Privacy Policy

01Who is responsible

The data controller is SHINE S.à r.l-S, which operates Forge Studio at 18A-18D Rue de la Cimenterie, L-1337 Luxembourg, registered with the Luxembourg Trade and Companies Register under number B257406, VAT number LU33262128.

Contact for privacy matters: hello@forgestudio.lu

We have not appointed a Data Protection Officer, as we are a small operation and are not required to do so.

02What data we collect

When you book the studio, we collect:

• Name
• Email address
• Phone number
• Company name and VAT number (for business bookings)
• Production type (what you plan to shoot)
• Booking details (date, time, options chosen)
• Payment status (but not your card details, which are handled by Stripe only)

If you create an account, we also store your login details through our account provider. If you subscribe to the newsletter, we store your email address for that purpose.

03Why we use your data and on what legal basis

• To process your booking, payment, and studio use: performance of a contract (Art. 6(1)(b) GDPR).
• To send operational emails about your booking (confirmation, reminders, changes): performance of a contract, and legitimate interest in running the studio (Art. 6(1)(b) and (f) GDPR).
• To comply with accounting and tax obligations: legal obligation (Art. 6(1)(c) GDPR).
• To send the newsletter: your consent (Art. 6(1)(a) GDPR). The newsletter is strictly opt-in. Every newsletter contains an unsubscribe link, and you can withdraw consent at any time.
• To handle damage claims or disputes: legitimate interest in establishing and defending legal claims (Art. 6(1)(f) GDPR).

04Who processes your data for us

We use the following service providers as processors or independent controllers:

• Stripe: payment processing (Stripe handles your card data on its own hosted page)
• Vercel: website hosting
• Neon: database hosting
• Clerk: customer accounts
• Resend: transactional and newsletter emails
• Google: calendar synchronization of bookings

Some of these providers may process data outside the EU/EEA. Where that happens, transfers rely on safeguards such as the EU Standard Contractual Clauses or an adequacy decision (for example the EU-US Data Privacy Framework).

We do not sell your data and do not share it with anyone else, except where required by law.

05How long we keep your data

• Booking and invoicing records: 10 years, as required by Luxembourg accounting law
• Operational booking correspondence: 12 months after your booking
• Account data: for as long as your account exists, then deleted within 30 days of account deletion
• Newsletter data: until you unsubscribe
• Inquiries that do not lead to a booking: 2 years

06Your rights

Under the GDPR you can ask us at any time to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data (where no legal retention duty applies)
• Restrict or object to processing based on legitimate interest
• Receive your data in a portable format
• Withdraw consent (for the newsletter) at any time, without affecting past processing

To exercise these rights, email hello@forgestudio.lu. We respond within one month.

You also have the right to lodge a complaint with the Luxembourg data protection authority: Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, www.cnpd.lu.

07Cookies

Our website currently uses only strictly necessary cookies, meaning cookies without which the site and the booking process cannot work. These cover hosting (Vercel), the payment session (Stripe) and, if you have an account, keeping you signed in (Clerk). Strictly necessary cookies do not require your consent and cannot be switched off.

No analytics tool is active on this site at present, and no advertising cookies are used at all. Analytics cookies are set only if you opt in, and your choice is asked for and stored before any is ever placed on your device. The categories we provide for are:

• Strictly necessary: required for the site, the booking flow and your signed-in state. Always active, no consent needed.
• Analytics: measures how the site is used. Not in use today. If it is introduced, it will only run after you opt in.
• Advertising: measures advertising performance and relevance. Not in use today. If it is introduced, it will only run after you opt in.

The "Cookie preferences" link in the footer of every page opens the cookie preferences panel. It lists the categories in use and, for any optional category, lets you grant or withdraw your consent at any time. Your choice is stored locally in your browser and stays in force until you change it or clear your browser storage.

If we introduce optional cookies, none will be set before you have made your choice, and this policy will be updated first.

08Changes to this policy

We may update this policy. The current version is always available on this page with its date of last update.