Privacy Policy

1. Scope and Applicability

This Privacy Policy applies to all personal information processed by Studio998 ("we", "us", "our") in connection with: (a) the delivery of digital operations, payment processing, compliance, infrastructure and advisory services to business clients; (b) the operation of the website studio998.com; and (c) communications with prospective clients, partners and vendors.

Where Studio998 processes personal data on behalf of a client under a written service agreement, the client is the data controller and Studio998 acts as data processor. This Policy does not override the terms of any executed Data Processing Addendum (DPA).

2. Information We Collect

2.1 Information You Provide

We collect business contact details (name, work email, phone number, job title), company registration information, billing addresses and payment instructions when you engage our services or submit an enquiry through our website.

2.2 Information Collected Automatically

When you visit studio998.com, our servers log IP address, browser type, operating system, referring pages and timestamps. The website itself sets no cookies and uses no client-side storage, analytics tools or tracking technologies; the only third-party requests its pages make are to the Google Fonts CDN, as described in our Cookie Policy.

2.3 Information from Third Parties

For KYC/AML compliance we may obtain identity verification data, sanctions-screening results, beneficial ownership records and adverse media reports from authorized third-party providers. This may include government-issued identification numbers, date of birth and business registration documents where required by applicable law.

3. How We Use Information

We use collected information solely to: deliver and maintain contracted services; verify identity and conduct sanctions screening; process transactions and issue invoices; detect and prevent fraud, money laundering or other illegal activity; communicate service updates, security alerts and support responses; improve platform reliability and performance analytics; and comply with legal, regulatory and tax obligations.

4. Legal Bases for Processing (GDPR)

For individuals in the EEA, UK or Switzerland, we rely on the following legal bases under Article 6(1) GDPR:

Contract performance (Art. 6(1)(b)) — processing necessary to deliver services under our agreement with you.
Legal obligation (Art. 6(1)(c)) — AML/KYC verification, tax record-keeping, sanctions screening.
Legitimate interests (Art. 6(1)(f)) — network security, fraud prevention, service analytics, internal administration. We conduct a balancing test and do not override your interests.
Consent (Art. 6(1)(a)) — marketing communications, where required. You may withdraw consent at any time.

6. International Data Transfers

Personal data is stored and processed primarily in the United States. Where we transfer data originating from the EEA, UK or Switzerland to the US, we rely on: EU-approved Standard Contractual Clauses (Module 2: controller-to-processor); the UK International Data Transfer Addendum; or an applicable adequacy decision. We conduct transfer impact assessments and implement supplementary technical measures (encryption in transit and at rest) where required.

7. Data Retention

We retain personal data according to the following schedule:

Client account data — for the duration of the service relationship plus 7 years after termination, to satisfy anti-money-laundering, tax and financial record-keeping obligations under the Bank Secrecy Act and IRS regulations.
KYC/CDD records — 5 years from the date the business relationship ends, per FinCEN guidance.
Website server logs — 14 months for hosting server access logs. studio998.com runs no analytics tools, so no website analytics data is collected or retained.
Marketing communications — until consent is withdrawn or 24 months of inactivity, whichever occurs first.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymized.

8. Security Measures

We maintain administrative, technical and physical safeguards designed to protect personal data, including: AES-256 encryption at rest and TLS 1.3 in transit; role-based access control with multi-factor authentication; quarterly penetration testing and vulnerability scanning; 24/7 infrastructure monitoring with automated alerting; annual security awareness training for all personnel; and incident response procedures with notification within 72 hours where a personal data breach is likely to result in high risk to data subjects.

9. Your Rights

9.1 GDPR Rights (EEA, UK, Switzerland)

You may exercise the following rights free of charge: access to your personal data; rectification of inaccurate data; erasure ("right to be forgotten") where no overriding legal basis applies; restriction of processing; data portability in a structured, machine-readable format; and objection to processing based on legitimate interests or direct marketing.

9.2 CCPA/CPRA Rights (California Residents)

California consumers have the right to: know what personal information is collected and how it is used; request deletion; opt out of the sale or sharing of personal information (we do not sell personal information); and non-discrimination for exercising privacy rights.

9.3 How to Exercise Your Rights

Submit a request to Service@studio998.com with the subject line "Privacy Rights Request". We will verify your identity, respond within 30 calendar days and provide the information in a commonly used electronic format. If we cannot fulfill a request (e.g. due to legal retention obligations), we will explain the reason in writing.

10. Children's Privacy

Studio998 provides business-to-business services and does not knowingly collect personal information from individuals under the age of 16. If we become aware that data relating to a child has been submitted, we will delete it promptly. Parents or guardians who believe a child has provided us with personal data may contact us at the email above.

11. Third-Party Links

Our website may contain links to third-party sites operated by payment partners, compliance providers or industry resources. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party service before submitting personal information.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in law, technology or business practices. The "Last updated" date at the top of this page indicates the most recent revision. Material changes will be communicated via email to affected clients at least 30 days before taking effect. Continued use of our services after the effective date constitutes acceptance of the revised Policy.

13. Contact Us and Supervisory Authorities

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

Studio998
Riverview, Florida, United States
Email: Service@studio998.com

EEA and UK data subjects also have the right to lodge a complaint with their local supervisory authority (e.g. the ICO in the United Kingdom, or the relevant state DPA in the EU member state of residence).

Other Policies

Cookie Policy — our tracking-free approach to cookies and similar technologies on studio998.com.
Terms of Service — the contractual terms governing use of Studio998 services.
Refund Policy — refund eligibility, timelines and dispute procedures.