Privacy Policy
1. Data Controller
Surface, which includes the creative studio Studio Surface and the engineering practice Surface Labs, is operated by Amin Gabbani as a sole trader (enskild firma) registered in Sweden.
Ehrensvärdsgatan 2B, 212 13 Malmö, Sweden
Org. Nr: 950112-7535
VAT/USt-IdNr: SE950112753501
For any questions regarding this policy or your personal data, contact us at hello@studiosurface.xyz.
2. Information We Collect
We collect personal information that you voluntarily provide to us when you enquire about our services or engage with us professionally. This includes your name, company name, email address, phone number, service interest, preferred project start date, and project details as submitted through our contact form.
If you book a meeting through our booking page, we receive your name, email address and the time you choose. If you apply for a role with us, we receive the information you send, such as your CV, portfolio and contact details.
If you accept marketing cookies on our website, the LinkedIn Insight Tag also collects technical and usage information about your visit, such as the pages you view, the address of the page you came from, your IP address, and your browser and device details. See section 9.
We do not collect sensitive personal data. We do not purchase, harvest, or otherwise obtain personal data from third party sources.
3. How We Use Your Information
We use the information we collect to respond to your enquiry and communicate with you about your project, to provide, deliver, and improve our services, to consider job applications, to comply with applicable legal obligations, and to protect our rights, property, or safety and that of our clients.
If you accept marketing cookies, we also use the data collected by the LinkedIn Insight Tag to measure how our advertising performs, to show relevant advertising on LinkedIn to people who have visited our website, and to see aggregated information about the kinds of professionals who visit it.
Apart from this advertising measurement and audience building, which depends on your consent, we do not use your information for automated decision-making or profiling.
4. Legal Basis for Processing
Under the EU General Data Protection Regulation (GDPR) and UK GDPR, we process your personal data on the following lawful bases: legitimate interest in responding to your enquiry, considering your application and managing our business relationship, performance of a contract when we are engaged to deliver services, compliance with legal obligations where applicable, and your consent for cookies and similar technologies that are not strictly necessary, including the LinkedIn Insight Tag. You can withdraw your consent at any time, with effect for the future (see section 9).
5. How We Share Your Information
We do not sell, rent, trade, or otherwise disclose your personal information to third parties for their own purposes. We may share your information with service providers who assist in operating our website and delivering our services, such as our website platform provider Squarespace and Google, which provides our email, calendar and booking tools, and with professional advisors, legal authorities, or regulatory bodies where required by law or to protect our legal rights.
If you accept marketing cookies, data collected by the LinkedIn Insight Tag is sent to LinkedIn. See section 9.
Two other services are contacted by your browser when you visit our website. The current weather in Malmö is requested from Open-Meteo, which receives your IP address as part of that request. A typeface used on one of our case pages is loaded from Google Fonts, which also receives your IP address.
All third party service providers are required to process your data in accordance with applicable data protection laws.
6. International Data Transfers
We operate globally and serve clients across multiple jurisdictions. Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA) or the United Kingdom, including the United States. Where such transfers occur, we ensure that appropriate safeguards are in place, such as an adequacy decision, the EU-U.S. Data Privacy Framework where the recipient is certified, or standard contractual clauses approved by the European Commission, to protect your data in accordance with GDPR and UK GDPR.
7. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal, accounting, or reporting obligations, or to resolve disputes and enforce our agreements. When your data is no longer required, it will be securely deleted or anonymised.
We delete CVs, portfolios and other application material 12 months after a recruitment process ends, unless you ask us to keep it for future roles. Data collected by the LinkedIn Insight Tag is kept by LinkedIn in line with LinkedIn's own privacy policy.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.
9. Cookies and Analytics
Our website uses cookies managed by our platform provider, Squarespace, and a cookie banner that asks for your choice. Cookies and similar technologies that are not strictly necessary are only used if you accept them.
LinkedIn Insight Tag. If you accept marketing cookies, our website loads the LinkedIn Insight Tag, a tool provided by LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland) and LinkedIn Corporation. The tag sends information about your visit to LinkedIn, including the pages you view, the address of the page you came from, your IP address, and your browser and device details. We use it to measure the results of our LinkedIn advertising, to show relevant ads on LinkedIn to people who have visited our website, and to receive aggregated reports about the job titles, industries and company sizes of our visitors. LinkedIn does not give us your identity through this tool.
We and LinkedIn Ireland Unlimited Company are jointly responsible for the collection of this data through the tag and its transmission to LinkedIn. LinkedIn is solely responsible for any further processing for its own purposes, which is described in LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy. We do not load the tag until you accept marketing cookies, and we do not load it if your browser sends a Global Privacy Control signal.
You can withdraw your consent at any time by changing your choice in our cookie banner or by clearing your cookies, and you can manage how LinkedIn uses your data for advertising in your LinkedIn account settings under Advertising data. You can exercise your rights against us or against LinkedIn.
Analytics. We use Squarespace Analytics to collect anonymised data about how visitors interact with our website. This information is used to improve our website and does not personally identify you.
10. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data.
Under the EU GDPR and UK GDPR, you have the right to access the personal data we hold about you, to rectify inaccurate or incomplete data, to request erasure of your data, to restrict or object to processing, to data portability, to withdraw your consent at any time, and to lodge a complaint with a supervisory authority. The relevant supervisory authority in Sweden is Integritetsskyddsmyndigheten (IMY).
Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to know what personal information is collected, to request deletion, to opt out of the sale or sharing of personal information, and to non-discrimination for exercising these rights. We do not sell personal information. The advertising tool described in section 9 only runs if you accept marketing cookies, and you can decline it in our cookie banner.
To exercise any of these rights, contact us at hello@studiosurface.xyz. We will respond within 30 days or within the timeframe required by applicable law.
11. Third Party Links
Our website may contain links to third party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to read the privacy policy of any website you visit.
12. Children's Privacy
Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate consent, we will take steps to delete that information.
13. Changes to This Policy
We reserve the right to update this privacy policy at any time. Any changes will be posted on this page with a revised effective date. Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.
14. Governing Law
This privacy policy is governed by the laws of Sweden, without regard to conflict of law principles. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts of Malmö, Sweden, except where mandatory consumer protection laws of your jurisdiction provide otherwise.
Thank you,
Team Surface
