Privacy statement — Studio

1. What Studio is

Studio is a closed suite of tools that Junnect uses to run online marketing for its clients. It brings together the planning, approval and publishing of social-media content, SEO content tooling for our clients' own websites, and Link in Bio pages. Only Junnect employees and authorised users of our clients have access. Studio is not a public product and is not offered or resold to third parties.

Through Studio we connect the business pages, accounts and websites that our clients ask us to manage. We only process data from pages, accounts and websites for which the client concerned has explicitly authorised us as manager.

2. Which personal data we process

Within Studio we process the following categories of personal data.

Data of Studio users (Junnect employees and client contacts):

name, e-mail address and telephone number
sign-in data, including the one-time login codes used by the client approval portal
role and access rights within the platform
activity within the platform, such as content created, approved and published

Data we receive through the connections with social-media platforms:

access and authorisation tokens that make the connection with a page possible
data about the connected business page and the administrators linked to it
statistics about pages and posts, such as reach, impressions, clicks and interactions
personal data of people who interact with our clients' content, such as their name, their profile and the replies, comments or reactions they leave on a post

We do not actively collect this data from the public ourselves. We receive it from the social-media platform concerned, on the basis of the authorisation granted by the client.

Data about visitors of public Link in Bio pages:

coarse, aggregated visit and click statistics, including the type of device, browser and operating system derived from technical request data
we use these figures only to report on how a page performs; we do not build advertising profiles and do not follow visitors across other websites

Website and search-performance data for our SEO tooling:

the content and structure of the client's own website, which our tooling reads in order to suggest improvements
search-performance data from Google Search Console for that same website, such as search queries, impressions, clicks and average position — this data describes the website, not identifiable visitors

3. Purposes of the processing

We process these personal data for the following purposes:

planning, reviewing, approving, scheduling and publishing content on the channels we manage for our clients
running our approval workflow, in which content moves through the statuses draft, awaiting approval and scheduled, and in which both a Junnect account manager and the client sign off before anything is published
displaying and managing reactions and interactions on our clients' content, so that we can carry out community management on their behalf
compiling performance and analysis reports for our clients
improving the content and findability of our clients' own websites through our SEO tooling
securing access to the platform and preventing misuse

4. Legal bases for the processing

We process personal data on the following legal bases under the GDPR:

performance of a contract, for managing the channels and websites we look after under our services agreement with the client
legitimate interest, for securing the platform, carrying out community management and reporting on performance, weighing the interests of the people concerned against the running of our business
legal obligation, insofar as we are required by law to retain or provide data

5. Our role: processor and controller

Our role under the GDPR differs per type of data.

For the personal data processed through the connected channels and websites — such as data of people who react to a client's content — Junnect acts in principle as a processor on behalf of the client. In that case the client is the controller and determines the purposes and means of the processing. We record the arrangements for this in a processing agreement with the client.

For the data of platform users and the data we need in order to secure and administer Studio, Junnect acts as the controller.

6. Connections with social-media platforms

Studio uses connections with external social-media platforms, including Meta (Facebook and Instagram), TikTok, LinkedIn and Pinterest. A connection is established through a secure authorisation (OAuth), in which the administrator of a page explicitly grants Studio access to that page.

These platforms also process personal data themselves and act as independent parties with their own responsibility and their own privacy policy. When we receive data or publish content through their connections, the terms and privacy policy of the platform concerned apply as well. We refer you to:

We use these connections solely to publish content on, and report about, the pages we are allowed to manage. We do not automate interactions, we do not send unsolicited messages, and we do not use the connections to collect data outside the authorised pages.

7. Sharing with third parties

We do not sell personal data and we do not share it with third parties for commercial purposes. We share data only:

with the social-media platforms, insofar as necessary to publish content and retrieve statistics
with the hosting and infrastructure providers that run the platform, and with Cloudflare, which stores and delivers the media files used in published content and routes the custom domains of Link in Bio pages
with the provider of our transactional e-mail (Brevo or our own mail server), for messages such as one-time login codes and approval notifications
with the AI providers that help us draft content (Anthropic and OpenAI). What we send them is the content being worked on; we do not send the names or e-mail addresses of platform users
with Google, for retrieving search-performance data from Search Console for our clients' own websites and for measuring page speed
with Canva and Shutterstock, where a user chooses to import or license media through those services
when we are legally obliged to do so

Suppliers that process personal data on our behalf do so under a processing agreement. Suppliers outside the European Economic Area are engaged only with appropriate safeguards in place.

8. Retention periods

We do not keep personal data longer than is necessary for the purposes for which it was collected. Published content and the accompanying statistics are kept for as long as we manage the channel for the client, so that we can report on performance.

After our services end, we delete the connected access tokens and delete or anonymise the accompanying personal data within a reasonable period, unless a statutory retention obligation provides otherwise. Short-lived data such as one-time login codes and visit statistics is removed on its own, shorter schedule.

9. Security

We take appropriate technical and organisational measures to secure personal data. Junnect employees sign in to Studio through the single sign-on of our organisation's Microsoft account, with multi-factor authentication. Client contacts sign in to the approval portal with a one-time code sent to their e-mail address, so there are no shared passwords.

Connections with social-media platforms run through secure authorisation (OAuth), and access tokens are stored encrypted. Access to data is limited to the employees and client contacts who need it for their work, and traffic to the platform runs over an encrypted connection.

10. Rights of data subjects

Under the GDPR, data subjects have the right to access their personal data, to have it corrected or erased, and to object to or request restriction of the processing.

For data in respect of which we act as a processor, we forward a request to the relevant controller — usually the client whose page or website it concerns. For data in respect of which we are the controller, a request can be submitted directly to us.

For people who interact with our clients' content, the management of their account data and privacy settings lies with the social-media platform concerned.

11. Contact

For questions about this privacy statement or about the processing of personal data within Studio, please contact Junnect at [email protected].

Data subjects also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).