Legal

Privacy Policy

Last updated: April 2026

1. Who we are

This website is operated by Stefka, an AI-native marketing studio based in Amsterdam, the Netherlands. We provide strategic and execution marketing services to mission-driven startups and scale-ups.

Data controller: Stefka, Amsterdam, the Netherlands
Contact: [email protected]

2. What data we collect and why

2.1 Data you provide directly

When you submit our contact form, we collect your name, email address, company name, and the content of your message. We use this information to respond to your enquiry and, where relevant, to follow up about potential collaboration. The legal basis for this processing is our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR), or performance of a contract where you are an existing client (Article 6(1)(b) GDPR).

2.2 Usage and analytics data

If you consent to analytics cookies, we collect anonymised data about how you interact with this website — pages visited, time on site, traffic source, and device type. This is processed via Google Analytics (GA4) and helps us understand how our content performs and improve the site. The legal basis is consent (Article 6(1)(a) GDPR).

2.3 Marketing and tracking data

If you consent to marketing cookies, HubSpot places a tracking pixel on your browser that allows us to identify returning visitors and understand how leads interact with our site before contacting us. The legal basis is consent (Article 6(1)(a) GDPR). You can withdraw consent at any time via the cookie settings link in the footer.

2.4 Technical data

Our hosting infrastructure (GitHub Pages) may log standard server-side data such as IP addresses and browser user-agent strings for security and performance purposes. We do not control or access these logs directly and they are retained by the infrastructure provider according to their own policies.

3. Cookies

We use cookies to enable analytics and marketing tracking where you have consented. For full details of the specific cookies placed, please see our Cookie Policy.

4. How we share your data

We do not sell, rent, or trade your personal data. We share data only with the following processors, each operating under a Data Processing Agreement:

  • Google LLC — analytics (Google Analytics 4). Data may be processed in the United States under Standard Contractual Clauses. See Google's Privacy Policy.
  • HubSpot, Inc. — CRM, contact form processing, and site tracking. Data is stored on EU servers (eu1 region). See HubSpot's Privacy Policy.

We may also disclose personal data if required by law, court order, or regulatory authority.

5. International data transfers

Google Analytics data may be transferred to and processed in the United States. These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission. HubSpot processes data within the EU (eu1 region) and is covered by the EU–US Data Privacy Framework where applicable.

6. Data retention

Contact form submissions are retained in HubSpot for as long as we have a legitimate business reason to maintain them, or until you request deletion. Google Analytics data is retained for 14 months by default. We review personal data regularly and delete it when it is no longer necessary.

7. Your rights under GDPR

As a resident of the European Economic Area, you have the following rights regarding your personal data:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate or incomplete data.
  • Erasure — request deletion of your data where we no longer have a lawful basis for processing it.
  • Restriction — ask us to restrict processing of your data in certain circumstances.
  • Portability — receive your data in a structured, commonly used format.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Complaints

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens (AP)
www.autoriteitpersoonsgegevens.nl

9. Children's privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

11. Contact

For any questions or concerns about this Privacy Policy or how we handle your data, please contact us at [email protected].