Legal
Privacy policy
How we handle your information. Last updated 31 August 2026.
The short version: we collect what we need to run a class or make a piece for you, we keep it no longer than we have to, and we never sell it. You can download or delete everything from your account.
Who is responsible
ZANART Ceramic Studio (“we”) is the data controller for the information described here.
- Registered name
- ZANART STUDIO SH.P.K.
- Registered address
- 7 Tringë Smajli, Prishtinë 10000
- Business number
- 812387373
- zanartstudio@hotmail.com
- Phone
- (+383) 45-975-610
For anything about your data - a copy, a correction, a deletion, or a complaint - email us and we will reply within one month, as the law requires.
What we collect, and why
We only ask for what a given task needs. Nothing here is optional-but-collected-anyway.
| What | Why | Legal basis |
|---|---|---|
| Name, email, phone | To hold your class booking and contact you if a session changes | Contract |
| Notes you add to a booking | So we can accommodate what you tell us - access needs, allergies | Contract, and your consent where it concerns health |
| Your account details and password | So you can sign in and see your own bookings and orders | Contract |
| Order details and our quotes | To make and deliver a commissioned piece, and for our accounts | Contract, and legal obligation for the records |
| Messages you send us | To answer the question you asked | Legitimate interest |
| Your email, if you subscribe | To send occasional studio news | Consent - and only if you tick the box |
If you sign in with Google, we receive your name, email address and profile picture from Google. We never receive your Google password.
What we do not do
- We do not sell or rent your information to anyone.
- We do not use advertising cookies, and we do not build a profile of you to sell to anyone.
- We do not take card payments on this site, so we never hold your card details.
Cookies
Two kinds, and only one of them needs your permission.
| Cookie | What it is for | Your choice |
|---|---|---|
| Sign-in | Keeps you signed in as you move between pages. Without it you would have to enter your password on every click. | None - the site cannot work without it, so no consent is required. |
| Language | Remembers whether you chose English or Albanian. | None - it holds a two-letter code and nothing else. |
| Google Analytics | Tells us which pages people actually read, so we know what to improve. Set by Google, who can see your IP address. | Yours. Nothing is loaded until you accept, and you can change your mind at any time. |
Analytics stays switched off until you accept it. If you decline, or simply ignore the banner, Google's script is never loaded and no analytics cookie is set - not a disabled one, none at all.
Google acts as our processor here and may transfer data to the United States under the EU-US Data Privacy Framework. If that is not something you want, decline - the site works exactly the same either way.
How long we keep it
These are enforced automatically, not by hand.
| What | How long | Then what |
|---|---|---|
| Class bookings | 3 years after the class ran | Your name, email, phone and notes are permanently removed. The place itself stays in our register, anonymously, so our records still add up. |
| Messages you send us | 1 year after we have dealt with it | Deleted outright. |
| Newsletter subscription | Until you unsubscribe | Removed within 30 days of unsubscribing. |
| Orders and quotes | As long as tax law requires us to keep the records | If you close your account first, the order stays but is no longer linked to your name. |
| Your account | Until you close it | See below. |
Your rights
Under the GDPR you can ask us for any of the following, free of charge. Two of them you can do yourself, right now, from your account.
- A copy of everything we hold about you - there is a Download my data button on your account page.
- Correction of anything wrong - you can edit your name and phone yourself.
- Deletion - the Close your account button removes your personal details for good.
- Restriction of how we use it, or an objection to us using it at all.
- Withdrawal of consent at any time, which stops the newsletter without affecting anything else.
- A complaint to your national data protection authority, if you think we have got this wrong.
One thing to be straight about: closing your account does not erase orders you have placed. We are required to keep those records, so we remove your name from them instead of deleting them.
Who else sees it
Only the services we need to run the studio. Each one holds only what its job requires, and all of them are in the EU or covered by an adequacy decision.
| Who | What for | What they see |
|---|---|---|
| Webdock (EU) | Hosting our site and database | Everything, at rest on their servers |
| Resend (EU) | Sending booking confirmations and password resets | Your name and email address |
| Sign in with Google, if you use it | That you signed in |
How it is protected
- The site runs over HTTPS, so what you send is encrypted in transit.
- Passwords are stored as one-way hashes. Nobody at the studio can read yours, including us.
- Links in emails - password resets, booking management - are stored only as hashes, so a copy of our database is not a set of working links.
- The database is not reachable from the internet, and only the studio's own accounts can open the admin area.
If something goes wrong and your data is at risk, we will tell the authority within 72 hours and tell you if the risk to you is high.
Children
Accounts are for adults. Children are welcome at our classes, but a parent or guardian books for them and gives their own details - we do not knowingly hold an account for anyone under 16.
Changes
If we change how we handle your data we will update this page and the date at the top. If a change matters to you, we will say so by email rather than leaving you to notice.