LEGAL // PRIVACY
Privacy and Cookie Policy
Last updated: 15 June 2026
1. Who we are
Studio WLWYB is a B2B creative studio specializing in custom LEGO builds and commissions for organizations. We are the data controller for all personal data collected through this website.
Contact: [email protected]
2. What we collect and why
Plausible Analytics (always active, no consent required)
We use Plausible Analytics for site statistics. Plausible is privacy-first: it collects no personal data, sets no cookies, does not use fingerprinting, and is fully GDPR compliant without consent. Data collected: page views, referrer, device type, country. Data is aggregated and anonymous. Legal basis: legitimate interests.
Analytics cookies (requires consent)
When you accept analytics cookies:
- Google Analytics 4 records page views, user journeys, and conversion events. Legal basis: consent (Article 6(1)(a) GDPR).
- Microsoft Clarity records heatmaps and anonymized session replays to help us improve the site. Legal basis: consent.
Marketing cookies (requires consent)
When you accept marketing cookies:
- Meta Pixel tracks ad performance and enables retargeting on Meta platforms. Legal basis: consent.
- LinkedIn Insight Tag tracks ad performance and enables B2B audience targeting on LinkedIn. Legal basis: consent.
Necessary (no consent required)
Required for the site to function:
- Shopify sets cart and session cookies on shop.wlwyb.com for checkout. Legal basis: contract performance.
- Cloudflare Turnstile sets a short-lived token for bot protection on form submissions. Legal basis: legitimate interests.
Contact and booking data
When you submit the contact form, we collect your name, contact details, and message. This is stored by Postmark (our email provider) and used solely to respond to your enquiry. Legal basis: legitimate interests. Retention: up to 12 months. When you book a call, Cal.com processes your name, email, and meeting details. See Cal.com's privacy policy for their data handling.
3. Cookie table
| Tool | Category | Cookies | Duration | Purpose |
|---|---|---|---|---|
| Plausible Analytics | None | None (cookieless) | n/a | Aggregated page analytics |
| Google Analytics 4 | Analytics | _ga, _ga_* |
13 months | Behaviour analytics, conversions |
| Microsoft Clarity | Analytics | CLID, _clck, _clsk |
Up to 1 year | Heatmaps, session replay |
| Meta Pixel | Marketing | _fbp |
90 days | Ad retargeting |
| LinkedIn Insight Tag | Marketing | li_sugr |
90 days | B2B audience and conversions |
| Shopify | Necessary | cart, _secure-session |
Session / 30 days | Cart and checkout |
| Cloudflare Turnstile | Necessary | cf_clearance |
30 min | Bot protection on forms |
4. Sub-processors
We use the following data processors. Where processors are located outside the EEA, transfers are covered by Standard Contractual Clauses (SCCs) or an adequacy decision.
| Processor | Service | Location |
|---|---|---|
| Plausible Analytics | Cookieless analytics | EU (Lithuania) |
| Google LLC | GA4, Search Console | US (SCCs) |
| Microsoft Corporation | Clarity heatmaps | US (SCCs) |
| Meta Platforms Inc. | Advertising pixel | US (SCCs) |
| LinkedIn Corporation | Advertising Insight Tag | US (SCCs) |
| Shopify Inc. | Commerce platform | CA/US (SCCs) |
| Netlify Inc. | Web hosting | US (SCCs) |
| Postmark / ActiveCampaign | Transactional email | US (SCCs) |
| Cal.com Inc. | Booking software | US (SCCs) |
| Cloudflare Inc. | Bot protection | US (SCCs) |
5. Your rights
Under GDPR you have the right to:
- Access personal data we hold about you
- Erasure (right to be forgotten)
- Portability of your data in a machine-readable format
- Restriction of processing
- Object to processing based on legitimate interests
- Withdraw consent at any time without affecting the lawfulness of prior processing (use Cookie Settings below)
- Lodge a complaint with your national supervisory authority
To exercise any of these rights, contact us at [email protected]. We respond within 30 days.
6. Data retention
Contact form submissions are retained for up to 12 months. Analytics data retention is governed by the individual tool settings (GA4: 14 months, Plausible: indefinitely but aggregated and anonymous). Cookie lifetimes are listed in the table above. No payment data is processed or stored on our servers; checkout is handled entirely by Shopify.
7. Changes to this policy
We update this policy when our data practices change. The "Last updated" date at the top reflects the most recent revision. Continued use of the site after an update constitutes acceptance of the revised policy.
8. Cookie settings
You can review and change your cookie preferences at any time. Withdrawing consent does not affect data already collected.