Who we are
Our website address is: https://twentyflowstudio.com. This site is operated by Greta Jeleazcov, based in Lisbon, Portugal. You can reach us at twentyflowstudio@gmail.com.
Workshop registrations
When you sign up for a workshop through our registration form, we collect your name, email address, phone number (if provided), selected workshop date, colour choice for your crochet project, allergies or dietary restrictions, and experience level.
We use this data only to process and confirm your registration, order the right materials, accommodate allergies when preparing snacks, and contact you about schedule changes. Registration data is stored for the duration of our business relationship and afterwards as long as required by Portuguese tax retention rules (typically 10 years for invoice-related data). Non-tax-relevant details, such as allergy information, are deleted no later than 12 months after the workshop.
Contact form
If you use our contact form, we collect the data shown in the form, such as your name, email address, and message, in order to respond to your inquiry. This data is deleted once your inquiry has been resolved, unless we are required to keep it longer for legal reasons.
Photo and social media consent
Photos may be taken during workshops and shared on Instagram or other social media channels run by Twentyflow Studio. This only happens if you explicitly agreed to it in the registration form. You may withdraw this consent at any time by emailing twentyflowstudio@gmail.com; already-published content will be removed promptly where technically possible.
Comments
When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.
An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.
Media
If images are uploaded to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website. We remove EXIF data from images before publishing where possible.
Cookies
This website uses cookies. Full details and your choices are available in the cookie banner shown on your first visit to the site.
If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.
If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.
If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.
Embedded content from other websites
Pages on this site may include embedded content (e.g. videos, images, articles, Instagram posts). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
Who we share your data with
We do not sell your data to third parties. It is only shared with [Form/email service provider, e.g. Formspree] to process your workshop registration, and with [Payment provider, e.g. Stripe] if you pay online. These providers process data on our behalf and are contractually bound to comply with GDPR.
If you request a password reset, your IP address will be included in the reset email.
Legal basis for processing
Processing of your registration data is based on Art. 6(1)(b) GDPR (performance of a contract / pre-contractual measures). The optional photo consent is based on Art. 6(1)(a) GDPR (your consent).
How long we retain your data
If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.
For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.
What rights you have over your data
If you have registered for a workshop, contacted us, or left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we correct or erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.
To exercise these rights, contact us at [your@email.com]. You also have the right to lodge a complaint with the relevant supervisory authority: in Portugal, the CNPD (Comissão Nacional de Proteção de Dados).
Where your data is sent
Visitor comments may be checked through an automated spam detection service. Registration and payment data may be processed by the third-party services listed above, which may be based outside Portugal but within the EU/EEA or under an adequate data protection framework.