Who we are

This Privacy Policy describes how Wolfsbane Creations (“we”, “our”, “us”) collects and processes personal data.

Wolfsbane Creations is a business based in the Netherlands providing graphic design and web development services, primarily aimed at dog breeders and owners.

Wolfsbane Creations
Adelaarstraat 20
3145 AA Maassluis
Netherlands
Email: info@wolfsbanecreations.com
KvK number: 62669354

What personal data we process

Personal data means any information relating to an identified or identifiable natural person. The only personal data we handle is the data you voluntarily provide to us by e‑mail or by attaching files to that e‑mail. We do not collect data automatically (e.g., via cookies, web‑forms, analytics, or advertising networks).

The data we receive may include the following categories:

• Contact information – name, email address, phone number
• Message content – the text of your inquiry or any instructions you include.
• Photos or other attachments – e.g., pictures of dogs, screenshots, design assets, or any files you attach.
• Payment information – bank account name and IBAN (for direct bank transfers) or PayPal account email/transaction ID (when the client pays via PayPal).

Purpose and legal basis for processing

We process your personal data only for the purposes listed below, and each purpose is supported by a specific legal basis under the GDPR (Article 6).

Contract
We process certain personal data when it is necessary to respond to your request for services or to perform the agreement for the services you have requested.

• Reading and responding to your e‑mail inquiries so that we can provide the service you have requested.
• Storing any photographs, design assets, or other files you supply while we create the final graphic, website, or other deliverable.
• Verifying receipt of payment and recording the payment information necessary to confirm that the transaction has been completed (such as the account name and IBAN or PayPal transaction details).

Legitimate Interest

We process certain personal data based on our legitimate interests as a business. These interests include maintaining records of communications and promoting our services through our portfolio.

• Storing e-mail correspondence for a reasonable business archive so that we can refer back to previous communications if a follow-up is needed, maintain an accurate record of our business communications, and handle potential questions or disputes.
• Keeping a copy of the completed work so that we can showcase the project in our public portfolio and marketing materials. Before relying on legitimate interests, we assess whether our interests are overridden by your rights and freedoms. If you object to your project being displayed in our portfolio, we will remove it upon request.

Legal Obligation

We process certain personal data when required to comply with applicable legal obligations.

• Retaining payment records, invoices, and receipts for the period required under applicable Dutch tax legislation and administrative obligations.
• Providing information to tax authorities or other competent bodies when we receive a lawful request.

Third-Party processors

We engage the following external services that receive personal data in order to provide our services. For each processor we state the purpose, the categories of data transferred, the legal basis we rely on, any cross‑border transfer safeguards, and a link to the processor’s own privacy notice.

Proton Mail – email communication
All client e‑mail is routed through Proton Mail. Proton receives the sender’s name, e‑mail address, the IP address that appears in the mail header, and the message metadata (subject line, timestamps). The content of the email (including any text, attachments, or personal data you include) is end‑to‑end encrypted on your device, so only you and the intended recipient can read it. This processing is carried out on the basis of contract as it is necessary to communicate with you, respond to your enquiries, and provide the services you have requested. Proton’s data centres are located in Switzerland, which the European Commission has recognised as providing an adequate level of data‑protection.
More information: https://proton.me/privacy

Proton Drive – file storage
We store the original PSD files on Proton Drive. The files may contain personal data (e.g., a client’s name or e‑mail address) but they are fully end‑to‑end encrypted, so the contents are inaccessible to Proton. This processing is carried out on the basis of contract as it is necessary to create, store, and deliver the project files you have commissioned. Proton’s data centres are in Switzerland, which the European Commission has recognised as providing an adequate level of data‑protection.
More information: https://proton.me/privacy

Hostinger – website hosting
We use Hostinger to host our website. Hostinger stores the IP address, timestamp, requested URL and browser/device information of every visitor. This data is used solely for server operation, security monitoring, troubleshooting and compliance with legal obligations. This processing is carried out on the basis of legitimate interest to ensure the availability, security and integrity of the service. All hosting facilities are situated in the EU, so no cross‑border transfer occurs.
More information: https://www.hostinger.com/legal/privacy-policy

PayPal – payment processing
We use PayPal to accept international payments. PayPal receives your name, e‑mail address, the PayPal‑registered account identifier and the transaction reference. This processing is carried out on the basis of contract to complete the purchase, with additional processing for fraud detection and AML compliance based on legal obligation. Data may be stored outside the EEA; we rely on the EU‑U.S. adequacy decision.
More information: https://www.paypal.com/us/legalhub/privacy-full

