Privacy

Your data, in plain words.

This notice explains what Dirtbag Studio collects when you order, subscribe, review or simply read; why we hold it; who processes it for us; and how to make us hand it back or delete it. No ad networks, no data broking, no cross-site tracking.

Data held in: EU: Paris
Tracking cookies: None
Data sold: Never
Reply time: < 1 month

Privacy

Who is responsible

Dirtbag Studio is the data controller for everything described below. Write to the address opposite and a person, not a ticketing robot, will answer.

Our registration and contact details are on the legal notice.

Last updated · 2026-07-26

What we collect, and why

Nothing here is collected for its own sake: each row exists because a part of the shop stops working without it.

Order details

Contract

Name, delivery address, email and phone number, so the canvas reaches the right wall and we can tell you when it was dispatched.

Payment data

Contract

Entered into a Stripe field on our checkout page and sent straight to Stripe. We receive a payment reference, the amount, the currency and the last four digits: never the full card number.

Newsletter signup

Consent

Your address, your language and where you signed up, so the monthly letter arrives in a language you read. One click unsubscribes, permanently.

Reviews and comments

Consent

The name you choose to publish, your rating and your words. An optional email lets us verify a purchase or reply: it is never shown.

Pageviews

Legitimate interest

Path, referrer, language, approximate city and country, and a random key that lives only until you close the tab. No profile is built and nothing is joined to your order.

Messages you send

Legitimate interest

What you write to us and what we write back, kept so the next conversation does not start from zero.

Who else touches it

A payment provider, a hosting and database provider and an email delivery provider process data on our behalf. Each is bound by a data-processing agreement, none may use your data for its own ends, and the data is stored in the EU. Write to us if you want the current providers named.

What you can demand.

Under the GDPR these are rights, not favours. Ask by email: we do not charge, and we answer inside one month.

Access. A copy of everything we hold about you, in a form you can actually read.

Rectification. A wrong address, a misspelled name: corrected on request.

Erasure. Deletion, except what tax law obliges us to keep: invoices stay for the statutory accounting period.

Portability. Your data as a machine-readable file, to take wherever you like.

Objection. Tell us to stop processing on legitimate-interest grounds, analytics included, and we stop.

Withdrawing consent. Unsubscribe from the newsletter or pull a review at any time. It does not undo what was lawful beforehand.

If we get it wrong.

Tell us first: we would rather fix it than be told to. You also have the right to complain to the Dutch data-protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the supervisory authority of the EU country where you live.

Ask us anything.

To exercise any right above, or simply to ask what we hold and why, write to hello@dirtbagstudio.com. Say what you want done, a copy, a correction, a deletion, and we confirm within one month, usually the same week.

The rest, briefly

No tracking cookies.

Your bag and your cookie choice sit in your browser and never leave it, and the analytics key is written only if you accept counting in the banner. The card field on our checkout page is served by our payment provider, which sets its own cookies inside it to take the payment and screen for fraud.

Analytics stay first-party.

Pageviews are counted by our own beacon and written to our own database. No Google Analytics, no advertising pixel, no social tracker, nothing that follows you to another site.

How long we keep things.

Order records for as long as tax and warranty obligations require. Subscriber addresses until you unsubscribe. Pageviews as counts, not histories. Unpublished reviews and support messages are cleared once they are dealt with.

Moderation before publication.

Reviews and journal comments arrive unpublished and are read by a person before they appear. We may decline anything abusive, fake or off-topic, and we remove yours on request.

Transfers outside the EU.

Data is stored in the EU. Where a processor operates from elsewhere, the transfer runs on the European Commission’s standard contractual clauses.

Children.

The shop is not aimed at children and we do not knowingly collect their data. If you believe we hold any, write to us and it goes.