PRIVACY POLICY

Who we are

Queen of Compass Studio (“we”, “us”) is a creative digital studio. We run this website and decide how the personal data collected on it is used, which makes us the data controller. For any question about your data, write to us at hello@queenofcompass.com.

This policy covers queenofcompass.com, including the Anúra pages and our payment page, and the emails we exchange with you. Our terms of use cover everything else about using the site.

What we collect and why

• Contact form. Your name, email address, company or brand (if you add it) and your message. We use them to reply, to arrange a call and to send you a copy of your message as confirmation. We do this because you asked us to get in touch.
• Newsletter. Your name and email address. We use them to send you studio news, new projects and creative insights. We do this with your consent, and you can withdraw it at any time. We also keep the date and the page where you subscribed, as a record of your consent.
• Brand Vision Guide. Your name and email address, used to send you the guide you requested.
• Anúra Mala questionnaire. Your name, email address, date of birth and your answers about what you are moving through, releasing and calling in. We use them only to design and make your Mala and to write to you about it. Some answers may touch on your personal or spiritual beliefs; you share them by your own choice, and we never use them for anything else. While you fill in the questionnaire, your answers are saved only in your own browser, so a closed page does not lose them; they reach us when you send the form.
• Payment requests. Your name, email address and country, the company and its website if a company pays, and the service, amount, currency and note you enter. We use them to issue a payment request through Payoneer and to keep the records that accounting law requires.
• Emails you send us. Whatever you choose to write, used to answer you.
• Business enquiries and offers. When an agency, freelancer or supplier writes to us, we keep the contact details and the message to reply and for our business records. You can ask us to delete them at any time.
• Visit statistics. Only if you allow it in our cookie banner, Google Analytics shows us which pages are visited, for how long, from which type of device and browser, from which city or country and how visitors found us. This helps us understand what is useful on the site and improve it. We do not use these statistics to identify you.
• Technical records. Like every web server, ours keeps short-lived records of requests (IP address, browser, time) to keep the site secure and working.

We make no decisions about you by automated means, and we do not build marketing profiles of our visitors.

Please keep sensitive details to yourself

Our forms are made for a first conversation about your brand, and the Anúra questionnaire asks only what we need for your Mala. Please do not send us passwords, bank or card details, identity numbers, health information or any other sensitive data through the forms or by email. If such details reach us without our request, we delete them as soon as we notice them. Where the law allows, we accept no responsibility for sensitive information that was sent to us without our request.

Cookies

We use only a few small cookies:

• PHPSESSID keeps our forms safe from automated spam. It is needed for the forms to work and disappears when you close your browser.
• _ga and _ga_* come from Google Analytics and tell one visit apart from another. They are set only after you choose “Accept all” in our cookie banner, and they last up to two years.
• qoc-cookie-choice is kept in your browser’s local storage and remembers your answer to the cookie banner, so we do not ask you again on every page.
• The Anúra questionnaire keeps a draft of your answers in your browser’s local storage until you send it, and removes it once it is sent.

Until you choose, Google Analytics does not load and nothing is sent to Google. You can change your choice at any time through “Cookie settings” at the bottom of every page; choosing “Essential only” turns Google Analytics off again and removes its cookies.

We use no advertising or tracking cookies from social networks. You can delete or block cookies in your browser settings, and you can turn off Google Analytics on every site with Google’s opt-out add-on. Some browsers send a “Do Not Track” signal; since there is no common standard for it, the site does not respond to it, and the options above remain the reliable way to limit tracking.

Who else sees your data

• Our hosting provider in Serbia stores the website, our email and the newsletter list on its servers and works only on our instructions.
• Google processes visit statistics for Google Analytics. Google may process this data in the United States under the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Payoneer receives the details needed to issue a payment request and to process your payment, under its own privacy policy. You enter card or bank details on Payoneer’s pages; they never reach us.
• Instagram (Meta) receives data only if you follow a link to our profile. From then on, Instagram’s own privacy policy applies.
• Authorities and advisers. We share data when the law, a court or a public authority requires it, and with our lawyers, accountants or insurers when we need their help to protect our rights, our property or the safety of others.
• A new owner. If the studio or its business is ever merged, sold or reorganised, your data may pass to the new owner, who must keep protecting it under this policy.