Stripe – payment processing
We use Stripe to accept international payments. Stripe receives your name, e‑mail address, payment card details (or other payment method information), and the transaction reference. This processing is carried out on the basis of contract to complete the purchase, with additional processing for fraud detection and AML compliance based on legal obligation. Data may be stored outside the EEA; we rely on Standard Contractual Clauses approved by the European Commission.
More information: https://stripe.com/privacy

ING – payment processing
We use ING to accept international payments. When you pay by direct bank transfer or through iDEAL/Wero, ING will record the account holder’s name, IBAN and the transaction reference. This processing is carried out on the basis of contract to complete the purchase, with additional processing for fraud detection and AML compliance based on legal obligation. ING’s data centres are located in the Netherlands (EEA), so no cross‑border transfer occurs.
More information: https://www.ing.nl/de-ing/privacy-statement

How long we keep the data

Email correspondence
What we keep: name, email address, phone number and the content of the messages you send.
Retention period: 12 months after the last interaction with you.
Why: This period is enough for us to keep a reasonable business record, resolve any disputes, and honour any post‑delivery support that may be required.

Photographs, design assets and other attachments
What we keep: any pictures, logos, sketches or other files you provide for a graphic design or web development project.
Retention period: 30 days after we have delivered the final product to you, unless you specifically ask us to keep them longer.
Why: The files are needed only while the design is being created. Once the project is finished they are deleted to minimise any exposure of personal data.

Original Photoshop (PSD) files
What we keep: the working PSD file that we use to produce the final JPEG/PNG.
Retention period: 12 months after the final image has been delivered.
Why: The PSD is a temporary working copy that we retain for up to 12 months so that we can accommodate post-delivery modification requests from the client. After this period the file is permanently deleted.

Portfolio copies
What we keep: a copy of the final JPEG/PNG image that is used in our public portfolio or marketing materials.
Retention period: indefinitely (or until you request its removal).
Why: The final image serves as a showcase of the work we have completed. Displaying examples of previous projects allows us to demonstrate our design capabilities to prospective clients and forms part of our legitimate business interests. We take care not to publish personal contact details of clients in our portfolio. If you prefer that your project not be displayed publicly, you may object at any time and we will remove the image from our portfolio upon request.

Payment record information
What we keep: client’s name, transaction date and amount.
Retention period: 7 years
Why: We are legally obliged to retain these records for tax and accounting purposes.

Invoices and receipts (if issued to the client)
What we keep: a copy of the invoice or receipt, which contains the client’s name (or company name) and address, invoice number, invoice date, description of the goods/services, amount charged, and our business information.
Retention period: 7 years
Why: We are legally obliged to retain these records for tax and accounting purposes.

Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. These measures include the use of encrypted communication services, secure file storage, and limiting access to personal data to only those systems necessary to provide our services.

Email communications are handled through Proton Mail and project files are stored in Proton Drive, both of which provide end-to-end encryption. Our website infrastructure is hosted by Hostinger within the European Union and is protected by standard server-level security controls.

While we take reasonable steps to protect personal data, no method of transmission over the internet or electronic storage is completely secure. We therefore cannot guarantee absolute security, but we continually review our practices to maintain an appropriate level of protection.

Your rights under the GDPR

As a data subject you have the following rights, which you can exercise at any time:

• Right of access – you may obtain a copy of the personal data we hold about you.
• Right to rectification – you can ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) – you may request that we delete your e‑mail address and any associated correspondence.
• Right to restriction of processing – you can ask us to temporarily halt processing of your data.
• Right to data portability – you may receive your data in a structured, commonly used electronic format.
• Right to object – you can object to any processing of your personal data, including processing based on legitimate interests.
• Right to withdraw consent – where we rely on your consent to process personal data, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before the consent was withdrawn.
• Right to lodge a complaint – if you believe we have violated the GDPR, you may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

If you wish to exercise any of the rights described above, please contact us at info@wolfsbanecreations.com. We will respond to your request without undue delay and at the latest within one month of receiving it, as required under Article 12(3) of the GDPR.

Changes to this Privacy Policy

We may update this privacy policy from time to time to reflect changes in the law or in our practices. If the changes are material, we will notify clients by placing a prominent notice on the website.

Contact us

If you have any questions, concerns, or wish to exercise any of your rights, please contact us.

Wolfsbane Creations
Adelaarstraat 20
3145 AA Maassluis
Netherlands
Email: info@wolfsbanecreations.com
KvK number: 62669354