01Who are we?
THE REAL MAG. is the trading name of XR-Studio B.V., registered at Risseweg 22 F, 6004 RM Weert, the Netherlands, with the Dutch Chamber of Commerce under number 74916556. We are the controller within the meaning of the GDPR (art. 4(7)).
Contact: [email protected] · +31 (0)45 572 1090 · Risseweg 22 F, 6004 RM Weert, the Netherlands.
02Which data do we process?
| Category | Example | Legal basis |
|---|---|---|
| Contact details | Name, email, phone, company name | Performance of a contract / legitimate interest |
| Project data | Briefings, photos, product data, 3D files | Performance of a contract |
| Communication history | Email, meeting reports, minutes | Performance of a contract |
| Invoicing data | Company address, VAT number, IBAN | Legal obligation |
| Technical data | IP address, user agent (anti-spam) | Legitimate interest |
| Marketing data | Newsletter sign-up, preferences | Consent |
03Why do we process them?
- To answer your question and carry out your project (art. 6(1)(b) GDPR, performance of a contract).
- To keep our records and send invoices (art. 6(1)(c), legal obligation).
- To improve our services and occasionally send you marketing you have consented to (art. 6(1)(a) and (f)).
- To prevent misuse of our forms (anti-spam, legitimate interest).
04How long do we keep them?
- Contact requests without a follow-up: no longer than 24 months after the last contact.
- Project files: no longer than 7 years after completion (statutory retention for tax purposes).
- Invoicing data: 7 years (statutory retention for tax purposes).
- Marketing lists: for as long as you are subscribed. You can unsubscribe at any time with one click under every newsletter.
- Anti-spam logs: no longer than 30 days.
05Who do we share them with?
We share data only with the partners we need in order to deliver our service, and with a data processing agreement for each of them:
- Hosting: our web server in the Netherlands (TransIP)
- SMTP and email: Google Workspace for business mail
- Bookkeeping: e-Boekhouden and our accountant Salarisdesk Nederland
- AI rendering: hosted AI models under strict data processing agreements
We never sell your data on to third parties for marketing purposes.
06International transfers
We aim to keep all data inside the EU. Where that is not possible (with a US SaaS supplier, for instance, or a specific AI model), we rely on EU Standard Contractual Clauses (SCCs) or an adequacy decision of the European Commission. On request we will tell you which parties this concerns.
07Cookies
We use a minimal set of functional cookies (language preference, the cookie consent itself). Optionally: analytical cookies if you consent to them through our cookie banner. We use no marketing or tracking cookies. You can withdraw your consent at any time by deleting cookies in your browser or through the banner.
08AI and client data
We process client material (photos, 3D models, briefings) inside our secured infrastructure. We never use client input to train public AI models. Our AI providers work under enterprise contracts in which use for training is explicitly excluded.
09Your rights
Under the GDPR you have the right to:
- Access your data (art. 15)
- Rectification of incorrect data (art. 16)
- Erasure (the right to be forgotten, art. 17), in so far as no statutory retention period applies
- Restriction of processing (art. 18)
- Objection to processing (art. 21)
- Data portability, a copy in a machine-readable format (art. 20)
- Lodging a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl)
Send requests to [email protected]. We respond within one month. If there is any doubt about your identity, we may ask for additional identification.
10Security
We protect your data with TLS encryption in transit, strong passwords, two-factor authentication on critical systems, encrypted backups and strictly role-based access control. If we suspect a data breach that puts individuals at risk, we report it to the Dutch Data Protection Authority within 72 hours and inform anyone directly affected.
11Changes to this statement
We may amend this statement when regulation or our service requires it. We announce material changes on this page and, where relevant, by email. The current version is always at therealmag.eu/privacy/.