Privacy Policy

The short version

This site collects the minimum needed to answer purchase enquiries and ship ceramics: your enquiry details, your message when you write, and anonymous page statistics. Advertising measurement by Meta (Facebook and Instagram) runs only if you accept it in the site’s banner. Your data is never sold.

Private classes and paid invoices

Your name, email, phone, chosen session and participant count are used to arrange your class and send transactional confirmations. Event enquiries also include your preferred date and requirements. Teya processes payments in its secure form; this site does not receive card numbers.

If you request a trade-union invoice, your legal name, kennitala and union name are used only for accurate paid documentation. Kennitala is encrypted in storage, excluded from analytics and application logs, and accessible only through protected invoices. We do not submit applications or share information with your union. Contact the studio to correct your details or request deletion, subject to accounting retention requirements.

Transactional email is delivered through Resend. Where the studio’s authenticated mail relay is used, the email and paid PDF pass securely through our artist’s email service. Private booking and quotation pages are excluded from advertising measurement.

Who is responsible

The data controller is Studio Esja, Iceland — reachable at [email protected]. Iceland is part of the EEA, so the GDPR applies to everything described here.

What is collected, and why

Purchase enquiries and orders. When you enquire about a piece, the studio stores your name, email address, phone number, country, delivery address, optional message, and the piece you asked about. These details are used to answer you, prepare the payment link, and fulfil the purchase if you proceed. Legal basis: performance of the contract — this is what makes it possible to pack, ship, and stand behind your order. Order records are kept for as long as bookkeeping and warranty obligations require.

Payment. If you choose to proceed, the studio sends a secure payment link by email. The payment provider processes the payment under its own privacy terms. The studio receives payment confirmation and order details, but never your card number.

Messages. If you write through the contact form or by email, your name, email address, and message are kept to answer you and for as long as the conversation is relevant. Legal basis: legitimate interest in replying to you. Nothing is added to a mailing list without your explicit consent.

Order and contact emails. Transactional emails (order confirmation, shipping notice, replies) are delivered through Resend, an email service processing the message and your address on the studio’s behalf.

Analytics. The site counts page views with a random, anonymous per-session identifier that disappears when you close the browser tab. It stores the page path and coarse location context provided by the network (country, city, time zone, and a location rounded to roughly ten kilometres) — no IP address, no fingerprinting, no cross-site tracking — and it is switched off entirely if your browser sends Do Not Track. Legal basis: legitimate interest in knowing which pages are read and roughly where visitors come from. Details are in the cookie policy.

Newsletter. Joining the studio’s letters is double opt-in: entering an address sends one confirmation email, and nothing else is ever sent unless you click it. Legal basis: your consent, which you can withdraw at any time — every letter carries a one-click unsubscribe link, and unsubscribed addresses are added to a suppression list so they are not emailed again. The same applies to Collector Access membership emails, which you join by application and can leave with one click.

Hosting. The site runs on Cloudflare Pages. Like any host, Cloudflare processes technical request data (such as IP addresses) for security and delivery, acting as a processor under its own data processing terms.

Advertising measurement (Meta). Only if you click Accept in the banner, the site loads Meta’s pixel, which sets the cookies _fbp and _fbc and tells Meta Platforms Ireland Ltd which pages you view; if you type your email or phone number into a form on such a page, the pixel sends a hashed (SHA-256) copy of it. If you then book a course, the site also sends Meta the booking event (course, number of places, price) together with your email address, phone number and name in hashed (SHA-256) form, your IP address and browser type, so Meta can match the booking to an ad you saw. This measures and improves the studio’s Facebook and Instagram ads. Legal basis: your consent (GDPR art. 6(1)(a)), which you can withdraw at any time on the cookie page; Studio Esja and Meta are joint controllers for the collection, and Meta’s own use is described in its privacy policy. Meta may transfer data to the United States under the EU–US Data Privacy Framework. The signals kept for a pending payment are deleted within 7 days. If you decline, nothing is sent to Meta.

Who receives data

Only the service providers needed to run the site, each bound by data-processing terms: Cloudflare (hosting, storage), the secure payment provider named in your payment link, Resend (transactional email), and the postal or courier service that carries your parcel (name and address — they cannot deliver without it). With your consent only, Meta (advertising measurement, described above). No data is sold or rented, ever.

Your rights

Under the GDPR you can ask at any time for access to the data held about you, correction, deletion, restriction of processing, a portable copy, or object to processing based on legitimate interest. Write to [email protected] and it will be handled personally, without forms or delay. You also have the right to complain to a supervisory authority — in Iceland, Persónuvernd (the Icelandic Data Protection Authority), or the authority in your own country.

What this site does not do

No advertising pixel without your consent. No third-party analytics. No automated decisions about you. No newsletters without your explicit, confirmed consent. No data transfers beyond the processors named above.