Privacy Policy

1. Controller

The Monday Club Studio, SLU
17 Carrer Bearn
Pas de la Casa, Encamp AD200
Principality of Andorra

Represented by: Jan Dimitri Schüpbach
Email: smile@themondayclub.studio

We are not required to appoint a Data Protection Officer, as we neither process special categories of data on a large scale nor systematically monitor behaviour. For any privacy question, write to the address above.

2. Applicable law

We are established in Andorra and subject to the Andorran data protection act (Llei 29/2021 qualificada de protecció de dades personals) and the supervision of the Agència Andorrana de Protecció de Dades (APDA).

Because we offer our services to businesses in the European Union, the General Data Protection Regulation (GDPR) also applies under Art. 3(2). For individuals in Switzerland, the Swiss Federal Act on Data Protection (revFADP) applies in addition.

Where these frameworks differ, we apply the stricter standard.

3. What we process, why, and on what legal basis

3.1 Visiting the website

When you visit themondayclub.studio, your browser transmits technically necessary data to our hosting provider Vercel Inc.: IP address, date and time, page requested, volume of data transferred, referrer URL, browser type and operating system.

• Purpose: delivering the website, keeping it stable and secure
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a functioning and secure web presence
• Retention: Vercel retains these log records for a limited, plan-dependent period of no more than 30 days, after which they are deleted automatically. We keep no further copies and maintain no persistent log file of our own.
• Objection: you may object under Art. 21 GDPR. Without this data we cannot technically deliver the website.

3.2 Contacting us by email or contact form

When you write to us, we process your name, email address, company and role if provided, and the content of your message.

• Purpose: answering your enquiry, assessing a possible engagement
• Legal basis: Art. 6(1)(b) GDPR for enquiries leading towards a contract; Art. 6(1)(f) GDPR for all other enquiries, our legitimate interest in communicating with prospective clients
• Retention: until your enquiry is fully handled. If it does not lead to an engagement, we delete the correspondence no later than twelve months after the last contact.
• Required fields: providing data is voluntary. Without a name and email address we cannot reply.

3.3 Booking a call

For fit calls and conversations we use Cal.com, provided by Cal.com, Inc., San Francisco, California, USA. The booking window is embedded in our website as a widget.

When you load the page, your browser connects to Cal.com's servers to load the widget. Your IP address is transmitted to Cal.com in this process, even if you do not book a call.

When you book, Cal.com additionally processes your name, email address, chosen slot, time zone, and any optional details from the booking form.

• Purpose: scheduling and calendar coordination
• Legal basis: for loading the widget, Art. 6(1)(f) GDPR, our legitimate interest in frictionless scheduling. For the booking itself, Art. 6(1)(b) GDPR, pre-contractual steps taken at your request.
• Retention: for as long as the booking is managed, then per the periods under 3.2
• Processing agreement: we have a data processing agreement with Cal.com under Art. 28 GDPR. Their privacy policy also applies: cal.com/privacy
• Third-country transfer: see section 6

3.4 Delivering client projects

If we work together, we process contact details of the people involved, contract and billing data, and the correspondence generated during the project.

• Purpose: delivering the engagement, invoicing, meeting legal obligations
• Legal basis: Art. 6(1)(b) GDPR for performing the contract, Art. 6(1)(c) GDPR for commercial and tax retention duties
• Retention: for the duration of the engagement. Accounting records are retained afterwards for the periods required by Andorran commercial and tax law.

Where a project involves us processing personal data belonging to your users or staff, for example in user research or when accessing your systems, we act as a processor on your instructions. A separate data processing agreement governs this.

3.5 Measuring page speed

To find out whether individual pages load too slowly, we use Vercel Speed Insights, a service of our hosting provider Vercel Inc. On each page view your browser measures technical performance metrics (Core Web Vitals) and reports them to Vercel.

The following is transmitted: the page requested, the measured performance values together with the page element they relate to, the approximate connection speed, browser, device type and operating system, your country as a country code, and the time of measurement.

