or erasure of your data, restriction of processing and data portability, and to object to processing based on legitimate interest. Consent can be withdrawn at any time. Contact me using the details above.

You can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or with the supervisory authority in the country where you live or work, for example the Spanish AEPD.