Privacy and Cookie Policy

Last updated: October 2026

1. Who is responsible

New Page Studio, operated by Cristina Frascolla, Seestrasse 27, 8002 Zurich, Switzerland, email: hello.newpagestudio@gmail.com, ("I"), is responsible for the data processing described here. This policy explains what personal data I process when you visit this website, contact me, book a call or work with me, why I do it, who receives it and what rights you have. It follows the Swiss Federal Act on Data Protection (FADP) and, for visitors in the EU or EEA, the General Data Protection Regulation (GDPR) where it applies.

2. In short

  • I process only the data needed to run this site, answer you and work with clients.

  • Analytics cookies stay off until you accept them (see section 4).

  • I do not use advertising cookies, tracking pixels, a newsletter, blog comments or an online shop.

  • I do not sell personal data.

3. Visiting this website

This website is built and hosted on Squarespace. When you open a page, Squarespace processes technical data such as your IP address, browser and device type, operating system, the pages you request, the page you came from, and the date and time. This is needed to deliver the site, keep it secure and detect misuse. The provider is Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland, together with its parent company Squarespace, Inc. in the USA. The fonts on this site are delivered through Squarespace.

Legal basis for visitors covered by the GDPR: legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

4. Cookies

Cookies are small files that your browser stores. When you first visit, a banner asks whether you accept analytics cookies. Nothing optional is set before you choose, and declining is as easy as accepting.

  • Necessary (always on): core functions, security and remembering your cookie choice. Examples set by Squarespace: crumb (security, session) and ss_performancecookiesAllowed and ss_marketingcookiesAllowed (your cookie choice, 30 days).

  • Performance and Analytics (off until you accept): count visits and traffic sources through Squarespace Analytics, to improve the site. Examples set by Squarespace: ss_cid, ss_cpvisit and ss_cvr (about 2 years each), ss_cvisit and ss_cvt (about 30 minutes each).

  • Advertising (off, and not used by me): no cookies of this kind are set.

Cookie names and lifetimes are set by Squarespace and can change; Squarespace publishes its current list in The cookies Squarespace uses. Legal basis: your consent for analytics cookies (Art. 6(1)(a) GDPR); necessary cookies rest on my legitimate interest in a working and secure site.

Changing or withdrawing your choice. The banner appears again after about 30 days, or at once if you delete this site's cookies in your browser settings. You can then choose anew.

5. Contacting me

If you write to me by email or through the contact form, I process your name, email address, your message and anything else you choose to send. The form is provided by Squarespace, which stores submissions and forwards them to my Gmail inbox. I use this data to answer you and, if you ask, to prepare an offer. Please do not send sensitive information such as health data through the form.

Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR) and my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Enquiries that do not lead to a project are kept only as long as needed to answer you and follow up, and are deleted at any time on request. I review them about once a year.

6. Booking a call

The "Book a free call" button opens a booking page provided by Google Calendar, in a new tab and outside this website. On that page you enter your name, email address and a time, and sometimes a short message. Google processes this under its own privacy policy (Google Ireland Limited and Google LLC). I receive the booking details and use them only to hold the call. Google may add a calendar invitation or a video-call link to your email.

Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR).

7. Working together

If you become a client, I process your contact details, business details, the content you send me (texts, images, access to your website account), proposals, contracts, invoices and our correspondence. I use them to deliver the work, invoice you and meet accounting duties. I use Google (Gmail) for email, Squarespace to create and issue invoices and, where we agree on it, shared project spaces such as Notion or Google Drive. Where I work inside your own Squarespace account, I handle your visitors' data only as far as the job requires and on your instructions. I may use AI assistants (for example Claude by Anthropic) to develop ideas and refine texts. I do not enter clients' personal data or access credentials into them. Invoices are paid by bank transfer, TWINT, Wise or PayPal; these providers process your payment data under their own privacy policies. My tax advisor receives invoices for bookkeeping.

Legal basis: performing our contract (Art. 6(1)(b) GDPR) and legal duties such as bookkeeping (Art. 6(1)(c) GDPR).

8. Social media and external links

This website links to [Instagram]. These are plain links: no plugins or embedded feeds load on my pages, so those platforms receive nothing from you until you click. After that, their own privacy policies apply, and the same goes for any other external site I link to.

9. Who receives your data

  • Squarespace (hosting, contact form storage, Squarespace Analytics, invoices)

  • Google (Gmail email and the Calendar booking page)

  • TWINT, Wise, PayPal and my bank (payments), and my tax advisor (bookkeeping)

  • Authorities or courts, if the law requires it

These providers act on my behalf under their own terms, or independently where they run their own service. I do not sell your data or use it for advertising.

10. Disclosure abroad

Some of these providers are based in or use servers in the USA. Switzerland recognises an adequate level of protection for US companies certified under the Swiss-U.S. Data Privacy Framework, in force since 15 September 2024, and the EU does the same for the EU-U.S. Data Privacy Framework. Where a recipient is not certified, I rely on standard contractual clauses, which Squarespace includes in its data processing addendum. You can check certifications at dataprivacyframework.gov.

11. How long I keep data

  • Technical data and cookies: as set out in section 4 and by Squarespace's own retention rules.

  • Enquiries and bookings that do not lead to a project: only as long as needed to answer you and follow up, reviewed about once a year and deleted at any time on request.

  • Other client project material (files, drafts, messages, backups): about 2 years after the project ends, unless a legal duty or a claim requires longer. Access credentials are deleted when the work ends.

  • Contracts, invoices, accounting records and key project correspondence kept as proof: up to 10 years (Art. 958f of the Swiss Code of Obligations).

Afterwards I delete or anonymise the data.

12. Security

This website is served over an encrypted HTTPS connection, and I limit access to your data to what the work needs. No online transmission or storage is completely secure, so I cannot guarantee absolute security.

13. Your rights

Under the FADP and, where it applies, the GDPR, you can ask me for access to your data, correction, deletion, restriction of processing and a copy in a common format. You can object to processing based on my legitimate interests, and you can withdraw any consent at any time with effect for the future; earlier processing stays lawful. Write to hello.newpagestudio@gmail.com. I may ask you to prove your identity and will answer within 30 days. In complex cases I will tell you if I need more time.

You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch, or, if you live outside Switzerland, to the data protection authority in your country.

14. Automated decisions

I do not make decisions based solely on automated processing and do not profile visitors.

15. Changes

I may update this policy when my website or the law changes. The current version is always on this page, with its date at the top.