This Privacy Policy explains how Soft Still Drift processes personal data in connection with the Sites and the tip jar.
It is issued under the General Data Protection Regulation and applicable Dutch privacy law.
This Privacy Policy should be read together with the Terms of Use. Defined terms used here have the meaning given in the Terms of Use unless this Privacy Policy states otherwise.
1. Controller
The controller is Soft Still Drift, a natural person established in the Netherlands, trading as Soft Still Drift.
Requests under this Privacy Policy, including requests to exercise data protection rights, must be sent through the Contact page.
2. Scope
This Privacy Policy applies to:
- the Sites;
- voluntary donations processed through Stripe;
- correspondence sent through the Contact page.
Stripe processes payments and is an independent controller for its own fraud-prevention, account, and platform purposes. Fastmail provides the email service used to receive and send correspondence. Cloudflare hosts the Sites.
3. Personal data that is processed
Soft Still Drift does not require you to create an account on the Sites. Soft Still Drift does not operate first-party analytics, advertising cookies, or a comments system on the Sites.
Depending on how you interact, the following categories of personal data may be processed.
Usage and technical data. Cloudflare hosts the Sites and may record ordinary server logs. A log may include Internet Protocol address, browser type, requested address, referring address, and date and time. This is processed in order to operate, secure, and maintain the Sites. See Cloudflare's privacy policy.
Correspondence. If you send a message through the Contact page, the name you give, email address, message content, and related metadata are processed in order to receive and respond to the message. Fastmail provides the mailbox. See Fastmail's privacy policy.
Donations. If you make a donation, Stripe processes identity data, contact data, payment data, amount, and whether the donation is one-time or recurring. Soft Still Drift may receive your name, email address, amount, currency, date, and whether the donation is one-time or recurring. Soft Still Drift does not receive full payment card numbers. See Stripe's privacy policy.
Journal. An entry may include a photograph and a link to a film on YouTube or another platform. That platform has its own privacy policy. Photographs, logos, icons, and other site files are served from assets.softstilldrift.com.
Photos. A page shows one photograph, served from assets.softstilldrift.com.
The Sites may contain links to third-party websites and platforms. Those parties process personal data under their own policies once you leave the Sites.
4. Purposes and legal bases
Personal data is processed only where a legal basis under Article 6 of the General Data Protection Regulation applies.
Performance of a contract, or steps at your request (Article 6(1)(b)). Responding to a request you send. Completing a donation you choose to make.
Legal obligation (Article 6(1)(c)). Keeping accounting and tax records of donations for the period required by Dutch law.
Legitimate interests (Article 6(1)(f)). Operating, securing, and maintaining the Sites, including server logs. Establishing, exercising, or defending legal claims. Those interests are balanced against your rights.
Soft Still Drift does not use personal data to build marketing profiles, does not sell personal data, and does not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.
5. Recipients
Personal data may be disclosed to:
- Stripe, for donations;
- Fastmail, for email;
- Cloudflare, for hosting, delivery, and security of the Sites, including server logs;
- professional advisers, public authorities, or courts, where required by law or where necessary to establish, exercise, or defend legal claims.
Each of Stripe, Fastmail, and Cloudflare publishes its own privacy policy, which governs that provider's processing.
6. International transfers
Stripe, Fastmail, and Cloudflare operate outside the European Economic Area as well as within it. Where personal data is transferred outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission where one exists, or on appropriate safeguards such as standard contractual clauses, as described in the relevant provider's documentation.
7. Retention
Server logs. For the period retained by Cloudflare, limited to what is needed to operate and secure the Sites.
Correspondence. For as long as needed to handle the matter, and thereafter for a reasonable period in case of follow-up or a legal claim.
Donation records. For the period required by Dutch accounting and tax law, which is in principle seven years from the end of the relevant year.
Where a provider retains data in its own role as controller, that provider's retention rules apply to that processing.
8. Security
Soft Still Drift takes appropriate technical and organisational measures to protect personal data, taking into account the nature of the data, the limited scope of the processing, and the risks. No method of transmission or storage is completely secure.
9. Cookies
The Sites do not set first-party tracking or advertising cookies. Cloudflare may set cookies that are necessary to deliver and secure the Sites. A third-party site you visit after following a link, including Stripe's payment pages and YouTube, may set its own cookies under its own policy.
10. Your rights
Subject to the conditions in the General Data Protection Regulation, you have the right to:
- access your personal data;
- rectify inaccurate personal data;
- erase personal data;
- restrict processing;
- object to processing based on legitimate interests;
- receive personal data you have provided, in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where the legal basis is contract and the processing is carried out by automated means.
To exercise these rights, use the Contact page. You may be asked to provide enough information to verify that the request comes from you.
You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch supervisory authority, or with another supervisory authority in the European Union in the place of your habitual residence, your workplace, or the place of the alleged infringement.
11. Children
The Sites are not directed at children under 16 years of age. Soft Still Drift does not knowingly collect personal data from children under 16. If you believe such data has been provided, use the Contact page so that it can be deleted.
12. Changes
Soft Still Drift may amend this Privacy Policy by publishing a new version on this page and updating the date at the top. The new version applies from that date. Where a change is material, Soft Still Drift will take such additional steps to inform you as the law requires.
13. Contact
Use the Contact page.