This privacy policy explains what data we collect when you visit our website, how we use it, and what rights you have under the GDPR (General Data Protection Regulation).
Controller
Server log files (access data)
When you visit this website, our hosting provider automatically collects technical access data: IP address, browser type and version, operating system, referring URL, and date/time of access. This data is stored in server log files for up to 14 days for security and stability purposes (Art. 6 (1) (f) GDPR — legitimate interest in operating a stable, secure website). It is not merged with other data sources and is not used to identify individuals.
Hosting
This website is hosted on infrastructure provided by a cloud hosting provider (e.g. Vercel Inc., Netlify Inc., or Cloudflare Inc., depending on deployment). Personal data such as IP addresses may be processed in the USA. Where data is transferred outside the EU, this is done on the basis of EU Standard Contractual Clauses (Art. 46 GDPR) to ensure an appropriate level of protection. Legal basis: Art. 6 (1) (f) GDPR.
Google Fonts
This website uses fonts from Google Fonts (provided by Google Ireland Ltd.) to display typefaces consistently. When you load a page, your browser fetches the required font files from Google's servers, transmitting your IP address. Google may process this data in the USA based on EU Standard Contractual Clauses. Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in a consistent, professional presentation. More info: policies.google.com/privacy.
Application form
When you submit the application form, we process the contact information you provide (e.g. email address or Instagram handle) plus the time of submission, in order to respond to your enquiry. The form is processed via Formspree (Formspree Inc., USA). Data may be processed in the USA based on EU Standard Contractual Clauses. We store your submission only as long as needed to handle your enquiry and any resulting business relationship. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (a) GDPR (consent). If we use the email fallback, your email client opens with a pre-filled message; nothing is stored on our side until you actually send the email.
Web analytics
We may use a privacy-friendly analytics service (e.g. Plausible Analytics, hosted in the EU) to understand which pages are visited and where traffic comes from. No cookies are set, no personal data is stored, and no cross-site tracking takes place. Aggregated, anonymised data only. Legal basis: Art. 6 (1) (f) GDPR. If we deploy a service that requires consent (e.g. Google Analytics), we will ask for your consent via a cookie banner first.
Cookies
This website does not set any cookies that require consent. Only technically essential session storage may be used to keep your language preference within a single visit. No tracking cookies, no marketing cookies, no third-party cookies are placed without your consent.
Your rights
Under the GDPR, you have the right to: access your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and object to processing (Art. 21). You may also withdraw any consent you have given at any time, with effect for the future. To exercise these rights, contact us using the details above. You also have the right to lodge a complaint with a data protection supervisory authority — for our location, this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
Changes to this policy
We may update this privacy policy to reflect changes to our services or legal requirements. The current version always applies — the "last updated" date below tells you when it was last revised.
Last updated: April 2026