Who is responsible for your data?
Pixel Shield is a Netherlands-based software and digital agency. We are the controller for the personal data described in this statement. You can reach us at info@pixelshield.studio for any question about your data.
We do not have a data protection officer; questions about privacy are handled directly by the person running Pixel Shield.
- Email: info@pixelshield.studio
Which data do we process, and why?
We only process the data we need for a specific purpose. Providing it is voluntary, but without an email address we cannot reply to your message.
- Contact form: your name, email address, company (optional), the service you are interested in and your message. We use these to answer your question and, if you ask for it, to prepare a proposal. Legal basis: taking steps at your request before entering into an agreement (Article 6(1)(b) GDPR).
- Open applications: your name, email address, area of interest, introduction and any portfolio, CV or LinkedIn link you choose to share. We use these to review your application and contact you about a suitable opportunity.
- Free AI visibility and security scan: the data from the contact form, plus the website address, the customer questions you send and your confirmation that you may request the scan for that website. We use these to carry out the scan, send the report and keep a record of the authorisation. Legal basis: Article 6(1)(b) GDPR.
- Email correspondence: the data you include in emails to us, used to handle your message. Legal basis: our legitimate interest in answering questions (Article 6(1)(f) GDPR).
- Clients: contact and administrative data, such as quotes and invoices, used to perform the agreement and to meet our legal obligations. Legal basis: Article 6(1)(b) and (c) GDPR.
- Spam and abuse protection: when you use a form, Cloudflare Turnstile checks whether the request comes from a person. It processes technical data such as your IP address and browser signals; it does not read what you type in the form. Legal basis: our legitimate interest in protecting our forms against abuse (Article 6(1)(f) GDPR).
- Website delivery, security and statistics: our hosting provider Cloudflare processes technical request data, including IP addresses, to deliver and protect the website. We use Cloudflare Web Analytics for aggregated visitor statistics without cookies; it does not build a profile of you. Legal basis: our legitimate interest in a secure, working website (Article 6(1)(f) GDPR).
- Optional website analytics: after you accept analytics, Google Analytics 4 measures page views, successful form submissions and clicks on phone and email links. It uses cookie identifiers, approximate location and technical data about your browser, device and visit to help us understand website use and which visits lead to enquiries. Google receives your IP address as part of the connection. Our analytics code sends page addresses without query strings or fragments and only the referring site’s origin. After you consent, selected UTM labels from the link you used are sent separately to measure campaign source, medium, name or ID, content variant and keyword. Form answers and raw phone or email link targets are excluded. Legal basis: your consent (Article 6(1)(a) GDPR).
When we carry out a scan, we look at publicly available information about the website you name and record how AI search tools describe the business. That information is about the organisation, not about you as a person.
Your choice about Google Analytics
Google Analytics loads only after you accept analytics in the cookie notice. If you decline or have not chosen, this website sends no requests to Google Analytics. You can use the website and submit forms without accepting. To change your choice or withdraw consent, use the cookie preferences control in the footer and reject analytics. This stops future Google Analytics measurement and removes its cookies from this website; it does not undo processing that took place with your consent. Cloudflare’s separate cookieless statistics and security services continue to operate. Google signals, advertising personalisation and remarketing are disabled, and we do not link this measurement to Google Ads.
What we do not do
We do not use advertising trackers or cookies for marketing, we do not sell personal data and we do not add you to a mailing list. We do not use automated decision-making or profiling that affects you.
Who receives your data?
We use a small number of service providers that process data on our behalf (processors). They may only use the data to provide their service to us.
- Cloudflare, Inc. (United States): hosting, content delivery, security, the form endpoint, Turnstile bot protection and Web Analytics.
- Resend (Plus Five Five, Inc., United States): delivering form messages to our mailbox. Messages are sent from its EU (Ireland) region; account data and delivery logs are stored in the United States and kept for 30 days.
- Natro (Çizgi Telekomünikasyon A.Ş., Türkiye): hosting of our mailbox, including form messages and emails you send us.
- Google (Google Analytics): optional website and conversion analytics after you consent. Google processes cookie identifiers, visit and event information and technical connection data; it may process these outside the European Economic Area.
We do not share your data with other parties unless the law requires us to. Instagram and LinkedIn are linked on this website but not embedded; they only receive data if you visit them.
Is data transferred outside the European Economic Area?
Yes. Cloudflare and Resend are based in the United States. Both participate in the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision, and their data processing agreements include the European Commission’s standard contractual clauses.
Google Analytics data may also be processed outside the European Economic Area, including in the United States. Google’s data processing terms describe the applicable transfer safeguards, including standard contractual clauses where required.
Our mailbox is hosted in Türkiye, a country without an adequacy decision from the European Commission. We are reviewing this setup to put appropriate safeguards under Article 46 GDPR in place, and we will update this statement when it changes. You can ask us about the current status at any time.
How long do we keep your data?
We do not keep personal data longer than necessary for the purpose it was collected for.
- Questions and proposal requests that do not lead to an assignment: deleted no later than 12 months after our last contact.
- Free scan requests and reports: deleted no later than 12 months after the report was sent, unless a follow-up assignment starts.
- Client administration, such as quotes, invoices and related correspondence: 7 years, as required by Dutch tax law.
- Delivery logs at Resend: 30 days. Technical and security data at Cloudflare: according to Cloudflare’s own retention periods.
- Google Analytics: user-level and event-level retention is set to 2 months. This limit does not apply to standard aggregated reports. Analytics cookies are configured for up to 180 days; browser limits can shorten this. We remember your analytics choice in browser storage for up to 180 days.
How do we protect your data?
We take appropriate technical and organisational measures, such as encrypted connections (HTTPS), bot protection on forms, a fixed recipient for form messages and limited access to our mailbox and hosting accounts. If you discover a vulnerability on this website, please report it as described in our terms of use.
What are your rights?
You have the right to access your personal data and to have it corrected or deleted. You can also ask us to restrict processing, object to processing based on our legitimate interest and receive your data in a portable format. Send your request to info@pixelshield.studio. We respond within one month and may ask you to confirm your identity.
If you are not satisfied with how we handle your data, please tell us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes to this statement
We update this statement when our website, service providers or retention periods change. The date at the top of this page shows the latest version.