The service sets no cookies, stores nothing in your browser, and assigns no identifier. Your IP address is not stored. Individual measurements cannot be joined into a session or attributed to a person.

• Purpose: finding and fixing performance problems
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a website that is quick to use. Because no information is stored on or read from your device in the process, no consent under § 25 TDDDG is required.
• Processing agreement and third-country transfer: as for Vercel under sections 5 and 6

4. Cookies and local storage

This website uses no advertising cookies, no profiling, and no analytics tracking that recognises you across page views. The performance measurement described in 3.5 works without cookies and without any identifier. We store exactly one technical marker, and it is strictly necessary to operate the site:

• NEXT_LOCALE (cookie, 12-month lifetime): records whether you read the site in English or German. We set it when the site redirects you to your language on a first visit, and when you switch language yourself using the footer.

It contains no personal data, it never leaves your browser, and it is not analysed.

• Legal basis: § 25(2)(2) TDDDG (Germany) and the equivalent national implementations of the ePrivacy Directive. Strictly necessary storage requires no consent, which is why you see no consent banner.

If we introduce analytics or marketing tools in future, we will ask for your consent first and update this policy.

5. Service providers and recipients

We share data only where necessary for the purposes above. The following categories of recipients are involved:

We have data processing agreements under Art. 28 GDPR with every provider that processes personal data on our behalf. Network partners are additionally bound by confidentiality obligations and are only engaged with the relevant client's consent.

We do not sell data and we do not share it for advertising purposes.

6. Transfers to third countries

Andorra and Switzerland. Our company is established in Andorra; our network partners work from Switzerland and Germany. The European Commission has adopted adequacy decisions for both Andorra and Switzerland. This means it has determined that the level of data protection there is equivalent to the EU's, so transfers require no additional safeguards.

United States. Three of our service providers process data in the US, or may do so:

• Vercel Inc. (hosting) is certified under the EU-US Data Privacy Framework. By its decision of 10 July 2023, the European Commission determined that certified US companies provide an adequate level of protection. Vercel's Data Processing Addendum, including the Standard Contractual Clauses, applies in addition.
• Google LLC (Google Workspace) is likewise certified under the EU-US Data Privacy Framework. Our contracting entity is Google Ireland Limited, established in the EU; Google LLC acts as a sub-processor. The Standard Contractual Clauses in the Google Cloud Data Processing Addendum apply.
• Cal.com, Inc. (scheduling) processes data on the basis of the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR.

For each of these transfers we have assessed whether additional safeguards are required. Only contact and scheduling data is transferred, never special categories of data within the meaning of Art. 9 GDPR.

If we engage further providers outside this area in future, we will likewise base the transfer on an adequacy decision or on Standard Contractual Clauses, and update this policy.

7. Security

The website is served exclusively over TLS-encrypted connections. Access to client and project data is limited to the people who need it for their work. We use two-factor authentication and encrypted storage.

8. No automated decision-making

We make no decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. We do not carry out profiling.

9. Your rights

You have the right at any time to:

• Access the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure, unless a legal retention obligation applies (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a structured, commonly used, machine-readable format (Art. 20 GDPR)
• Object to processing we base on legitimate interests (Art. 21 GDPR)
• Withdraw consent at any time, with effect for the future (Art. 7(3) GDPR)

An informal email to smile@themondayclub.studio is enough. We respond within one month. Comparable rights apply under Andorra's Llei 29/2021 and the Swiss revFADP.

10. Right to complain

If you believe we are not processing your data lawfully, you can lodge a complaint with a supervisory authority:

• Andorra: Agència Andorrana de Protecció de Dades (APDA), apda.ad
• EU: the data protection authority of your country of residence, place of work, or the place of the alleged infringement
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch

Telling us first is welcome but not a precondition.

11. Changes to this policy

We update this policy when our processing or the legal situation changes. The version published on this page applies. The date at the top shows when it was last updated.