1. Who controls your data
Spatialist is the controller for account, project, marketplace and support data. The controlling legal entity is the Spatialist operator identified in your project contract or invoice. Its registered name, office, company number and VAT number must be published here before public payment activation. Privacy enquiries and rights requests can be sent to office@spatialist.studio.
Stripe acts as an independent controller for certain identity, compliance, fraud-prevention and payment activities and as a processor for certain services, as described in Stripe’s own privacy documentation and data-processing agreement.
2. Data we process
- Identity and account data: name, email, user identifier, role, country and account status.
- Professional data: business identity, qualifications, portfolio and Stripe Connect verification status. Stripe receives identity documents and bank details directly; Spatialist is designed not to store full card or bank-account numbers.
- Project data: briefs, counterparties, proposals, milestones, deliverables, decisions, messages and dispute evidence.
- Payment records: amounts, currency, fees, Stripe references, funding, refund, dispute and transfer status.
- Consent and audit data: accepted policy versions, timestamps and material project events.
- Security and technical data: limited request, device and diagnostic information required to protect and operate the service.
Please do not upload special-category data, government identifiers, building access codes or unrelated personal information unless specifically requested through a secure, lawful process.
3. Why we use data and our legal bases
4. Payments and Stripe
Stripe processes checkout, card authentication, professional onboarding, identity verification, fraud checks, connected-account balances and payouts. Card details are entered into Stripe-controlled interfaces and are not intended to pass through Spatialist servers. We retain Stripe object identifiers and transaction status so that we can operate milestones, refunds, releases and disputes.
Stripe may process data outside the EEA under its applicable Data Processing Agreement, Data Transfers Addendum, Standard Contractual Clauses and other lawful safeguards.
5. Who receives data
We disclose only what is necessary to:
- the client and professional working on the same project;
- Stripe and its banking, identity and fraud-prevention partners;
- hosting, security, email, support and professional advisers acting under appropriate obligations;
- tax, judicial, regulatory or law-enforcement bodies where legally required; and
- a successor in a properly safeguarded merger, financing or business transfer.
Spatialist does not sell personal data. It does not share project data for third-party behavioural advertising.
6. International transfers
Where data is accessed outside the EEA, we use an adequacy decision, the European Commission’s Standard Contractual Clauses, the EU–US Data Privacy Framework where valid and applicable, or another lawful safeguard. We assess supplementary measures where required and minimise the data transferred.
7. Retention
We delete or anonymise data when the relevant period ends unless a legal hold, unresolved dispute or statutory duty requires longer retention.
8. Your GDPR rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability or objection; withdraw consent without affecting earlier lawful processing; and object to direct marketing at any time. You may also complain to your local supervisory authority or to Romania’s ANSPDCP.
Send a request to office@spatialist.studio. We may need proportionate identity verification. We normally respond within one month, with any lawful extension explained. Rights can be limited where data must be retained for tax, payment, fraud or legal-claim obligations.
9. Automated decisions
Spatialist does not currently make solely automated decisions that produce legal or similarly significant effects. Stripe and financial institutions may use automated fraud, sanctions and authentication systems under their own responsibilities. Where applicable law provides a right to human review, contact us and we will direct or assist the request.
10. Cookies and local storage
The site stores a theme preference on your device and may use strictly necessary security, authentication and payment technologies. These are required to provide a service you request. Spatialist will not activate analytics, advertising or other non-essential cookies for EU visitors without prior, specific consent and an equally easy way to withdraw it.
11. Security and privacy by default
Measures are designed to include least-privilege access, server-side authorisation, encrypted transport, Stripe-hosted payment collection, data minimisation, separated payment identifiers, signed webhook verification, idempotent payment actions, audit trails, backups and incident procedures. No service can promise absolute security; controls must be reviewed as the platform, risks and law change.
Where a personal-data breach is likely to risk individuals’ rights, Spatialist will assess notification to the competent authority within the legally required period and notify affected people where the risk is high.
12. Children
Spatialist is intended for adults and business users. We do not knowingly offer accounts or payment services to anyone under 18.
13. Changes and launch readiness
We will post material changes with a new effective date and provide additional notice where required. Before public payment activation, Spatialist must complete and document its controller identity, processor register, records of processing, retention ownership, security response plan, lawful-transfer review, consumer flow and, where risk requires it, a data-protection impact assessment. This statement supports GDPR transparency but cannot by itself guarantee compliance in every EU jurisdiction.