We never sell or rent your personal data, and we never share it for advertising.

Services run by others

Our hosting provider, Google, Payoneer, Instagram and the websites we link to are independent companies with their own terms, privacy policies and security. We choose reliable providers, and we have no control over how they run their systems. To the extent permitted by law, we are not responsible for their practices, for their outages or for security incidents that happen on their systems.

How long we keep it

• Enquiries and emails: for as long as we are talking or working together, and up to two years after our last contact.
• Newsletter: until you unsubscribe; the record of your consent for up to three years after that.
• Anúra questionnaire: while we make your Mala and up to two years after we deliver it, unless you ask us to delete it sooner.
• Payment requests and invoices: as long as accounting and tax law requires.
• Visit statistics: up to 14 months in Google Analytics.

We keep data longer only when the law requires it (for example, accounting records once we work together) or when we need it to establish or defend a legal claim. Deleted data can remain in our providers’ backups for a short time until those backups are overwritten.

How we protect it

The whole site runs over an encrypted connection (HTTPS). Form messages go straight to our own mailbox, and the newsletter list is kept outside the public part of the server, where only we can open it. Passwords are kept away from the website code, our forms are guarded against automated abuse, and access is limited to the studio team.

Even so, no website, email service or storage can be made completely secure. We take reasonable and appropriate measures for a studio of our size, and we cannot guarantee that data sent over the internet or stored online will never be accessed by someone who breaks the law to reach it.

If something goes wrong

If we learn that personal data may have been exposed, we act at once:

• we stop the incident and secure our systems;
• we find out what happened and which data was affected;
• where the law requires it, we inform the data protection authority within 72 hours;
• if the incident is likely to put you at high risk, we tell you without delay what happened and what you can do to protect yourself;
• we record the incident and improve our protection so it does not happen again.

Limits of our responsibility

To the fullest extent permitted by applicable law, we are not liable for loss or damage caused by:

• unauthorised access, hacking, malware or other attacks carried out by third parties that we could not reasonably prevent despite the protection described above;
• outages, errors or security incidents at our hosting provider or other outside services;
• information you sent to us that we did not ask for, including sensitive details;
• events beyond our reasonable control, such as power or internet failures, natural disasters, war, strikes or decisions of public authorities.

Nothing in this policy limits a liability that the law does not allow us to limit, and nothing in it takes away the rights you have under data protection law.

Your rights

You can ask us at any time to show you the data we hold about you, correct it, delete it, limit how we use it or hand it over to you in a common format. You can object to its use and withdraw any consent you gave; to leave the newsletter, write to us or use the unsubscribe link in any newsletter email. Write to hello@queenofcompass.com and we will answer within 30 days.

To protect you, we may ask you to confirm your identity before we act on a request. We may decline a request that is clearly unfounded or excessive, or keep data that the law obliges us to keep, and we will always tell you why.

If you feel we have not handled your data properly, please write to us first so we can put it right. You can also complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs) or to the data protection authority in the country where you live.

What we ask of you

• Give us accurate details, and let us know when they change.
• Send us personal data about other people (for example, your colleagues) only when you are allowed to share it with us.
• Keep your own devices, email account and passwords safe.

Children

This site is meant for businesses and adults. We do not knowingly collect data from children under 16. If you believe a child has sent us personal data, write to us and we will delete it.

Changes to this policy

When we change how we handle data, we update this page and the date at the top. If the change is important, we will also tell our newsletter subscribers by email. The version published here is the one that applies.

Language

This policy is written in English. If we publish it in another language, the English version prevails wherever the two differ.